@augstash/sdk 0.2.0 → 0.3.0

package/dist/generated/src/apis/SsoSettingsApi.js

@@ -0,0 +1,242 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SsoSettingsApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const index_1 = require("../models/index");
+/**
+ *
+ */
+class SsoSettingsApi extends runtime.BaseAPI {
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * Remove the workspace\'s single sign-on configuration
+     */
+    async deleteSettingsRaw(requestParameters, initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/settings/sso`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * Remove the workspace\'s single sign-on configuration
+     */
+    async deleteSettings(requestParameters = {}, initOverrides) {
+        await this.deleteSettingsRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * Get the workspace\'s single sign-on configuration
+     */
+    async getSettingsSsoRaw(initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/settings/sso`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.SsoConnectionResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * Get the workspace\'s single sign-on configuration
+     */
+    async getSettingsSso(initOverrides) {
+        const response = await this.getSettingsSsoRaw(initOverrides);
+        return await response.value();
+    }
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * Mint a SCIM provisioning token
+     */
+    async mintScimTokenRaw(requestParameters, initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/settings/sso/scim-token`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.ScimTokenResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * Mint a SCIM provisioning token
+     */
+    async mintScimToken(requestParameters = {}, initOverrides) {
+        const response = await this.mintScimTokenRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * Revoke the SCIM provisioning token
+     */
+    async revokeScimTokenRaw(requestParameters, initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/settings/sso/scim-token`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * Revoke the SCIM provisioning token
+     */
+    async revokeScimToken(requestParameters = {}, initOverrides) {
+        await this.revokeScimTokenRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * Create or update the workspace\'s single sign-on configuration
+     */
+    async upsertRaw(requestParameters, initOverrides) {
+        if (requestParameters['upsertSsoConnectionRequest'] == null) {
+            throw new runtime.RequiredError('upsertSsoConnectionRequest', 'Required parameter "upsertSsoConnectionRequest" was null or undefined when calling upsert().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/settings/sso`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'PUT',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.UpsertSsoConnectionRequestToJSON)(requestParameters['upsertSsoConnectionRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.SsoConnectionResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * Create or update the workspace\'s single sign-on configuration
+     */
+    async upsert(requestParameters, initOverrides) {
+        const response = await this.upsertRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}
+exports.SsoSettingsApi = SsoSettingsApi;

package/dist/generated/src/apis/StandaloneAuthApi.d.ts

@@ -15,7 +15,7 @@ export interface ForgotPasswordOperationRequest {
     forgotPasswordRequest: ForgotPasswordRequest;
     xIdempotencyKey?: string;
 }
-export interface LoginOperationRequest {
+export interface LoginAuthRequest {
     loginRequest: LoginRequest;
     xIdempotencyKey?: string;
 }
@@ -66,12 +66,12 @@ export interface StandaloneAuthApiInterface {
      * @throws {RequiredError}
      * @memberof StandaloneAuthApiInterface
      */
-    loginRaw(requestParameters: LoginOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
+    loginAuthRaw(requestParameters: LoginAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
     /**
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log in with email + password
      */
-    login(requestParameters: LoginOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
+    loginAuth(requestParameters: LoginAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
     /**
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * @summary Log out and clear the refresh cookie
@@ -151,12 +151,12 @@ export declare class StandaloneAuthApi extends runtime.BaseAPI implements Standa
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log in with email + password
      */
-    loginRaw(requestParameters: LoginOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
+    loginAuthRaw(requestParameters: LoginAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthTokenResponse>>;
     /**
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log in with email + password
      */
-    login(requestParameters: LoginOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
+    loginAuth(requestParameters: LoginAuthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthTokenResponse>;
     /**
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log out and clear the refresh cookie

package/dist/generated/src/apis/StandaloneAuthApi.js

@@ -99,9 +99,9 @@ class StandaloneAuthApi extends runtime.BaseAPI {
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log in with email + password
      */
-    async loginRaw(requestParameters, initOverrides) {
+    async loginAuthRaw(requestParameters, initOverrides) {
         if (requestParameters['loginRequest'] == null) {
-            throw new runtime.RequiredError('loginRequest', 'Required parameter "loginRequest" was null or undefined when calling login().');
+            throw new runtime.RequiredError('loginRequest', 'Required parameter "loginRequest" was null or undefined when calling loginAuth().');
         }
         const queryParameters = {};
         const headerParameters = {};
@@ -133,8 +133,8 @@ class StandaloneAuthApi extends runtime.BaseAPI {
      * Writes < 300ms. Auth flows may legitimately exceed this on cache-miss (password hashing, external OAuth round trip) — treat as best-effort.
      * Log in with email + password
      */
-    async login(requestParameters, initOverrides) {
-        const response = await this.loginRaw(requestParameters, initOverrides);
+    async loginAuth(requestParameters, initOverrides) {
+        const response = await this.loginAuthRaw(requestParameters, initOverrides);
         return await response.value();
     }
     /**

package/dist/generated/src/apis/StoreApi.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import type { ConnectStoreRequest, StoreConnectionResponse, StoreSyncResponse, StoreVendorResponse } from '../models/index';
+export interface ConnectCatalogStoresRequest {
+    vendor: string;
+    connectStoreRequest: ConnectStoreRequest;
+    xIdempotencyKey?: string;
+}
+export interface DisconnectCatalogStoresRequest {
+    vendor: string;
+    xIdempotencyKey?: string;
+}
+export interface GetCatalogStoresRequest {
+    vendor: string;
+}
+export interface SyncCatalogStoresRequest {
+    vendor: string;
+    importProducts?: boolean;
+    xIdempotencyKey?: string;
+}
+/**
+ * StoreApi - interface
+ *
+ * @export
+ * @interface StoreApiInterface
+ */
+export interface StoreApiInterface {
+    /**
+     * Verifies the credentials against the store before saving, so a wrong token fails here rather than silently at the first sync. The credential keys each vendor wants are published as credentialFields on GET /api/v1/catalog/stores. For a cart with an inbound webhook (WooCommerce today) the webhook URL and secret are returned ONCE and are never rotated by a re-save — webhookMinted says whether this call created them. Writes < 2s (one live call to the merchant\'s own store). Requires API-key scope: catalog:write.
+     * @summary Connect or update one of the tenant\'s e-commerce stores
+     * @param {string} vendor
+     * @param {ConnectStoreRequest} connectStoreRequest
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StoreApiInterface
+     */
+    connectCatalogStoresRaw(requestParameters: ConnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreConnectionResponse>>;
+    /**
+     * Verifies the credentials against the store before saving, so a wrong token fails here rather than silently at the first sync. The credential keys each vendor wants are published as credentialFields on GET /api/v1/catalog/stores. For a cart with an inbound webhook (WooCommerce today) the webhook URL and secret are returned ONCE and are never rotated by a re-save — webhookMinted says whether this call created them. Writes < 2s (one live call to the merchant\'s own store). Requires API-key scope: catalog:write.
+     * Connect or update one of the tenant\'s e-commerce stores
+     */
+    connectCatalogStores(requestParameters: ConnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreConnectionResponse>;
+    /**
+     * Idempotent. Products and orders already imported are kept — they are the merchant\'s history, not the connector\'s. The stored credentials are forgotten. Writes < 500ms. Requires API-key scope: catalog:write.
+     * @summary Disconnect one of the tenant\'s e-commerce stores
+     * @param {string} vendor
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StoreApiInterface
+     */
+    disconnectCatalogStoresRaw(requestParameters: DisconnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Idempotent. Products and orders already imported are kept — they are the merchant\'s history, not the connector\'s. The stored credentials are forgotten. Writes < 500ms. Requires API-key scope: catalog:write.
+     * Disconnect one of the tenant\'s e-commerce stores
+     */
+    disconnectCatalogStores(requestParameters: DisconnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Never returns credentials; webhookUrl/webhookSecret are null here and are returned only once, from POST /connect. Reads < 300ms. Requires API-key scope: catalog:read.
+     * @summary Get the tenant\'s connection to one store
+     * @param {string} vendor
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StoreApiInterface
+     */
+    getCatalogStoresRaw(requestParameters: GetCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreConnectionResponse>>;
+    /**
+     * Never returns credentials; webhookUrl/webhookSecret are null here and are returned only once, from POST /connect. Reads < 300ms. Requires API-key scope: catalog:read.
+     * Get the tenant\'s connection to one store
+     */
+    getCatalogStores(requestParameters: GetCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreConnectionResponse>;
+    /**
+     * Serves all five carts whatever the tenant has connected — a cart missing from this list is one the FE cannot render a connect prompt for. credentialFields comes from the vendor\'s own adapter, so a connect form built from it cannot drift out of step with what the backend validates. Never returns a credential. Reads < 300ms. Requires API-key scope: catalog:read.
+     * @summary List every e-commerce store Augstash can connect
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StoreApiInterface
+     */
+    listCatalogStoresRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<StoreVendorResponse>>>;
+    /**
+     * Serves all five carts whatever the tenant has connected — a cart missing from this list is one the FE cannot render a connect prompt for. credentialFields comes from the vendor\'s own adapter, so a connect form built from it cannot drift out of step with what the backend validates. Never returns a credential. Reads < 300ms. Requires API-key scope: catalog:read.
+     * List every e-commerce store Augstash can connect
+     */
+    listCatalogStores(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<StoreVendorResponse>>;
+    /**
+     * For BigCommerce, Magento and Ecwid this is the merchant\'s manual version of the sweep that already runs every 15 minutes; for WooCommerce it is the backfill for anything its webhook missed. Product import needs a connected product catalog (422 CATALOG_NOT_CONNECTED otherwise) and can be skipped with importProducts=false. Not paginated: it walks the store\'s pages itself, capped at 50. Writes < 5s (bounded by the merchant\'s own store, not by us). Requires API-key scope: catalog:write.
+     * @summary Sync products and recent orders from one connected store
+     * @param {string} vendor
+     * @param {boolean} [importProducts]
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StoreApiInterface
+     */
+    syncCatalogStoresRaw(requestParameters: SyncCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreSyncResponse>>;
+    /**
+     * For BigCommerce, Magento and Ecwid this is the merchant\'s manual version of the sweep that already runs every 15 minutes; for WooCommerce it is the backfill for anything its webhook missed. Product import needs a connected product catalog (422 CATALOG_NOT_CONNECTED otherwise) and can be skipped with importProducts=false. Not paginated: it walks the store\'s pages itself, capped at 50. Writes < 5s (bounded by the merchant\'s own store, not by us). Requires API-key scope: catalog:write.
+     * Sync products and recent orders from one connected store
+     */
+    syncCatalogStores(requestParameters: SyncCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreSyncResponse>;
+}
+/**
+ *
+ */
+export declare class StoreApi extends runtime.BaseAPI implements StoreApiInterface {
+    /**
+     * Verifies the credentials against the store before saving, so a wrong token fails here rather than silently at the first sync. The credential keys each vendor wants are published as credentialFields on GET /api/v1/catalog/stores. For a cart with an inbound webhook (WooCommerce today) the webhook URL and secret are returned ONCE and are never rotated by a re-save — webhookMinted says whether this call created them. Writes < 2s (one live call to the merchant\'s own store). Requires API-key scope: catalog:write.
+     * Connect or update one of the tenant\'s e-commerce stores
+     */
+    connectCatalogStoresRaw(requestParameters: ConnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreConnectionResponse>>;
+    /**
+     * Verifies the credentials against the store before saving, so a wrong token fails here rather than silently at the first sync. The credential keys each vendor wants are published as credentialFields on GET /api/v1/catalog/stores. For a cart with an inbound webhook (WooCommerce today) the webhook URL and secret are returned ONCE and are never rotated by a re-save — webhookMinted says whether this call created them. Writes < 2s (one live call to the merchant\'s own store). Requires API-key scope: catalog:write.
+     * Connect or update one of the tenant\'s e-commerce stores
+     */
+    connectCatalogStores(requestParameters: ConnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreConnectionResponse>;
+    /**
+     * Idempotent. Products and orders already imported are kept — they are the merchant\'s history, not the connector\'s. The stored credentials are forgotten. Writes < 500ms. Requires API-key scope: catalog:write.
+     * Disconnect one of the tenant\'s e-commerce stores
+     */
+    disconnectCatalogStoresRaw(requestParameters: DisconnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Idempotent. Products and orders already imported are kept — they are the merchant\'s history, not the connector\'s. The stored credentials are forgotten. Writes < 500ms. Requires API-key scope: catalog:write.
+     * Disconnect one of the tenant\'s e-commerce stores
+     */
+    disconnectCatalogStores(requestParameters: DisconnectCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Never returns credentials; webhookUrl/webhookSecret are null here and are returned only once, from POST /connect. Reads < 300ms. Requires API-key scope: catalog:read.
+     * Get the tenant\'s connection to one store
+     */
+    getCatalogStoresRaw(requestParameters: GetCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreConnectionResponse>>;
+    /**
+     * Never returns credentials; webhookUrl/webhookSecret are null here and are returned only once, from POST /connect. Reads < 300ms. Requires API-key scope: catalog:read.
+     * Get the tenant\'s connection to one store
+     */
+    getCatalogStores(requestParameters: GetCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreConnectionResponse>;
+    /**
+     * Serves all five carts whatever the tenant has connected — a cart missing from this list is one the FE cannot render a connect prompt for. credentialFields comes from the vendor\'s own adapter, so a connect form built from it cannot drift out of step with what the backend validates. Never returns a credential. Reads < 300ms. Requires API-key scope: catalog:read.
+     * List every e-commerce store Augstash can connect
+     */
+    listCatalogStoresRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<StoreVendorResponse>>>;
+    /**
+     * Serves all five carts whatever the tenant has connected — a cart missing from this list is one the FE cannot render a connect prompt for. credentialFields comes from the vendor\'s own adapter, so a connect form built from it cannot drift out of step with what the backend validates. Never returns a credential. Reads < 300ms. Requires API-key scope: catalog:read.
+     * List every e-commerce store Augstash can connect
+     */
+    listCatalogStores(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<StoreVendorResponse>>;
+    /**
+     * For BigCommerce, Magento and Ecwid this is the merchant\'s manual version of the sweep that already runs every 15 minutes; for WooCommerce it is the backfill for anything its webhook missed. Product import needs a connected product catalog (422 CATALOG_NOT_CONNECTED otherwise) and can be skipped with importProducts=false. Not paginated: it walks the store\'s pages itself, capped at 50. Writes < 5s (bounded by the merchant\'s own store, not by us). Requires API-key scope: catalog:write.
+     * Sync products and recent orders from one connected store
+     */
+    syncCatalogStoresRaw(requestParameters: SyncCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<StoreSyncResponse>>;
+    /**
+     * For BigCommerce, Magento and Ecwid this is the merchant\'s manual version of the sweep that already runs every 15 minutes; for WooCommerce it is the backfill for anything its webhook missed. Product import needs a connected product catalog (422 CATALOG_NOT_CONNECTED otherwise) and can be skipped with importProducts=false. Not paginated: it walks the store\'s pages itself, capped at 50. Writes < 5s (bounded by the merchant\'s own store, not by us). Requires API-key scope: catalog:write.
+     * Sync products and recent orders from one connected store
+     */
+    syncCatalogStores(requestParameters: SyncCatalogStoresRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<StoreSyncResponse>;
+}