@behio/storefront-sdk 0.8.0 → 0.10.0

package/dist/{chunk-DMTMGPUZ.js → chunk-LNSFBNPJ.js}

@@ -307,7 +307,10 @@ var BehioStorefront = class {
     if (this.cartSession) {
       headers["X-Cart-Session"] = this.cartSession;
     }
-    const bodyStr = _optionalChain([options, 'optionalAccess', _14 => _14.body]) ? JSON.stringify(options.body) : void 0;
+    if (_optionalChain([options, 'optionalAccess', _14 => _14.headers])) {
+      Object.assign(headers, options.headers);
+    }
+    const bodyStr = _optionalChain([options, 'optionalAccess', _15 => _15.body]) ? JSON.stringify(options.body) : void 0;
     let interceptedConfig = {
       url,
       method,
@@ -321,7 +324,7 @@ var BehioStorefront = class {
     for (let attempt = 0; attempt <= this.retries; attempt++) {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-      if (_optionalChain([options, 'optionalAccess', _15 => _15.signal])) {
+      if (_optionalChain([options, 'optionalAccess', _16 => _16.signal])) {
         if (options.signal.aborted) {
           clearTimeout(timeoutId);
           throw new BehioNetworkError("Request aborted", false);
@@ -362,8 +365,8 @@ var BehioStorefront = class {
       this.emit("response", { method, path, status: res.status });
       if (!res.ok) {
         const body = await res.json().catch(() => null);
-        const apiError = new BehioApiError(res.status, body, _optionalChain([body, 'optionalAccess', _16 => _16.message]) || `API Error ${res.status}`);
-        if (res.status === 401 && this.refreshToken && _optionalChain([options, 'optionalAccess', _17 => _17.auth]) !== false && !_optionalChain([options, 'optionalAccess', _18 => _18._isRetryAfterRefresh])) {
+        const apiError = new BehioApiError(res.status, body, _optionalChain([body, 'optionalAccess', _17 => _17.message]) || `API Error ${res.status}`);
+        if (res.status === 401 && this.refreshToken && _optionalChain([options, 'optionalAccess', _18 => _18.auth]) !== false && !_optionalChain([options, 'optionalAccess', _19 => _19._isRetryAfterRefresh])) {
           try {
             await this.handleTokenRefresh();
             return this.rawRequest(method, path, { ...options, _isRetryAfterRefresh: true });
@@ -426,7 +429,7 @@ var CatalogModule = class {
   /** Get product detail by slug */
   async getProduct(slug, options) {
     return this.client.request("GET", `/catalog/products/${slug}`, {
-      query: { locale: _optionalChain([options, 'optionalAccess', _19 => _19.locale]), currency: _optionalChain([options, 'optionalAccess', _20 => _20.currency]) }
+      query: { locale: _optionalChain([options, 'optionalAccess', _20 => _20.locale]), currency: _optionalChain([options, 'optionalAccess', _21 => _21.currency]) }
     });
   }
   /** Get category tree */
@@ -460,7 +463,7 @@ var CatalogModule = class {
   /** Get featured products */
   async getFeatured(options) {
     return this.client.request("GET", "/catalog/featured", {
-      query: { locale: _optionalChain([options, 'optionalAccess', _21 => _21.locale]), currency: _optionalChain([options, 'optionalAccess', _22 => _22.currency]) }
+      query: { locale: _optionalChain([options, 'optionalAccess', _22 => _22.locale]), currency: _optionalChain([options, 'optionalAccess', _23 => _23.currency]) }
     });
   }
   /** Get available filter fields for dynamic filter UI */
@@ -505,7 +508,7 @@ var CatalogModule = class {
   /** List configured payment methods (filtered by currency). */
   async listPaymentMethods(opts) {
     const query = {};
-    if (_optionalChain([opts, 'optionalAccess', _23 => _23.currency])) query.currency = opts.currency;
+    if (_optionalChain([opts, 'optionalAccess', _24 => _24.currency])) query.currency = opts.currency;
     return this.client.request("GET", "/catalog/payment-methods", { query });
   }
 };
@@ -746,7 +749,7 @@ var OrdersModule = class {
   /** List customer orders (requires auth) */
   async list(options) {
     return this.client.request("GET", "/orders", {
-      query: { page: _optionalChain([options, 'optionalAccess', _24 => _24.page]), limit: _optionalChain([options, 'optionalAccess', _25 => _25.limit]) }
+      query: { page: _optionalChain([options, 'optionalAccess', _25 => _25.page]), limit: _optionalChain([options, 'optionalAccess', _26 => _26.limit]) }
     });
   }
   /** Get order detail (requires auth) */
@@ -757,10 +760,50 @@ var OrdersModule = class {
   async cancel(orderNumber) {
     return this.client.request("POST", `/orders/${orderNumber}/cancel`);
   }
-  /** Track order by tracking token (no customer login required, only API key) */
+  /**
+   * Track an order by tracking token (no login, only API key). Returns a
+   * PII-minimized view: order status + items + masked email + destination
+   * city, never full address / phone / billing — the token travels in URLs
+   * and e-mails so it must not expose full personal data.
+   */
   async track(trackingToken) {
     return this.client.request("GET", `/orders/track/${trackingToken}`, { auth: false });
   }
+  /**
+   * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+   * address on the order. The response is always generic (success) regardless
+   * of whether the order number + e-mail match, so order numbers can't be
+   * enumerated. No login, only API key.
+   */
+  async requestAccessCode(orderNumber, email) {
+    return this.client.request("POST", "/orders/access/request", {
+      auth: false,
+      body: { orderNumber, email }
+    });
+  }
+  /**
+   * Step 2 of guest order-access: verify the e-mailed code. On success returns
+   * the FULL order detail plus a short-lived `accessToken` you can pass to
+   * {@link getByAccessToken} to re-fetch the detail without re-entering the
+   * code. No login, only API key.
+   */
+  async verifyAccessCode(orderNumber, email, code) {
+    return this.client.request("POST", "/orders/access/verify", {
+      auth: false,
+      body: { orderNumber, email, code }
+    });
+  }
+  /**
+   * Re-fetch a guest order's full detail using the `accessToken` returned by
+   * {@link verifyAccessCode}. The token is scoped to that single order and
+   * expires after 30 minutes.
+   */
+  async getByAccessToken(accessToken) {
+    return this.client.request("GET", "/orders/access/detail", {
+      auth: false,
+      headers: { "X-Order-Access": accessToken }
+    });
+  }
 };
 var CustomerModule = class {
   constructor(client) {
@@ -860,8 +903,9 @@ var ReturnsModule = class {
   async submit(input) {
     return this.client.request("POST", "/returns", { body: input });
   }
+  /** Email is the ownership gate; POST so it never lands in a URL / log. */
   async getStatus(returnId, email) {
-    return this.client.request("GET", `/returns/${returnId}/status`, { query: { email } });
+    return this.client.request("POST", `/returns/${returnId}/status`, { body: { email } });
   }
 };
 var ConsentModule = class {
@@ -928,10 +972,10 @@ var ShippingModule = class {
    */
   async listMethods(opts) {
     const query = {};
-    if (_optionalChain([opts, 'optionalAccess', _26 => _26.currency])) query.currency = opts.currency;
-    if (_optionalChain([opts, 'optionalAccess', _27 => _27.country])) query.country = opts.country;
-    if (_optionalChain([opts, 'optionalAccess', _28 => _28.cartTotal]) != null) query.cartTotal = String(opts.cartTotal);
-    if (_optionalChain([opts, 'optionalAccess', _29 => _29.cartWeightKg]) != null) query.cartWeightKg = String(opts.cartWeightKg);
+    if (_optionalChain([opts, 'optionalAccess', _27 => _27.currency])) query.currency = opts.currency;
+    if (_optionalChain([opts, 'optionalAccess', _28 => _28.country])) query.country = opts.country;
+    if (_optionalChain([opts, 'optionalAccess', _29 => _29.cartTotal]) != null) query.cartTotal = String(opts.cartTotal);
+    if (_optionalChain([opts, 'optionalAccess', _30 => _30.cartWeightKg]) != null) query.cartWeightKg = String(opts.cartWeightKg);
     return this.client.request(
       "GET",
       "/catalog/shipping-methods",

package/dist/{chunk-EZEZUV2B.mjs → chunk-O3IM7PAY.mjs}

@@ -307,6 +307,9 @@ var BehioStorefront = class {
     if (this.cartSession) {
       headers["X-Cart-Session"] = this.cartSession;
     }
+    if (options?.headers) {
+      Object.assign(headers, options.headers);
+    }
     const bodyStr = options?.body ? JSON.stringify(options.body) : void 0;
     let interceptedConfig = {
       url,
@@ -757,10 +760,50 @@ var OrdersModule = class {
   async cancel(orderNumber) {
     return this.client.request("POST", `/orders/${orderNumber}/cancel`);
   }
-  /** Track order by tracking token (no customer login required, only API key) */
+  /**
+   * Track an order by tracking token (no login, only API key). Returns a
+   * PII-minimized view: order status + items + masked email + destination
+   * city, never full address / phone / billing — the token travels in URLs
+   * and e-mails so it must not expose full personal data.
+   */
   async track(trackingToken) {
     return this.client.request("GET", `/orders/track/${trackingToken}`, { auth: false });
   }
+  /**
+   * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+   * address on the order. The response is always generic (success) regardless
+   * of whether the order number + e-mail match, so order numbers can't be
+   * enumerated. No login, only API key.
+   */
+  async requestAccessCode(orderNumber, email) {
+    return this.client.request("POST", "/orders/access/request", {
+      auth: false,
+      body: { orderNumber, email }
+    });
+  }
+  /**
+   * Step 2 of guest order-access: verify the e-mailed code. On success returns
+   * the FULL order detail plus a short-lived `accessToken` you can pass to
+   * {@link getByAccessToken} to re-fetch the detail without re-entering the
+   * code. No login, only API key.
+   */
+  async verifyAccessCode(orderNumber, email, code) {
+    return this.client.request("POST", "/orders/access/verify", {
+      auth: false,
+      body: { orderNumber, email, code }
+    });
+  }
+  /**
+   * Re-fetch a guest order's full detail using the `accessToken` returned by
+   * {@link verifyAccessCode}. The token is scoped to that single order and
+   * expires after 30 minutes.
+   */
+  async getByAccessToken(accessToken) {
+    return this.client.request("GET", "/orders/access/detail", {
+      auth: false,
+      headers: { "X-Order-Access": accessToken }
+    });
+  }
 };
 var CustomerModule = class {
   constructor(client) {
@@ -860,8 +903,9 @@ var ReturnsModule = class {
   async submit(input) {
     return this.client.request("POST", "/returns", { body: input });
   }
+  /** Email is the ownership gate; POST so it never lands in a URL / log. */
   async getStatus(returnId, email) {
-    return this.client.request("GET", `/returns/${returnId}/status`, { query: { email } });
+    return this.client.request("POST", `/returns/${returnId}/status`, { body: { email } });
   }
 };
 var ConsentModule = class {

package/dist/index.d.mts

@@ -392,6 +392,25 @@ interface OrderItem {
     totalPrice: number;
     totalPriceWithTax: number;
 }
+/**
+ * PII-minimized order view returned by `orders.track(token)`. The tracking
+ * token is shared in URLs and e-mails, so this deliberately omits full
+ * address, phone, billing and customer note, and masks the email.
+ */
+interface OrderTracking {
+    orderNumber: string;
+    status: OrderStatus;
+    paymentStatus: PaymentStatus;
+    fulfillmentStatus: FulfillmentStatus;
+    currency: string;
+    grandTotal: number;
+    /** Masked, e.g. "j***@e***.cz" */
+    emailMasked: string;
+    shippingCity: string | null;
+    shippingCountry: string | null;
+    items: OrderItem[];
+    createdAt: number;
+}
 interface OrderStatusHistory {
     fromStatus?: OrderStatus;
     toStatus: OrderStatus;
@@ -421,6 +440,19 @@ interface OrderDetail extends OrderListItem {
      */
     paymentRedirectUrl?: string | null;
 }
+/** Generic response to `orders.requestAccessCode` — never reveals existence. */
+interface OrderAccessRequestResponse {
+    success: boolean;
+    message: string;
+}
+/** Response to a successful `orders.verifyAccessCode`. */
+interface OrderAccessVerifyResponse {
+    /** Short-lived JWT scoped to this single order (use with `getByAccessToken`). */
+    accessToken: string;
+    /** Token lifetime in seconds. */
+    expiresIn: number;
+    order: OrderDetail;
+}
 interface CustomerProfile {
     id: string;
     email: string;
@@ -933,6 +965,7 @@ declare class BehioStorefront {
         query?: Record<string, string | number | boolean | undefined | string[] | number[]>;
         auth?: boolean;
         signal?: AbortSignal;
+        headers?: Record<string, string>;
     }): Promise<SdkResult<T>>;
     /**
      * Throws on failure (API error / network / timeout). Kept private so
@@ -1094,8 +1127,33 @@ declare class OrdersModule {
     get(orderNumber: string): Promise<SdkResult<OrderDetail>>;
     /** Cancel a PENDING order (requires auth) */
     cancel(orderNumber: string): Promise<SdkResult<OrderDetail>>;
-    /** Track order by tracking token (no customer login required, only API key) */
-    track(trackingToken: string): Promise<SdkResult<OrderDetail>>;
+    /**
+     * Track an order by tracking token (no login, only API key). Returns a
+     * PII-minimized view: order status + items + masked email + destination
+     * city, never full address / phone / billing — the token travels in URLs
+     * and e-mails so it must not expose full personal data.
+     */
+    track(trackingToken: string): Promise<SdkResult<OrderTracking>>;
+    /**
+     * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+     * address on the order. The response is always generic (success) regardless
+     * of whether the order number + e-mail match, so order numbers can't be
+     * enumerated. No login, only API key.
+     */
+    requestAccessCode(orderNumber: string, email: string): Promise<SdkResult<OrderAccessRequestResponse>>;
+    /**
+     * Step 2 of guest order-access: verify the e-mailed code. On success returns
+     * the FULL order detail plus a short-lived `accessToken` you can pass to
+     * {@link getByAccessToken} to re-fetch the detail without re-entering the
+     * code. No login, only API key.
+     */
+    verifyAccessCode(orderNumber: string, email: string, code: string): Promise<SdkResult<OrderAccessVerifyResponse>>;
+    /**
+     * Re-fetch a guest order's full detail using the `accessToken` returned by
+     * {@link verifyAccessCode}. The token is scoped to that single order and
+     * expires after 30 minutes.
+     */
+    getByAccessToken(accessToken: string): Promise<SdkResult<OrderDetail>>;
 }
 declare class CustomerModule {
     private client;
@@ -1164,6 +1222,7 @@ declare class ReturnsModule {
      */
     lookupOrder(orderNumber: string, email: string): Promise<SdkResult<ReturnableOrder>>;
     submit(input: SubmitReturnInput): Promise<SdkResult<ReturnRequest>>;
+    /** Email is the ownership gate; POST so it never lands in a URL / log. */
     getStatus(returnId: string, email: string): Promise<SdkResult<ReturnStatus>>;
 }
 declare class ConsentModule {
@@ -1256,4 +1315,4 @@ declare class ShippingModule {
     }>>;
 }
 
-export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };
+export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderAccessRequestResponse, type OrderAccessVerifyResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type OrderTracking, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };

package/dist/index.d.ts

@@ -392,6 +392,25 @@ interface OrderItem {
     totalPrice: number;
     totalPriceWithTax: number;
 }
+/**
+ * PII-minimized order view returned by `orders.track(token)`. The tracking
+ * token is shared in URLs and e-mails, so this deliberately omits full
+ * address, phone, billing and customer note, and masks the email.
+ */
+interface OrderTracking {
+    orderNumber: string;
+    status: OrderStatus;
+    paymentStatus: PaymentStatus;
+    fulfillmentStatus: FulfillmentStatus;
+    currency: string;
+    grandTotal: number;
+    /** Masked, e.g. "j***@e***.cz" */
+    emailMasked: string;
+    shippingCity: string | null;
+    shippingCountry: string | null;
+    items: OrderItem[];
+    createdAt: number;
+}
 interface OrderStatusHistory {
     fromStatus?: OrderStatus;
     toStatus: OrderStatus;
@@ -421,6 +440,19 @@ interface OrderDetail extends OrderListItem {
      */
     paymentRedirectUrl?: string | null;
 }
+/** Generic response to `orders.requestAccessCode` — never reveals existence. */
+interface OrderAccessRequestResponse {
+    success: boolean;
+    message: string;
+}
+/** Response to a successful `orders.verifyAccessCode`. */
+interface OrderAccessVerifyResponse {
+    /** Short-lived JWT scoped to this single order (use with `getByAccessToken`). */
+    accessToken: string;
+    /** Token lifetime in seconds. */
+    expiresIn: number;
+    order: OrderDetail;
+}
 interface CustomerProfile {
     id: string;
     email: string;
@@ -933,6 +965,7 @@ declare class BehioStorefront {
         query?: Record<string, string | number | boolean | undefined | string[] | number[]>;
         auth?: boolean;
         signal?: AbortSignal;
+        headers?: Record<string, string>;
     }): Promise<SdkResult<T>>;
     /**
      * Throws on failure (API error / network / timeout). Kept private so
@@ -1094,8 +1127,33 @@ declare class OrdersModule {
     get(orderNumber: string): Promise<SdkResult<OrderDetail>>;
     /** Cancel a PENDING order (requires auth) */
     cancel(orderNumber: string): Promise<SdkResult<OrderDetail>>;
-    /** Track order by tracking token (no customer login required, only API key) */
-    track(trackingToken: string): Promise<SdkResult<OrderDetail>>;
+    /**
+     * Track an order by tracking token (no login, only API key). Returns a
+     * PII-minimized view: order status + items + masked email + destination
+     * city, never full address / phone / billing — the token travels in URLs
+     * and e-mails so it must not expose full personal data.
+     */
+    track(trackingToken: string): Promise<SdkResult<OrderTracking>>;
+    /**
+     * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+     * address on the order. The response is always generic (success) regardless
+     * of whether the order number + e-mail match, so order numbers can't be
+     * enumerated. No login, only API key.
+     */
+    requestAccessCode(orderNumber: string, email: string): Promise<SdkResult<OrderAccessRequestResponse>>;
+    /**
+     * Step 2 of guest order-access: verify the e-mailed code. On success returns
+     * the FULL order detail plus a short-lived `accessToken` you can pass to
+     * {@link getByAccessToken} to re-fetch the detail without re-entering the
+     * code. No login, only API key.
+     */
+    verifyAccessCode(orderNumber: string, email: string, code: string): Promise<SdkResult<OrderAccessVerifyResponse>>;
+    /**
+     * Re-fetch a guest order's full detail using the `accessToken` returned by
+     * {@link verifyAccessCode}. The token is scoped to that single order and
+     * expires after 30 minutes.
+     */
+    getByAccessToken(accessToken: string): Promise<SdkResult<OrderDetail>>;
 }
 declare class CustomerModule {
     private client;
@@ -1164,6 +1222,7 @@ declare class ReturnsModule {
      */
     lookupOrder(orderNumber: string, email: string): Promise<SdkResult<ReturnableOrder>>;
     submit(input: SubmitReturnInput): Promise<SdkResult<ReturnRequest>>;
+    /** Email is the ownership gate; POST so it never lands in a URL / log. */
     getStatus(returnId: string, email: string): Promise<SdkResult<ReturnStatus>>;
 }
 declare class ConsentModule {
@@ -1256,4 +1315,4 @@ declare class ShippingModule {
     }>>;
 }
 
-export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };
+export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderAccessRequestResponse, type OrderAccessVerifyResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type OrderTracking, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };

package/dist/index.js

@@ -10,7 +10,7 @@
 
 
 
-var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
+var _chunkLNSFBNPJjs = require('./chunk-LNSFBNPJ.js');
 
 
 
@@ -23,4 +23,4 @@ var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
 
 
 
-exports.AddressTypes = _chunkDMTMGPUZjs.AddressTypes; exports.BehioApiError = _chunkDMTMGPUZjs.BehioApiError; exports.BehioNetworkError = _chunkDMTMGPUZjs.BehioNetworkError; exports.BehioStorefront = _chunkDMTMGPUZjs.BehioStorefront; exports.FulfillmentStatuses = _chunkDMTMGPUZjs.FulfillmentStatuses; exports.OrderStatuses = _chunkDMTMGPUZjs.OrderStatuses; exports.PaymentStatuses = _chunkDMTMGPUZjs.PaymentStatuses; exports.ProductSort = _chunkDMTMGPUZjs.ProductSort; exports.err = _chunkDMTMGPUZjs.err; exports.ok = _chunkDMTMGPUZjs.ok; exports.toSdkError = _chunkDMTMGPUZjs.toSdkError;
+exports.AddressTypes = _chunkLNSFBNPJjs.AddressTypes; exports.BehioApiError = _chunkLNSFBNPJjs.BehioApiError; exports.BehioNetworkError = _chunkLNSFBNPJjs.BehioNetworkError; exports.BehioStorefront = _chunkLNSFBNPJjs.BehioStorefront; exports.FulfillmentStatuses = _chunkLNSFBNPJjs.FulfillmentStatuses; exports.OrderStatuses = _chunkLNSFBNPJjs.OrderStatuses; exports.PaymentStatuses = _chunkLNSFBNPJjs.PaymentStatuses; exports.ProductSort = _chunkLNSFBNPJjs.ProductSort; exports.err = _chunkLNSFBNPJjs.err; exports.ok = _chunkLNSFBNPJjs.ok; exports.toSdkError = _chunkLNSFBNPJjs.toSdkError;

package/dist/index.mjs

@@ -10,7 +10,7 @@ import {
   err,
   ok,
   toSdkError
-} from "./chunk-EZEZUV2B.mjs";
+} from "./chunk-O3IM7PAY.mjs";
 export {
   AddressTypes,
   BehioApiError,

package/dist/next.js

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
+var _chunkLNSFBNPJjs = require('./chunk-LNSFBNPJ.js');
 
 // src/next.ts
 var _headers = require('next/headers');
@@ -17,7 +17,7 @@ async function getBehio(options = {}) {
   const locale = _nullishCoalesce(options.locale, () => ( process.env.BEHIO_LOCALE));
   const currency = _nullishCoalesce(options.currency, () => ( process.env.BEHIO_CURRENCY));
   const cookieName = _nullishCoalesce(options.cartCookieName, () => ( CART_COOKIE_NAME));
-  const client = new (0, _chunkDMTMGPUZjs.BehioStorefront)({
+  const client = new (0, _chunkLNSFBNPJjs.BehioStorefront)({
     apiKey,
     ...baseUrl ? { baseUrl } : {},
     ...locale ? { locale } : {},

package/dist/next.mjs

@@ -1,6 +1,6 @@
 import {
   BehioStorefront
-} from "./chunk-EZEZUV2B.mjs";
+} from "./chunk-O3IM7PAY.mjs";
 
 // src/next.ts
 import { cookies } from "next/headers";

package/dist/react.d.mts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { QueryClient } from '@tanstack/react-query';
-import { BehioStorefront, ProductsQuery, PaginatedResponse, ProductListItem, ProductDetail, Category, CategoryDetail, ProductLabel, FilterField, Cart, CustomerProfile, RegisterInput, CustomerAddress, AddressSuggestion, AddressDetail, OrderListItem, OrderDetail, CheckoutInput, PageDetail, Page, ShopInfo, ShopSeo, Bundle, CrossSellItem, ActivePromotion, GiftCardBalance, WishlistItem, ProductReviewsResponse, SubmitReviewInput, ReturnableOrder, ReturnStatus, ReturnRequest, SubmitReturnInput, CookieConsent, CookieConsentInput, QuoteRequest, SubmitQuoteInput, BackInStockSubscription } from './index.mjs';
+import { BehioStorefront, ProductsQuery, PaginatedResponse, ProductListItem, ProductDetail, Category, CategoryDetail, ProductLabel, FilterField, Cart, CustomerProfile, RegisterInput, CustomerAddress, AddressSuggestion, AddressDetail, OrderListItem, OrderDetail, OrderAccessRequestResponse, OrderAccessVerifyResponse, CheckoutInput, PageDetail, Page, ShopInfo, ShopSeo, Bundle, CrossSellItem, ActivePromotion, GiftCardBalance, WishlistItem, ProductReviewsResponse, SubmitReviewInput, ReturnableOrder, ReturnStatus, ReturnRequest, SubmitReturnInput, CookieConsent, CookieConsentInput, QuoteRequest, SubmitQuoteInput, BackInStockSubscription } from './index.mjs';
 export { AddToCartInput, AuthTokens, BehioApiError, BundleItem, CartDiscount, CartItem, CheckoutAddress, FulfillmentStatus, LoginInput, MessageResponse, OrderItem, OrderStatus, PaymentStatus, ProductPrice, ProductReview, ProductVariant } from './index.mjs';
 import * as _tanstack_query_core from '@tanstack/query-core';
 
@@ -292,6 +292,35 @@ declare function useOrder(orderNumber: string, options?: UseOrderOptions): {
     isCancelling: boolean;
 };
 
+/**
+ * Verified guest order-access flow (no login). Two steps:
+ *   1. `requestCode(orderNumber, email)` — e-mails a 6-digit code to the
+ *      address on the order. Always resolves generically, so order numbers
+ *      can't be enumerated.
+ *   2. `verifyCode(code)` — verifies the code, then exposes the full
+ *      `order` detail and a short-lived `accessToken`.
+ *
+ * Knowing the order number alone is never enough to see the detail — control
+ * of the order e-mail must be proven first.
+ */
+declare function useOrderAccess(): {
+    /** Step 1: send the code. */
+    requestCode: (on: string, em: string) => Promise<OrderAccessRequestResponse>;
+    isRequesting: boolean;
+    requestError: Error | null;
+    /** True once a code has been requested (move the UI to the code input). */
+    codeSent: boolean;
+    /** Step 2: verify the code. */
+    verifyCode: (code: string) => Promise<OrderAccessVerifyResponse>;
+    isVerifying: boolean;
+    verifyError: Error | null;
+    /** Full order detail, available after a successful verify. */
+    order: OrderDetail | null;
+    /** Short-lived token scoped to this order (30 min). */
+    accessToken: string | null;
+    reset: () => void;
+};
+
 declare function useCheckout(): {
     createOrder: (input: CheckoutInput) => Promise<OrderDetail>;
     isCreating: boolean;
@@ -862,4 +891,4 @@ declare function useBehioClient(): BehioStorefront;
  */
 declare function formatPrice(amount: number, currency: string, locale?: string): string;
 
-export { ActivePromotion, BehioProvider, type BehioProviderProps, Bundle, Cart, Category, CategoryDetail, CheckoutInput, CookieConsent, CookieConsentInput, CrossSellItem, CustomerAddress, CustomerProfile, FilterField, GiftCardBalance, OrderDetail, OrderListItem, Page, PageDetail, PaginatedResponse, ProductDetail, ProductLabel, ProductListItem, ProductReviewsResponse, ProductsQuery, QuoteRequest, RegisterInput, ReturnRequest, ShopInfo, ShopSeo, type StorageAdapter, SubmitQuoteInput, SubmitReturnInput, SubmitReviewInput, type UseAddressAutocompleteOptions, type UseAddressAutocompleteReturn, type UseAddressesOptions, type UseCartCountOptions, type UseCartOptions, type UseCategoriesOptions, type UseCategoryOptions, type UseCustomerOptions, type UseFeaturedOptions, type UseFiltersOptions, type UseLabelsOptions, type UseOrderOptions, type UseOrdersOptions, type UsePageOptions, type UsePagesOptions, type UseProductOptions, type UseProductsOptions, type UseSearchOptions, type UseShopInfoOptions, type UseShopSeoOptions, WishlistItem, cookieStorage, createMemoryStorage, detectStorage, formatPrice, localStorageAdapter, memoryStorage, useAddressAutocomplete, useAddresses, useAuth, useBehio, useBehioClient, useBundle, useBundles, useCart, useCartCount, useCategories, useCategory, useCheckout, useCookieConsent, useCrossSell, useCustomer, useFeatured, useFilters, useGiftCardBalance, useIsInWishlist, useLabels, useLookupReturnableOrder, useNotifyWhenAvailable, useOrder, useOrders, usePage, usePages, useProduct, useProductPromotions, useProductReviews, useProducts, useQuoteStatus, useReturnStatus, useSearch, useShopInfo, useShopSeo, useSubmitQuote, useSubmitReturn, useSubmitReview, useWishlist };
+export { ActivePromotion, BehioProvider, type BehioProviderProps, Bundle, Cart, Category, CategoryDetail, CheckoutInput, CookieConsent, CookieConsentInput, CrossSellItem, CustomerAddress, CustomerProfile, FilterField, GiftCardBalance, OrderDetail, OrderListItem, Page, PageDetail, PaginatedResponse, ProductDetail, ProductLabel, ProductListItem, ProductReviewsResponse, ProductsQuery, QuoteRequest, RegisterInput, ReturnRequest, ShopInfo, ShopSeo, type StorageAdapter, SubmitQuoteInput, SubmitReturnInput, SubmitReviewInput, type UseAddressAutocompleteOptions, type UseAddressAutocompleteReturn, type UseAddressesOptions, type UseCartCountOptions, type UseCartOptions, type UseCategoriesOptions, type UseCategoryOptions, type UseCustomerOptions, type UseFeaturedOptions, type UseFiltersOptions, type UseLabelsOptions, type UseOrderOptions, type UseOrdersOptions, type UsePageOptions, type UsePagesOptions, type UseProductOptions, type UseProductsOptions, type UseSearchOptions, type UseShopInfoOptions, type UseShopSeoOptions, WishlistItem, cookieStorage, createMemoryStorage, detectStorage, formatPrice, localStorageAdapter, memoryStorage, useAddressAutocomplete, useAddresses, useAuth, useBehio, useBehioClient, useBundle, useBundles, useCart, useCartCount, useCategories, useCategory, useCheckout, useCookieConsent, useCrossSell, useCustomer, useFeatured, useFilters, useGiftCardBalance, useIsInWishlist, useLabels, useLookupReturnableOrder, useNotifyWhenAvailable, useOrder, useOrderAccess, useOrders, usePage, usePages, useProduct, useProductPromotions, useProductReviews, useProducts, useQuoteStatus, useReturnStatus, useSearch, useShopInfo, useShopSeo, useSubmitQuote, useSubmitReturn, useSubmitReview, useWishlist };

package/dist/react.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { QueryClient } from '@tanstack/react-query';
-import { BehioStorefront, ProductsQuery, PaginatedResponse, ProductListItem, ProductDetail, Category, CategoryDetail, ProductLabel, FilterField, Cart, CustomerProfile, RegisterInput, CustomerAddress, AddressSuggestion, AddressDetail, OrderListItem, OrderDetail, CheckoutInput, PageDetail, Page, ShopInfo, ShopSeo, Bundle, CrossSellItem, ActivePromotion, GiftCardBalance, WishlistItem, ProductReviewsResponse, SubmitReviewInput, ReturnableOrder, ReturnStatus, ReturnRequest, SubmitReturnInput, CookieConsent, CookieConsentInput, QuoteRequest, SubmitQuoteInput, BackInStockSubscription } from './index.js';
+import { BehioStorefront, ProductsQuery, PaginatedResponse, ProductListItem, ProductDetail, Category, CategoryDetail, ProductLabel, FilterField, Cart, CustomerProfile, RegisterInput, CustomerAddress, AddressSuggestion, AddressDetail, OrderListItem, OrderDetail, OrderAccessRequestResponse, OrderAccessVerifyResponse, CheckoutInput, PageDetail, Page, ShopInfo, ShopSeo, Bundle, CrossSellItem, ActivePromotion, GiftCardBalance, WishlistItem, ProductReviewsResponse, SubmitReviewInput, ReturnableOrder, ReturnStatus, ReturnRequest, SubmitReturnInput, CookieConsent, CookieConsentInput, QuoteRequest, SubmitQuoteInput, BackInStockSubscription } from './index.js';
 export { AddToCartInput, AuthTokens, BehioApiError, BundleItem, CartDiscount, CartItem, CheckoutAddress, FulfillmentStatus, LoginInput, MessageResponse, OrderItem, OrderStatus, PaymentStatus, ProductPrice, ProductReview, ProductVariant } from './index.js';
 import * as _tanstack_query_core from '@tanstack/query-core';
 
@@ -292,6 +292,35 @@ declare function useOrder(orderNumber: string, options?: UseOrderOptions): {
     isCancelling: boolean;
 };
 
+/**
+ * Verified guest order-access flow (no login). Two steps:
+ *   1. `requestCode(orderNumber, email)` — e-mails a 6-digit code to the
+ *      address on the order. Always resolves generically, so order numbers
+ *      can't be enumerated.
+ *   2. `verifyCode(code)` — verifies the code, then exposes the full
+ *      `order` detail and a short-lived `accessToken`.
+ *
+ * Knowing the order number alone is never enough to see the detail — control
+ * of the order e-mail must be proven first.
+ */
+declare function useOrderAccess(): {
+    /** Step 1: send the code. */
+    requestCode: (on: string, em: string) => Promise<OrderAccessRequestResponse>;
+    isRequesting: boolean;
+    requestError: Error | null;
+    /** True once a code has been requested (move the UI to the code input). */
+    codeSent: boolean;
+    /** Step 2: verify the code. */
+    verifyCode: (code: string) => Promise<OrderAccessVerifyResponse>;
+    isVerifying: boolean;
+    verifyError: Error | null;
+    /** Full order detail, available after a successful verify. */
+    order: OrderDetail | null;
+    /** Short-lived token scoped to this order (30 min). */
+    accessToken: string | null;
+    reset: () => void;
+};
+
 declare function useCheckout(): {
     createOrder: (input: CheckoutInput) => Promise<OrderDetail>;
     isCreating: boolean;
@@ -862,4 +891,4 @@ declare function useBehioClient(): BehioStorefront;
  */
 declare function formatPrice(amount: number, currency: string, locale?: string): string;
 
-export { ActivePromotion, BehioProvider, type BehioProviderProps, Bundle, Cart, Category, CategoryDetail, CheckoutInput, CookieConsent, CookieConsentInput, CrossSellItem, CustomerAddress, CustomerProfile, FilterField, GiftCardBalance, OrderDetail, OrderListItem, Page, PageDetail, PaginatedResponse, ProductDetail, ProductLabel, ProductListItem, ProductReviewsResponse, ProductsQuery, QuoteRequest, RegisterInput, ReturnRequest, ShopInfo, ShopSeo, type StorageAdapter, SubmitQuoteInput, SubmitReturnInput, SubmitReviewInput, type UseAddressAutocompleteOptions, type UseAddressAutocompleteReturn, type UseAddressesOptions, type UseCartCountOptions, type UseCartOptions, type UseCategoriesOptions, type UseCategoryOptions, type UseCustomerOptions, type UseFeaturedOptions, type UseFiltersOptions, type UseLabelsOptions, type UseOrderOptions, type UseOrdersOptions, type UsePageOptions, type UsePagesOptions, type UseProductOptions, type UseProductsOptions, type UseSearchOptions, type UseShopInfoOptions, type UseShopSeoOptions, WishlistItem, cookieStorage, createMemoryStorage, detectStorage, formatPrice, localStorageAdapter, memoryStorage, useAddressAutocomplete, useAddresses, useAuth, useBehio, useBehioClient, useBundle, useBundles, useCart, useCartCount, useCategories, useCategory, useCheckout, useCookieConsent, useCrossSell, useCustomer, useFeatured, useFilters, useGiftCardBalance, useIsInWishlist, useLabels, useLookupReturnableOrder, useNotifyWhenAvailable, useOrder, useOrders, usePage, usePages, useProduct, useProductPromotions, useProductReviews, useProducts, useQuoteStatus, useReturnStatus, useSearch, useShopInfo, useShopSeo, useSubmitQuote, useSubmitReturn, useSubmitReview, useWishlist };
+export { ActivePromotion, BehioProvider, type BehioProviderProps, Bundle, Cart, Category, CategoryDetail, CheckoutInput, CookieConsent, CookieConsentInput, CrossSellItem, CustomerAddress, CustomerProfile, FilterField, GiftCardBalance, OrderDetail, OrderListItem, Page, PageDetail, PaginatedResponse, ProductDetail, ProductLabel, ProductListItem, ProductReviewsResponse, ProductsQuery, QuoteRequest, RegisterInput, ReturnRequest, ShopInfo, ShopSeo, type StorageAdapter, SubmitQuoteInput, SubmitReturnInput, SubmitReviewInput, type UseAddressAutocompleteOptions, type UseAddressAutocompleteReturn, type UseAddressesOptions, type UseCartCountOptions, type UseCartOptions, type UseCategoriesOptions, type UseCategoryOptions, type UseCustomerOptions, type UseFeaturedOptions, type UseFiltersOptions, type UseLabelsOptions, type UseOrderOptions, type UseOrdersOptions, type UsePageOptions, type UsePagesOptions, type UseProductOptions, type UseProductsOptions, type UseSearchOptions, type UseShopInfoOptions, type UseShopSeoOptions, WishlistItem, cookieStorage, createMemoryStorage, detectStorage, formatPrice, localStorageAdapter, memoryStorage, useAddressAutocomplete, useAddresses, useAuth, useBehio, useBehioClient, useBundle, useBundles, useCart, useCartCount, useCategories, useCategory, useCheckout, useCookieConsent, useCrossSell, useCustomer, useFeatured, useFilters, useGiftCardBalance, useIsInWishlist, useLabels, useLookupReturnableOrder, useNotifyWhenAvailable, useOrder, useOrderAccess, useOrders, usePage, usePages, useProduct, useProductPromotions, useProductReviews, useProducts, useQuoteStatus, useReturnStatus, useSearch, useShopInfo, useShopSeo, useSubmitQuote, useSubmitReturn, useSubmitReview, useWishlist };

package/dist/react.js

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
+var _chunkLNSFBNPJjs = require('./chunk-LNSFBNPJ.js');
 
 // src/react/provider.tsx
 var _react = require('react');
@@ -114,7 +114,7 @@ function BehioProvider({
   const storageAdapter = _react.useMemo.call(void 0, () => resolveStorage(storageOption), [storageOption]);
   const clientRef = _react.useRef.call(void 0, null);
   if (!clientRef.current) {
-    clientRef.current = new (0, _chunkDMTMGPUZjs.BehioStorefront)({
+    clientRef.current = new (0, _chunkLNSFBNPJjs.BehioStorefront)({
       apiKey,
       baseUrl,
       locale,
@@ -886,6 +886,66 @@ function useOrder(orderNumber, options) {
   };
 }
 
+// src/react/hooks/use-order-access.ts
+
+
+function useOrderAccess() {
+  const { client } = useBehio();
+  const [orderNumber, setOrderNumber] = _react.useState.call(void 0, null);
+  const [email, setEmail] = _react.useState.call(void 0, null);
+  const [order, setOrder] = _react.useState.call(void 0, null);
+  const [accessToken, setAccessToken] = _react.useState.call(void 0, null);
+  const requestMutation = _reactquery.useMutation.call(void 0, {
+    mutationFn: (input) => unwrap(client.orders.requestAccessCode(input.orderNumber, input.email)),
+    onSuccess: (_data, input) => {
+      setOrderNumber(input.orderNumber);
+      setEmail(input.email);
+    }
+  });
+  const verifyMutation = _reactquery.useMutation.call(void 0, {
+    mutationFn: (code) => {
+      if (!orderNumber || !email) {
+        throw new Error("Request a code before verifying");
+      }
+      return unwrap(client.orders.verifyAccessCode(orderNumber, email, code));
+    },
+    onSuccess: (result) => {
+      setOrder(result.order);
+      setAccessToken(result.accessToken);
+    }
+  });
+  const requestCode = _react.useCallback.call(void 0, 
+    (on, em) => requestMutation.mutateAsync({ orderNumber: on, email: em }),
+    [requestMutation]
+  );
+  const verifyCode = _react.useCallback.call(void 0, (code) => verifyMutation.mutateAsync(code), [verifyMutation]);
+  const reset = _react.useCallback.call(void 0, () => {
+    setOrderNumber(null);
+    setEmail(null);
+    setOrder(null);
+    setAccessToken(null);
+    requestMutation.reset();
+    verifyMutation.reset();
+  }, [requestMutation, verifyMutation]);
+  return {
+    /** Step 1: send the code. */
+    requestCode,
+    isRequesting: requestMutation.isPending,
+    requestError: requestMutation.error,
+    /** True once a code has been requested (move the UI to the code input). */
+    codeSent: !!orderNumber && !!email,
+    /** Step 2: verify the code. */
+    verifyCode,
+    isVerifying: verifyMutation.isPending,
+    verifyError: verifyMutation.error,
+    /** Full order detail, available after a successful verify. */
+    order,
+    /** Short-lived token scoped to this order (30 min). */
+    accessToken,
+    reset
+  };
+}
+
 // src/react/hooks/use-checkout.ts
 
 
@@ -1216,4 +1276,5 @@ function formatPrice(amount, currency, locale) {
 
 
 
-exports.BehioProvider = BehioProvider; exports.cookieStorage = cookieStorage; exports.createMemoryStorage = createMemoryStorage; exports.detectStorage = detectStorage; exports.formatPrice = formatPrice; exports.localStorageAdapter = localStorageAdapter; exports.memoryStorage = memoryStorage; exports.useAddressAutocomplete = useAddressAutocomplete; exports.useAddresses = useAddresses; exports.useAuth = useAuth; exports.useBehio = useBehio; exports.useBehioClient = useBehioClient; exports.useBundle = useBundle; exports.useBundles = useBundles; exports.useCart = useCart; exports.useCartCount = useCartCount; exports.useCategories = useCategories; exports.useCategory = useCategory; exports.useCheckout = useCheckout; exports.useCookieConsent = useCookieConsent; exports.useCrossSell = useCrossSell; exports.useCustomer = useCustomer; exports.useFeatured = useFeatured; exports.useFilters = useFilters; exports.useGiftCardBalance = useGiftCardBalance; exports.useIsInWishlist = useIsInWishlist; exports.useLabels = useLabels; exports.useLookupReturnableOrder = useLookupReturnableOrder; exports.useNotifyWhenAvailable = useNotifyWhenAvailable; exports.useOrder = useOrder; exports.useOrders = useOrders; exports.usePage = usePage; exports.usePages = usePages; exports.useProduct = useProduct; exports.useProductPromotions = useProductPromotions; exports.useProductReviews = useProductReviews; exports.useProducts = useProducts; exports.useQuoteStatus = useQuoteStatus; exports.useReturnStatus = useReturnStatus; exports.useSearch = useSearch; exports.useShopInfo = useShopInfo; exports.useShopSeo = useShopSeo; exports.useSubmitQuote = useSubmitQuote; exports.useSubmitReturn = useSubmitReturn; exports.useSubmitReview = useSubmitReview; exports.useWishlist = useWishlist;
+
+exports.BehioProvider = BehioProvider; exports.cookieStorage = cookieStorage; exports.createMemoryStorage = createMemoryStorage; exports.detectStorage = detectStorage; exports.formatPrice = formatPrice; exports.localStorageAdapter = localStorageAdapter; exports.memoryStorage = memoryStorage; exports.useAddressAutocomplete = useAddressAutocomplete; exports.useAddresses = useAddresses; exports.useAuth = useAuth; exports.useBehio = useBehio; exports.useBehioClient = useBehioClient; exports.useBundle = useBundle; exports.useBundles = useBundles; exports.useCart = useCart; exports.useCartCount = useCartCount; exports.useCategories = useCategories; exports.useCategory = useCategory; exports.useCheckout = useCheckout; exports.useCookieConsent = useCookieConsent; exports.useCrossSell = useCrossSell; exports.useCustomer = useCustomer; exports.useFeatured = useFeatured; exports.useFilters = useFilters; exports.useGiftCardBalance = useGiftCardBalance; exports.useIsInWishlist = useIsInWishlist; exports.useLabels = useLabels; exports.useLookupReturnableOrder = useLookupReturnableOrder; exports.useNotifyWhenAvailable = useNotifyWhenAvailable; exports.useOrder = useOrder; exports.useOrderAccess = useOrderAccess; exports.useOrders = useOrders; exports.usePage = usePage; exports.usePages = usePages; exports.useProduct = useProduct; exports.useProductPromotions = useProductPromotions; exports.useProductReviews = useProductReviews; exports.useProducts = useProducts; exports.useQuoteStatus = useQuoteStatus; exports.useReturnStatus = useReturnStatus; exports.useSearch = useSearch; exports.useShopInfo = useShopInfo; exports.useShopSeo = useShopSeo; exports.useSubmitQuote = useSubmitQuote; exports.useSubmitReturn = useSubmitReturn; exports.useSubmitReview = useSubmitReview; exports.useWishlist = useWishlist;

package/dist/react.mjs

@@ -1,6 +1,6 @@
 import {
   BehioStorefront
-} from "./chunk-EZEZUV2B.mjs";
+} from "./chunk-O3IM7PAY.mjs";
 
 // src/react/provider.tsx
 import { useRef, useEffect, useMemo } from "react";
@@ -886,14 +886,74 @@ function useOrder(orderNumber, options) {
   };
 }
 
+// src/react/hooks/use-order-access.ts
+import { useCallback as useCallback9, useState as useState5 } from "react";
+import { useMutation as useMutation6 } from "@tanstack/react-query";
+function useOrderAccess() {
+  const { client } = useBehio();
+  const [orderNumber, setOrderNumber] = useState5(null);
+  const [email, setEmail] = useState5(null);
+  const [order, setOrder] = useState5(null);
+  const [accessToken, setAccessToken] = useState5(null);
+  const requestMutation = useMutation6({
+    mutationFn: (input) => unwrap(client.orders.requestAccessCode(input.orderNumber, input.email)),
+    onSuccess: (_data, input) => {
+      setOrderNumber(input.orderNumber);
+      setEmail(input.email);
+    }
+  });
+  const verifyMutation = useMutation6({
+    mutationFn: (code) => {
+      if (!orderNumber || !email) {
+        throw new Error("Request a code before verifying");
+      }
+      return unwrap(client.orders.verifyAccessCode(orderNumber, email, code));
+    },
+    onSuccess: (result) => {
+      setOrder(result.order);
+      setAccessToken(result.accessToken);
+    }
+  });
+  const requestCode = useCallback9(
+    (on, em) => requestMutation.mutateAsync({ orderNumber: on, email: em }),
+    [requestMutation]
+  );
+  const verifyCode = useCallback9((code) => verifyMutation.mutateAsync(code), [verifyMutation]);
+  const reset = useCallback9(() => {
+    setOrderNumber(null);
+    setEmail(null);
+    setOrder(null);
+    setAccessToken(null);
+    requestMutation.reset();
+    verifyMutation.reset();
+  }, [requestMutation, verifyMutation]);
+  return {
+    /** Step 1: send the code. */
+    requestCode,
+    isRequesting: requestMutation.isPending,
+    requestError: requestMutation.error,
+    /** True once a code has been requested (move the UI to the code input). */
+    codeSent: !!orderNumber && !!email,
+    /** Step 2: verify the code. */
+    verifyCode,
+    isVerifying: verifyMutation.isPending,
+    verifyError: verifyMutation.error,
+    /** Full order detail, available after a successful verify. */
+    order,
+    /** Short-lived token scoped to this order (30 min). */
+    accessToken,
+    reset
+  };
+}
+
 // src/react/hooks/use-checkout.ts
-import { useState as useState5, useCallback as useCallback9 } from "react";
-import { useMutation as useMutation6, useQueryClient as useQueryClient8 } from "@tanstack/react-query";
+import { useState as useState6, useCallback as useCallback10 } from "react";
+import { useMutation as useMutation7, useQueryClient as useQueryClient8 } from "@tanstack/react-query";
 function useCheckout() {
   const { client, storage } = useBehio();
   const queryClient = useQueryClient8();
-  const [order, setOrder] = useState5(null);
-  const mutation = useMutation6({
+  const [order, setOrder] = useState6(null);
+  const mutation = useMutation7({
     mutationFn: (input) => unwrap(client.checkout.createOrder(input)),
     onSuccess: (result) => {
       setOrder(result);
@@ -902,11 +962,11 @@ function useCheckout() {
       queryClient.invalidateQueries({ queryKey: ["behio", "orders"] });
     }
   });
-  const createOrder = useCallback9(
+  const createOrder = useCallback10(
     (input) => mutation.mutateAsync(input),
     [mutation]
   );
-  const reset = useCallback9(() => {
+  const reset = useCallback10(() => {
     setOrder(null);
     mutation.reset();
   }, [mutation]);
@@ -1023,7 +1083,7 @@ function useGiftCardBalance(code, options) {
 }
 
 // src/react/hooks/use-wishlist.ts
-import { useQuery as useQuery21, useMutation as useMutation7, useQueryClient as useQueryClient9 } from "@tanstack/react-query";
+import { useQuery as useQuery21, useMutation as useMutation8, useQueryClient as useQueryClient9 } from "@tanstack/react-query";
 function useWishlist(options) {
   const { client } = useBehio();
   const qc = useQueryClient9();
@@ -1032,11 +1092,11 @@ function useWishlist(options) {
     queryFn: () => unwrap(client.wishlist.get()),
     enabled: options?.enabled ?? true
   });
-  const addMutation = useMutation7({
+  const addMutation = useMutation8({
     mutationFn: (productId) => unwrap(client.wishlist.add(productId)),
     onSuccess: () => qc.invalidateQueries({ queryKey: ["behio", "wishlist"] })
   });
-  const removeMutation = useMutation7({
+  const removeMutation = useMutation8({
     mutationFn: (productId) => unwrap(client.wishlist.remove(productId)),
     onSuccess: () => qc.invalidateQueries({ queryKey: ["behio", "wishlist"] })
   });
@@ -1058,7 +1118,7 @@ function useIsInWishlist(productId) {
 }
 
 // src/react/hooks/use-reviews.ts
-import { useQuery as useQuery22, useMutation as useMutation8, useQueryClient as useQueryClient10 } from "@tanstack/react-query";
+import { useQuery as useQuery22, useMutation as useMutation9, useQueryClient as useQueryClient10 } from "@tanstack/react-query";
 function useProductReviews(productId, options) {
   const { client } = useBehio();
   return useQuery22({
@@ -1070,23 +1130,23 @@ function useProductReviews(productId, options) {
 function useSubmitReview() {
   const { client } = useBehio();
   const qc = useQueryClient10();
-  return useMutation8({
+  return useMutation9({
     mutationFn: (input) => unwrap(client.reviews.submit(input)),
     onSuccess: (_, input) => qc.invalidateQueries({ queryKey: ["behio", "reviews", input.productId] })
   });
 }
 
 // src/react/hooks/use-returns.ts
-import { useQuery as useQuery23, useMutation as useMutation9 } from "@tanstack/react-query";
+import { useQuery as useQuery23, useMutation as useMutation10 } from "@tanstack/react-query";
 function useLookupReturnableOrder() {
   const { client } = useBehio();
-  return useMutation9({
+  return useMutation10({
     mutationFn: ({ orderNumber, email }) => unwrap(client.returns.lookupOrder(orderNumber, email))
   });
 }
 function useSubmitReturn() {
   const { client } = useBehio();
-  return useMutation9({
+  return useMutation10({
     mutationFn: (input) => unwrap(client.returns.submit(input))
   });
 }
@@ -1100,7 +1160,7 @@ function useReturnStatus(returnId, email) {
 }
 
 // src/react/hooks/use-consent.ts
-import { useQuery as useQuery24, useMutation as useMutation10, useQueryClient as useQueryClient11 } from "@tanstack/react-query";
+import { useQuery as useQuery24, useMutation as useMutation11, useQueryClient as useQueryClient11 } from "@tanstack/react-query";
 function useCookieConsent(visitorId) {
   const { client } = useBehio();
   const qc = useQueryClient11();
@@ -1109,11 +1169,11 @@ function useCookieConsent(visitorId) {
     queryFn: () => unwrap(client.consent.get(visitorId)),
     enabled: Boolean(visitorId)
   });
-  const recordMutation = useMutation10({
+  const recordMutation = useMutation11({
     mutationFn: (input) => unwrap(client.consent.record(input)),
     onSuccess: () => qc.invalidateQueries({ queryKey: ["behio", "consent"] })
   });
-  const revokeMutation = useMutation10({
+  const revokeMutation = useMutation11({
     mutationFn: () => unwrap(client.consent.revoke(visitorId)),
     onSuccess: () => qc.invalidateQueries({ queryKey: ["behio", "consent"] })
   });
@@ -1125,10 +1185,10 @@ function useCookieConsent(visitorId) {
 }
 
 // src/react/hooks/use-quotes.ts
-import { useMutation as useMutation11, useQuery as useQuery25 } from "@tanstack/react-query";
+import { useMutation as useMutation12, useQuery as useQuery25 } from "@tanstack/react-query";
 function useSubmitQuote() {
   const { client } = useBehio();
-  return useMutation11({
+  return useMutation12({
     mutationFn: (input) => unwrap(client.quotes.submit(input))
   });
 }
@@ -1142,10 +1202,10 @@ function useQuoteStatus(quoteId, email) {
 }
 
 // src/react/hooks/use-back-in-stock.ts
-import { useMutation as useMutation12 } from "@tanstack/react-query";
+import { useMutation as useMutation13 } from "@tanstack/react-query";
 function useNotifyWhenAvailable() {
   const { client } = useBehio();
-  return useMutation12({
+  return useMutation13({
     mutationFn: ({ productId, email }) => unwrap(client.catalog.notifyWhenAvailable(productId, email))
   });
 }
@@ -1200,6 +1260,7 @@ export {
   useLookupReturnableOrder,
   useNotifyWhenAvailable,
   useOrder,
+  useOrderAccess,
   useOrders,
   usePage,
   usePages,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@behio/storefront-sdk",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "TypeScript SDK for Behio Headless E-Shop — core client + React hooks",
   "author": "Behio",
   "license": "MIT",