@aimee.shop/sdk 0.26.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ziftr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,144 @@
+# Aimee TypeScript SDKs
+
+This repo publishes two ESM TypeScript SDK packages from one npm workspace.
+
+## Packages
+
+### `@aimee.shop/sdk`
+
+Public SDK for storefront and merchant-safe commerce APIs.
+
+```bash
+npm install @aimee.shop/sdk
+```
+
+```typescript
+import { ZiftrSDK } from '@aimee.shop/sdk';
+
+const sdk = new ZiftrSDK({
+  apiKey: process.env.ZIFTR_API_KEY,
+  tenantId: 'tenant-uuid',
+});
+
+const products = await sdk.products.list({ limit: 20 });
+const checkout = await sdk.checkout.create({ cartId: 'cart-uuid' });
+```
+
+Browser usage:
+
+```typescript
+import { ziftr, browserAuth } from '@aimee.shop/sdk/browser';
+
+await browserAuth.signIn('user@example.com', 'password');
+const products = await ziftr.products.list();
+```
+
+### `@aimee.shop/sdk-platform`
+
+Internal/admin SDK for platform operations. It includes the public SDK surface plus RBAC, payments admin, workflows, notifications, tenants, users/admin, API keys, UCP/admin, sandbox promotion, and content copy.
+
+```bash
+npm install @aimee.shop/sdk @aimee.shop/sdk-platform
+```
+
+```typescript
+import { ZiftrPlatformSDK } from '@aimee.shop/sdk-platform';
+
+const sdk = new ZiftrPlatformSDK({
+  apiKey: process.env.ZIFTR_API_KEY,
+  tenantId: 'tenant-uuid',
+});
+
+const roles = await sdk.rbac.roles.list();
+const tenants = await sdk.tenants.list();
+```
+
+## Development
+
+```bash
+npm install
+npm run build
+npm run typecheck
+npm test
+npm run status
+npm run pack:dry-run
+```
+
+Quality rules:
+
+- `npm run status` must pass before commit.
+- No `any`, `as any`, or `@ts-ignore`.
+- Public package must not include platform service files.
+- Platform package is the only package that exposes internal/admin clients.
+
+## Authentication
+
+Supported auth modes:
+
+- API key for server-side consumers.
+- `getAccessToken` for browser/framework-managed sessions.
+- Cognito email/password for service-style auth.
+- Interactive auth for local development.
+
+```typescript
+const sdk = new ZiftrSDK({
+  getAccessToken: () => authContext.getToken(),
+  tenantId: 'tenant-uuid',
+});
+```
+
+## Multi-Tenant Context
+
+```typescript
+const tenantSdk = sdk.withTenant('other-tenant');
+const storeSdk = sdk.withStore('store-uuid');
+```
+
+Scoped instances share authentication but get their own HTTP client so tenant/store headers are isolated.
+
+## Notification config (server / `sk_` only)
+
+List which transactional definitions exist for a store and fire a test send
+without placing an order. Requires a secret API key (`sk_`) or admin JWT with
+`notification-config:read` / `notification-config:trigger`, plus store context.
+Publishable (`pk_`) keys return 403. This is not on `@aimee.shop/sdk/storefront`.
+Admin template/provider work stays on `@aimee.shop/sdk-platform` (`sdk.notifications`).
+
+```typescript
+sdk.setStore(storeId);
+const { items } = await sdk.notificationConfig.list();
+await sdk.notificationConfig.testSend({
+  eventName: 'order.created',
+  to: 'dev@example.com',
+});
+```
+
+The live order-confirmation event is `order.created` (not `order.confirmed`).
+
+## CSV exports (server / `sk_` only)
+
+Create an async CSV export job, poll until `completed`, then open the
+presigned download URL. Requires `{entity}:export` (`orders:export`,
+`products:export`, `customers:export`) plus store context for store-scoped
+entities. Publishable (`pk_`) keys return 403. This is not on
+`@aimee.shop/sdk/storefront`.
+
+```typescript
+sdk.setStore(storeId);
+const { jobId } = await sdk.exports.create(
+  { entity: 'orders', filters: { status: 'PAID' }, columnSet: 'summary' },
+  { idempotencyKey: crypto.randomUUID() },
+);
+const job = await sdk.exports.get(jobId);
+if (job.status === 'completed') {
+  const { downloadUrl } = await sdk.exports.getDownloadUrl(jobId);
+}
+```
+
+## Package Boundary
+
+Use `@aimee.shop/sdk` for storefronts, public developer tooling, and merchant-safe integrations.
+
+Use `@aimee.shop/sdk-platform` for admin UI, internal services, and tools that need platform operations.
+
+`@aimee.shop/sdk-platform` peer-depends on `@aimee.shop/sdk` and extends its public SDK class. Platform consumers should import SDK symbols from `@aimee.shop/sdk-platform` when they need the combined public plus platform surface.

package/dist/browser/browser-auth.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Browser-side Cognito authentication helper.
+ * Auto-detects and manages Cognito session from localStorage.
+ *
+ * Uses COGNITO_CONFIG resolved from environment variables at runtime.
+ * Set ZIFTR_COGNITO_USER_POOL_ID and ZIFTR_COGNITO_CLIENT_ID (or NEXT_PUBLIC_ variants).
+ *
+ * @example
+ * ```typescript
+ * import { browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * // Sign in
+ * await browserAuth.signIn('user@example.com', 'password');
+ *
+ * // Get current user
+ * const user = await browserAuth.getCurrentUser();
+ *
+ * // Sign out
+ * browserAuth.signOut();
+ * ```
+ */
+import { CognitoUserSession } from 'amazon-cognito-identity-js';
+/**
+ * User identity from Cognito JWT.
+ * Note: Tenant membership comes from /users/me/tenants API, not JWT.
+ * Note: Roles/permissions come from RBAC service, not JWT.
+ */
+export interface BrowserUser {
+    email: string;
+    sub: string;
+}
+/**
+ * Result of a successful sign-in
+ */
+export interface SignInResult {
+    user: BrowserUser;
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+}
+/**
+ * Cognito authentication flow for sign-in.
+ *
+ * - `USER_SRP_AUTH` (default): two round trips with an SRP zero-knowledge
+ *   proof; the password never leaves the browser.
+ * - `USER_PASSWORD_AUTH`: single round trip; the password is sent to Cognito
+ *   over TLS. Faster, but only appropriate for first-party apps over HTTPS.
+ */
+export type CognitoAuthFlow = 'USER_SRP_AUTH' | 'USER_PASSWORD_AUTH';
+/**
+ * Options for {@link BrowserAuth.signIn}.
+ */
+export interface SignInOptions {
+    /**
+     * Cognito authentication flow. Defaults to `USER_SRP_AUTH`.
+     *
+     * `USER_PASSWORD_AUTH` skips the SRP challenge round trip (saves a network
+     * round trip plus client-side SRP crypto) at the cost of sending the
+     * password to Cognito over TLS instead of an SRP zero-knowledge proof.
+     * Keep the default for public/storefront clients; opt in only for
+     * first-party apps. Requires `ALLOW_USER_PASSWORD_AUTH` on the Cognito app
+     * client, otherwise Cognito rejects with NotAuthorizedException.
+     */
+    authFlow?: CognitoAuthFlow;
+}
+/**
+ * Browser-side Cognito authentication helper.
+ * Manages Cognito user pool session in the browser.
+ */
+export declare class BrowserAuth {
+    private pool;
+    /**
+     * Get or create the Cognito user pool instance.
+     * Uses COGNITO_CONFIG resolved from environment variables.
+     */
+    private getPool;
+    /**
+     * Get the current access token from the Cognito session.
+     * Returns null if not authenticated.
+     */
+    getAccessToken(): Promise<string | null>;
+    /**
+     * Get the current ID token from the Cognito session.
+     * Returns null if not authenticated.
+     */
+    getIdToken(): Promise<string | null>;
+    /**
+     * Get the current authenticated user.
+     * Returns null if not authenticated.
+     */
+    getCurrentUser(): Promise<BrowserUser | null>;
+    /**
+     * Check if there is a valid authenticated session.
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Sign in with email and password.
+     *
+     * Uses the SRP flow by default. Pass `{ authFlow: 'USER_PASSWORD_AUTH' }`
+     * to authenticate in a single round trip (see {@link SignInOptions}).
+     */
+    signIn(email: string, password: string, options?: SignInOptions): Promise<SignInResult>;
+    /**
+     * Sign out the current user.
+     * Clears the local session.
+     */
+    signOut(): void;
+    /**
+     * Refresh the current session.
+     * Returns the new session or null if refresh failed.
+     */
+    refreshSession(): Promise<CognitoUserSession | null>;
+}
+export declare const browserAuth: BrowserAuth;
+//# sourceMappingURL=browser-auth.d.ts.map

package/dist/browser/browser-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-auth.d.ts","sourceRoot":"","sources":["../../../../src/browser/browser-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAIL,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAGpC;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAgC;IAE5C;;;OAGG;IACH,OAAO,CAAC,OAAO;IA0Bf;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwB9C;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuB1C;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA8BnD;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAKzC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA0C7F;;;OAGG;IACH,OAAO,IAAI,IAAI;IAYf;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CAkC3D;AAGD,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/browser/browser-auth.js

@@ -0,0 +1,234 @@
+/**
+ * Browser-side Cognito authentication helper.
+ * Auto-detects and manages Cognito session from localStorage.
+ *
+ * Uses COGNITO_CONFIG resolved from environment variables at runtime.
+ * Set ZIFTR_COGNITO_USER_POOL_ID and ZIFTR_COGNITO_CLIENT_ID (or NEXT_PUBLIC_ variants).
+ *
+ * @example
+ * ```typescript
+ * import { browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * // Sign in
+ * await browserAuth.signIn('user@example.com', 'password');
+ *
+ * // Get current user
+ * const user = await browserAuth.getCurrentUser();
+ *
+ * // Sign out
+ * browserAuth.signOut();
+ * ```
+ */
+import { CognitoUserPool, CognitoUser, AuthenticationDetails, } from 'amazon-cognito-identity-js';
+import { COGNITO_CONFIG } from '../core/config.js';
+/**
+ * Browser-side Cognito authentication helper.
+ * Manages Cognito user pool session in the browser.
+ */
+export class BrowserAuth {
+    pool = null;
+    /**
+     * Get or create the Cognito user pool instance.
+     * Uses COGNITO_CONFIG resolved from environment variables.
+     */
+    getPool() {
+        if (this.pool) {
+            return this.pool;
+        }
+        // Check for browser environment
+        if (typeof window === 'undefined') {
+            throw new Error('BrowserAuth can only be used in browser environments. ' +
+                'For server-side usage, use ZiftrSDK with apiKey instead.');
+        }
+        // Validate Cognito config is available (resolved from env vars or defaults)
+        if (!COGNITO_CONFIG.userPoolId || !COGNITO_CONFIG.clientId) {
+            throw new Error('Cognito configuration not available. This is an SDK build issue.');
+        }
+        this.pool = new CognitoUserPool({
+            UserPoolId: COGNITO_CONFIG.userPoolId,
+            ClientId: COGNITO_CONFIG.clientId,
+        });
+        return this.pool;
+    }
+    /**
+     * Get the current access token from the Cognito session.
+     * Returns null if not authenticated.
+     */
+    async getAccessToken() {
+        try {
+            const pool = this.getPool();
+            const user = pool.getCurrentUser();
+            if (!user) {
+                return null;
+            }
+            return new Promise((resolve) => {
+                user.getSession((err, session) => {
+                    if (err || !session?.isValid()) {
+                        resolve(null);
+                        return;
+                    }
+                    resolve(session.getAccessToken().getJwtToken());
+                });
+            });
+        }
+        catch {
+            // Pool initialization failed (missing config, SSR, etc.)
+            return null;
+        }
+    }
+    /**
+     * Get the current ID token from the Cognito session.
+     * Returns null if not authenticated.
+     */
+    async getIdToken() {
+        try {
+            const pool = this.getPool();
+            const user = pool.getCurrentUser();
+            if (!user) {
+                return null;
+            }
+            return new Promise((resolve) => {
+                user.getSession((err, session) => {
+                    if (err || !session?.isValid()) {
+                        resolve(null);
+                        return;
+                    }
+                    resolve(session.getIdToken().getJwtToken());
+                });
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Get the current authenticated user.
+     * Returns null if not authenticated.
+     */
+    async getCurrentUser() {
+        try {
+            const pool = this.getPool();
+            const cognitoUser = pool.getCurrentUser();
+            if (!cognitoUser) {
+                return null;
+            }
+            return new Promise((resolve) => {
+                cognitoUser.getSession((err, session) => {
+                    if (err || !session?.isValid()) {
+                        resolve(null);
+                        return;
+                    }
+                    const idToken = session.getIdToken();
+                    const payload = idToken.decodePayload();
+                    resolve({
+                        email: payload.email,
+                        sub: payload.sub,
+                    });
+                });
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check if there is a valid authenticated session.
+     */
+    async isAuthenticated() {
+        const token = await this.getAccessToken();
+        return token !== null;
+    }
+    /**
+     * Sign in with email and password.
+     *
+     * Uses the SRP flow by default. Pass `{ authFlow: 'USER_PASSWORD_AUTH' }`
+     * to authenticate in a single round trip (see {@link SignInOptions}).
+     */
+    async signIn(email, password, options) {
+        const pool = this.getPool();
+        const authDetails = new AuthenticationDetails({
+            Username: email,
+            Password: password,
+        });
+        const cognitoUser = new CognitoUser({
+            Username: email,
+            Pool: pool,
+        });
+        if (options?.authFlow === 'USER_PASSWORD_AUTH') {
+            cognitoUser.setAuthenticationFlowType('USER_PASSWORD_AUTH');
+        }
+        return new Promise((resolve, reject) => {
+            cognitoUser.authenticateUser(authDetails, {
+                onSuccess: (session) => {
+                    const idTokenPayload = session.getIdToken().decodePayload();
+                    resolve({
+                        user: {
+                            email: idTokenPayload.email,
+                            sub: idTokenPayload.sub,
+                        },
+                        accessToken: session.getAccessToken().getJwtToken(),
+                        idToken: session.getIdToken().getJwtToken(),
+                        refreshToken: session.getRefreshToken().getToken(),
+                    });
+                },
+                onFailure: (err) => {
+                    reject(err);
+                },
+                newPasswordRequired: () => {
+                    reject(new Error('NEW_PASSWORD_REQUIRED'));
+                },
+            });
+        });
+    }
+    /**
+     * Sign out the current user.
+     * Clears the local session.
+     */
+    signOut() {
+        try {
+            const pool = this.getPool();
+            const user = pool.getCurrentUser();
+            if (user) {
+                user.signOut();
+            }
+        }
+        catch {
+            // Ignore errors during sign out
+        }
+    }
+    /**
+     * Refresh the current session.
+     * Returns the new session or null if refresh failed.
+     */
+    async refreshSession() {
+        try {
+            const pool = this.getPool();
+            const user = pool.getCurrentUser();
+            if (!user) {
+                return null;
+            }
+            return new Promise((resolve) => {
+                user.getSession((err, session) => {
+                    if (err || !session) {
+                        resolve(null);
+                        return;
+                    }
+                    const refreshToken = session.getRefreshToken();
+                    user.refreshSession(refreshToken, (refreshErr, newSession) => {
+                        if (refreshErr) {
+                            resolve(null);
+                            return;
+                        }
+                        resolve(newSession);
+                    });
+                });
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
+// Default singleton instance
+export const browserAuth = new BrowserAuth();
+//# sourceMappingURL=browser-auth.js.map

package/dist/browser/browser-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-auth.js","sourceRoot":"","sources":["../../../../src/browser/browser-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,WAAW,EACX,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAiDnD;;;GAGG;AACH,MAAM,OAAO,WAAW;IACd,IAAI,GAA2B,IAAI,CAAC;IAE5C;;;OAGG;IACK,OAAO;QACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,QAAQ,EAAE,cAAc,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,GAAiB,EAAE,OAAkC,EAAE,EAAE;oBACxE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,GAAiB,EAAE,OAAkC,EAAE,EAAE;oBACxE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAE1C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,WAAW,CAAC,UAAU,CAAC,CAAC,GAAiB,EAAE,OAAkC,EAAE,EAAE;oBAC/E,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;oBAExC,OAAO,CAAC;wBACN,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,OAAuB;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAE5B,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;YAClC,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC/C,WAAW,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,WAAW,CAAC,gBAAgB,CAAC,WAAW,EAAE;gBACxC,SAAS,EAAE,CAAC,OAA2B,EAAE,EAAE;oBACzC,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;oBAE5D,OAAO,CAAC;wBACN,IAAI,EAAE;4BACJ,KAAK,EAAE,cAAc,CAAC,KAAK;4BAC3B,GAAG,EAAE,cAAc,CAAC,GAAG;yBACxB;wBACD,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE;wBACnD,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE;wBAC3C,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,SAAS,EAAE,CAAC,GAAU,EAAE,EAAE;oBACxB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;gBACD,mBAAmB,EAAE,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;gBAC7C,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,GAAiB,EAAE,OAAkC,EAAE,EAAE;oBACxE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;wBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;oBAE/C,IAAI,CAAC,cAAc,CACjB,YAAY,EACZ,CAAC,UAAwB,EAAE,UAAqC,EAAE,EAAE;wBAClE,IAAI,UAAU,EAAE,CAAC;4BACf,OAAO,CAAC,IAAI,CAAC,CAAC;4BACd,OAAO;wBACT,CAAC;wBACD,OAAO,CAAC,UAAU,CAAC,CAAC;oBACtB,CAAC,CACF,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/browser/index.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Browser entry point for @aimee.shop/sdk
+ *
+ * Provides a pre-configured SDK instance that automatically detects
+ * Cognito session from localStorage. No manual token injection required.
+ *
+ * @example
+ * ```typescript
+ * // Simple, Stripe-like usage!
+ * import { ziftr } from '@aimee.shop/sdk/browser';
+ *
+ * // Just works - auth auto-detected from Cognito session
+ * const products = await ziftr.products.list();
+ * const orders = await ziftr.orders.list();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Sign in and use
+ * import { ziftr, browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * await browserAuth.signIn('admin@example.com', 'password');
+ * const products = await ziftr.products.list();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Check authentication status
+ * import { browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * const isLoggedIn = await browserAuth.isAuthenticated();
+ * const user = await browserAuth.getCurrentUser();
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { ZiftrSDK } from '../core/sdk.js';
+import { browserAuth, BrowserAuth, BrowserUser, SignInResult, SignInOptions, CognitoAuthFlow } from './browser-auth.js';
+/**
+ * Pre-configured SDK instance with auto-detected browser Cognito auth.
+ *
+ * This singleton automatically:
+ * - Detects Cognito session from localStorage
+ * - Injects ID token into all API requests
+ *
+ * For server-side usage, use `ZiftrSDK` with `apiKey` instead.
+ *
+ * @example
+ * ```typescript
+ * import { ziftr } from '@aimee.shop/sdk/browser';
+ *
+ * // No setup needed - just use it!
+ * const products = await ziftr.products.list();
+ * ```
+ */
+export declare const ziftr: ZiftrSDK;
+export { browserAuth };
+export type { BrowserAuth, BrowserUser, SignInResult, SignInOptions, CognitoAuthFlow };
+export { ZiftrSDK };
+export type { ZiftrSDKConfig, ServiceEndpoints, CognitoConfig } from '../core/config.js';
+export { COGNITO_CONFIG } from '../core/config.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/browser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/browser/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,UAMhB,CAAC;AAGH,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAGvF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIzF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/browser/index.js

@@ -0,0 +1,69 @@
+/**
+ * Browser entry point for @aimee.shop/sdk
+ *
+ * Provides a pre-configured SDK instance that automatically detects
+ * Cognito session from localStorage. No manual token injection required.
+ *
+ * @example
+ * ```typescript
+ * // Simple, Stripe-like usage!
+ * import { ziftr } from '@aimee.shop/sdk/browser';
+ *
+ * // Just works - auth auto-detected from Cognito session
+ * const products = await ziftr.products.list();
+ * const orders = await ziftr.orders.list();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Sign in and use
+ * import { ziftr, browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * await browserAuth.signIn('admin@example.com', 'password');
+ * const products = await ziftr.products.list();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Check authentication status
+ * import { browserAuth } from '@aimee.shop/sdk/browser';
+ *
+ * const isLoggedIn = await browserAuth.isAuthenticated();
+ * const user = await browserAuth.getCurrentUser();
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { ZiftrSDK } from '../core/sdk.js';
+import { browserAuth, } from './browser-auth.js';
+/**
+ * Pre-configured SDK instance with auto-detected browser Cognito auth.
+ *
+ * This singleton automatically:
+ * - Detects Cognito session from localStorage
+ * - Injects ID token into all API requests
+ *
+ * For server-side usage, use `ZiftrSDK` with `apiKey` instead.
+ *
+ * @example
+ * ```typescript
+ * import { ziftr } from '@aimee.shop/sdk/browser';
+ *
+ * // No setup needed - just use it!
+ * const products = await ziftr.products.list();
+ * ```
+ */
+export const ziftr = new ZiftrSDK({
+    // Auto-inject Cognito ID token (backend @ziftr/auth expects tokenUse: 'id')
+    getAccessToken: () => browserAuth.getIdToken(),
+    // Debug mode follows NODE_ENV
+    debug: process.env.NODE_ENV === 'development',
+});
+// Re-export auth helper for login/logout
+export { browserAuth };
+// Re-export main SDK class and types (for advanced usage)
+export { ZiftrSDK };
+// Re-export Cognito config for frontends that manage their own auth
+// but want to use the SDK's baked-in configuration
+export { COGNITO_CONFIG } from '../core/config.js';
+//# sourceMappingURL=index.js.map

package/dist/browser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/browser/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,WAAW,GAMZ,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC;IAChC,4EAA4E;IAC5E,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE;IAE9C,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;CAC9C,CAAC,CAAC;AAEH,yCAAyC;AACzC,OAAO,EAAE,WAAW,EAAE,CAAC;AAKvB,0DAA0D;AAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC;AAGpB,oEAAoE;AACpE,mDAAmD;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/core/auth/api-key.authenticator.d.ts

@@ -0,0 +1,16 @@
+import type { Authenticator } from './authenticator.js';
+/**
+ * API Key authenticator - highest priority in the chain.
+ * Simply adds the API key to request headers.
+ */
+export declare class ApiKeyAuthenticator implements Authenticator {
+    readonly name = "api-key";
+    readonly priority = 1;
+    private readonly apiKey;
+    constructor(apiKey: string);
+    canAuthenticate(): boolean;
+    getAuthHeaders(): Promise<Record<string, string>>;
+    isExpired(): boolean;
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=api-key.authenticator.d.ts.map