@behio/storefront-sdk 0.8.0 → 0.12.0

package/dist/{chunk-DMTMGPUZ.js → chunk-GGUHYQNF.js}

@@ -123,6 +123,7 @@ var BehioStorefront = class {
     this.rateLimitReset = null;
     this.baseUrl = (config.baseUrl || "https://api.behio.com").replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    this.shopDomain = config.shopDomain;
     this.defaultLocale = config.locale;
     this.defaultCurrency = config.currency;
     this.fetchFn = config.fetch || globalThis.fetch.bind(globalThis);
@@ -185,6 +186,28 @@ var BehioStorefront = class {
   clearCartSession() {
     this.cartSession = void 0;
   }
+  // --- Default currency / locale (runtime-switchable) ---
+  /**
+   * Set the default currency sent on every catalog request (unless a per-call
+   * `currency` overrides it). Read live at request time, so changing it takes
+   * effect immediately without rebuilding the client. Pass undefined to clear
+   * (falls back to the shop's default currency server-side).
+   */
+  setCurrency(currency) {
+    this.defaultCurrency = currency || void 0;
+  }
+  /** Get the current default currency, if any. */
+  getCurrency() {
+    return this.defaultCurrency;
+  }
+  /** Set the default locale sent on every catalog request (per-call wins). */
+  setLocale(locale) {
+    this.defaultLocale = locale || void 0;
+  }
+  /** Get the current default locale, if any. */
+  getLocale() {
+    return this.defaultLocale;
+  }
   // --- Event emitter ---
   /** Subscribe to SDK events. Returns an unsubscribe function. */
   on(event, handler) {
@@ -301,13 +324,19 @@ var BehioStorefront = class {
       "X-Api-Key": this.apiKey,
       "Content-Type": "application/json"
     };
+    if (this.shopDomain) {
+      headers["X-Shop-Domain"] = this.shopDomain;
+    }
     if (this.accessToken && _optionalChain([options, 'optionalAccess', _13 => _13.auth]) !== false) {
       headers["Authorization"] = `Bearer ${this.accessToken}`;
     }
     if (this.cartSession) {
       headers["X-Cart-Session"] = this.cartSession;
     }
-    const bodyStr = _optionalChain([options, 'optionalAccess', _14 => _14.body]) ? JSON.stringify(options.body) : void 0;
+    if (_optionalChain([options, 'optionalAccess', _14 => _14.headers])) {
+      Object.assign(headers, options.headers);
+    }
+    const bodyStr = _optionalChain([options, 'optionalAccess', _15 => _15.body]) ? JSON.stringify(options.body) : void 0;
     let interceptedConfig = {
       url,
       method,
@@ -321,7 +350,7 @@ var BehioStorefront = class {
     for (let attempt = 0; attempt <= this.retries; attempt++) {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-      if (_optionalChain([options, 'optionalAccess', _15 => _15.signal])) {
+      if (_optionalChain([options, 'optionalAccess', _16 => _16.signal])) {
         if (options.signal.aborted) {
           clearTimeout(timeoutId);
           throw new BehioNetworkError("Request aborted", false);
@@ -362,8 +391,8 @@ var BehioStorefront = class {
       this.emit("response", { method, path, status: res.status });
       if (!res.ok) {
         const body = await res.json().catch(() => null);
-        const apiError = new BehioApiError(res.status, body, _optionalChain([body, 'optionalAccess', _16 => _16.message]) || `API Error ${res.status}`);
-        if (res.status === 401 && this.refreshToken && _optionalChain([options, 'optionalAccess', _17 => _17.auth]) !== false && !_optionalChain([options, 'optionalAccess', _18 => _18._isRetryAfterRefresh])) {
+        const apiError = new BehioApiError(res.status, body, _optionalChain([body, 'optionalAccess', _17 => _17.message]) || `API Error ${res.status}`);
+        if (res.status === 401 && this.refreshToken && _optionalChain([options, 'optionalAccess', _18 => _18.auth]) !== false && !_optionalChain([options, 'optionalAccess', _19 => _19._isRetryAfterRefresh])) {
           try {
             await this.handleTokenRefresh();
             return this.rawRequest(method, path, { ...options, _isRetryAfterRefresh: true });
@@ -426,7 +455,7 @@ var CatalogModule = class {
   /** Get product detail by slug */
   async getProduct(slug, options) {
     return this.client.request("GET", `/catalog/products/${slug}`, {
-      query: { locale: _optionalChain([options, 'optionalAccess', _19 => _19.locale]), currency: _optionalChain([options, 'optionalAccess', _20 => _20.currency]) }
+      query: { locale: _optionalChain([options, 'optionalAccess', _20 => _20.locale]), currency: _optionalChain([options, 'optionalAccess', _21 => _21.currency]) }
     });
   }
   /** Get category tree */
@@ -460,7 +489,7 @@ var CatalogModule = class {
   /** Get featured products */
   async getFeatured(options) {
     return this.client.request("GET", "/catalog/featured", {
-      query: { locale: _optionalChain([options, 'optionalAccess', _21 => _21.locale]), currency: _optionalChain([options, 'optionalAccess', _22 => _22.currency]) }
+      query: { locale: _optionalChain([options, 'optionalAccess', _22 => _22.locale]), currency: _optionalChain([options, 'optionalAccess', _23 => _23.currency]) }
     });
   }
   /** Get available filter fields for dynamic filter UI */
@@ -505,7 +534,7 @@ var CatalogModule = class {
   /** List configured payment methods (filtered by currency). */
   async listPaymentMethods(opts) {
     const query = {};
-    if (_optionalChain([opts, 'optionalAccess', _23 => _23.currency])) query.currency = opts.currency;
+    if (_optionalChain([opts, 'optionalAccess', _24 => _24.currency])) query.currency = opts.currency;
     return this.client.request("GET", "/catalog/payment-methods", { query });
   }
 };
@@ -746,7 +775,7 @@ var OrdersModule = class {
   /** List customer orders (requires auth) */
   async list(options) {
     return this.client.request("GET", "/orders", {
-      query: { page: _optionalChain([options, 'optionalAccess', _24 => _24.page]), limit: _optionalChain([options, 'optionalAccess', _25 => _25.limit]) }
+      query: { page: _optionalChain([options, 'optionalAccess', _25 => _25.page]), limit: _optionalChain([options, 'optionalAccess', _26 => _26.limit]) }
     });
   }
   /** Get order detail (requires auth) */
@@ -757,10 +786,50 @@ var OrdersModule = class {
   async cancel(orderNumber) {
     return this.client.request("POST", `/orders/${orderNumber}/cancel`);
   }
-  /** Track order by tracking token (no customer login required, only API key) */
+  /**
+   * Track an order by tracking token (no login, only API key). Returns a
+   * PII-minimized view: order status + items + masked email + destination
+   * city, never full address / phone / billing — the token travels in URLs
+   * and e-mails so it must not expose full personal data.
+   */
   async track(trackingToken) {
     return this.client.request("GET", `/orders/track/${trackingToken}`, { auth: false });
   }
+  /**
+   * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+   * address on the order. The response is always generic (success) regardless
+   * of whether the order number + e-mail match, so order numbers can't be
+   * enumerated. No login, only API key.
+   */
+  async requestAccessCode(orderNumber, email) {
+    return this.client.request("POST", "/orders/access/request", {
+      auth: false,
+      body: { orderNumber, email }
+    });
+  }
+  /**
+   * Step 2 of guest order-access: verify the e-mailed code. On success returns
+   * the FULL order detail plus a short-lived `accessToken` you can pass to
+   * {@link getByAccessToken} to re-fetch the detail without re-entering the
+   * code. No login, only API key.
+   */
+  async verifyAccessCode(orderNumber, email, code) {
+    return this.client.request("POST", "/orders/access/verify", {
+      auth: false,
+      body: { orderNumber, email, code }
+    });
+  }
+  /**
+   * Re-fetch a guest order's full detail using the `accessToken` returned by
+   * {@link verifyAccessCode}. The token is scoped to that single order and
+   * expires after 30 minutes.
+   */
+  async getByAccessToken(accessToken) {
+    return this.client.request("GET", "/orders/access/detail", {
+      auth: false,
+      headers: { "X-Order-Access": accessToken }
+    });
+  }
 };
 var CustomerModule = class {
   constructor(client) {
@@ -860,8 +929,9 @@ var ReturnsModule = class {
   async submit(input) {
     return this.client.request("POST", "/returns", { body: input });
   }
+  /** Email is the ownership gate; POST so it never lands in a URL / log. */
   async getStatus(returnId, email) {
-    return this.client.request("GET", `/returns/${returnId}/status`, { query: { email } });
+    return this.client.request("POST", `/returns/${returnId}/status`, { body: { email } });
   }
 };
 var ConsentModule = class {
@@ -928,10 +998,10 @@ var ShippingModule = class {
    */
   async listMethods(opts) {
     const query = {};
-    if (_optionalChain([opts, 'optionalAccess', _26 => _26.currency])) query.currency = opts.currency;
-    if (_optionalChain([opts, 'optionalAccess', _27 => _27.country])) query.country = opts.country;
-    if (_optionalChain([opts, 'optionalAccess', _28 => _28.cartTotal]) != null) query.cartTotal = String(opts.cartTotal);
-    if (_optionalChain([opts, 'optionalAccess', _29 => _29.cartWeightKg]) != null) query.cartWeightKg = String(opts.cartWeightKg);
+    if (_optionalChain([opts, 'optionalAccess', _27 => _27.currency])) query.currency = opts.currency;
+    if (_optionalChain([opts, 'optionalAccess', _28 => _28.country])) query.country = opts.country;
+    if (_optionalChain([opts, 'optionalAccess', _29 => _29.cartTotal]) != null) query.cartTotal = String(opts.cartTotal);
+    if (_optionalChain([opts, 'optionalAccess', _30 => _30.cartWeightKg]) != null) query.cartWeightKg = String(opts.cartWeightKg);
     return this.client.request(
       "GET",
       "/catalog/shipping-methods",

package/dist/{chunk-EZEZUV2B.mjs → chunk-XITY2WQN.mjs}

@@ -123,6 +123,7 @@ var BehioStorefront = class {
     this.rateLimitReset = null;
     this.baseUrl = (config.baseUrl || "https://api.behio.com").replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    this.shopDomain = config.shopDomain;
     this.defaultLocale = config.locale;
     this.defaultCurrency = config.currency;
     this.fetchFn = config.fetch || globalThis.fetch.bind(globalThis);
@@ -185,6 +186,28 @@ var BehioStorefront = class {
   clearCartSession() {
     this.cartSession = void 0;
   }
+  // --- Default currency / locale (runtime-switchable) ---
+  /**
+   * Set the default currency sent on every catalog request (unless a per-call
+   * `currency` overrides it). Read live at request time, so changing it takes
+   * effect immediately without rebuilding the client. Pass undefined to clear
+   * (falls back to the shop's default currency server-side).
+   */
+  setCurrency(currency) {
+    this.defaultCurrency = currency || void 0;
+  }
+  /** Get the current default currency, if any. */
+  getCurrency() {
+    return this.defaultCurrency;
+  }
+  /** Set the default locale sent on every catalog request (per-call wins). */
+  setLocale(locale) {
+    this.defaultLocale = locale || void 0;
+  }
+  /** Get the current default locale, if any. */
+  getLocale() {
+    return this.defaultLocale;
+  }
   // --- Event emitter ---
   /** Subscribe to SDK events. Returns an unsubscribe function. */
   on(event, handler) {
@@ -301,12 +324,18 @@ var BehioStorefront = class {
       "X-Api-Key": this.apiKey,
       "Content-Type": "application/json"
     };
+    if (this.shopDomain) {
+      headers["X-Shop-Domain"] = this.shopDomain;
+    }
     if (this.accessToken && options?.auth !== false) {
       headers["Authorization"] = `Bearer ${this.accessToken}`;
     }
     if (this.cartSession) {
       headers["X-Cart-Session"] = this.cartSession;
     }
+    if (options?.headers) {
+      Object.assign(headers, options.headers);
+    }
     const bodyStr = options?.body ? JSON.stringify(options.body) : void 0;
     let interceptedConfig = {
       url,
@@ -757,10 +786,50 @@ var OrdersModule = class {
   async cancel(orderNumber) {
     return this.client.request("POST", `/orders/${orderNumber}/cancel`);
   }
-  /** Track order by tracking token (no customer login required, only API key) */
+  /**
+   * Track an order by tracking token (no login, only API key). Returns a
+   * PII-minimized view: order status + items + masked email + destination
+   * city, never full address / phone / billing — the token travels in URLs
+   * and e-mails so it must not expose full personal data.
+   */
   async track(trackingToken) {
     return this.client.request("GET", `/orders/track/${trackingToken}`, { auth: false });
   }
+  /**
+   * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+   * address on the order. The response is always generic (success) regardless
+   * of whether the order number + e-mail match, so order numbers can't be
+   * enumerated. No login, only API key.
+   */
+  async requestAccessCode(orderNumber, email) {
+    return this.client.request("POST", "/orders/access/request", {
+      auth: false,
+      body: { orderNumber, email }
+    });
+  }
+  /**
+   * Step 2 of guest order-access: verify the e-mailed code. On success returns
+   * the FULL order detail plus a short-lived `accessToken` you can pass to
+   * {@link getByAccessToken} to re-fetch the detail without re-entering the
+   * code. No login, only API key.
+   */
+  async verifyAccessCode(orderNumber, email, code) {
+    return this.client.request("POST", "/orders/access/verify", {
+      auth: false,
+      body: { orderNumber, email, code }
+    });
+  }
+  /**
+   * Re-fetch a guest order's full detail using the `accessToken` returned by
+   * {@link verifyAccessCode}. The token is scoped to that single order and
+   * expires after 30 minutes.
+   */
+  async getByAccessToken(accessToken) {
+    return this.client.request("GET", "/orders/access/detail", {
+      auth: false,
+      headers: { "X-Order-Access": accessToken }
+    });
+  }
 };
 var CustomerModule = class {
   constructor(client) {
@@ -860,8 +929,9 @@ var ReturnsModule = class {
   async submit(input) {
     return this.client.request("POST", "/returns", { body: input });
   }
+  /** Email is the ownership gate; POST so it never lands in a URL / log. */
   async getStatus(returnId, email) {
-    return this.client.request("GET", `/returns/${returnId}/status`, { query: { email } });
+    return this.client.request("POST", `/returns/${returnId}/status`, { body: { email } });
   }
 };
 var ConsentModule = class {

package/dist/index.d.mts

@@ -3,6 +3,14 @@ interface BehioStorefrontConfig {
     apiKey: string;
     /** Backend base URL. Default: https://api.behio.com */
     baseUrl?: string;
+    /**
+     * The domain this storefront is served on (e.g. "mujshop.cz"), sent as
+     * X-Shop-Domain. Only needed when ONE deployment serves several domains with
+     * a single "all domains" API key (e.g. a Vercel app behind mujshop.cz +
+     * mujshop.sk) AND there's no Origin header (server-side rendering). A
+     * domain-bound key, or a browser request (Origin), doesn't need it.
+     */
+    shopDomain?: string;
     /** Default locale for catalog requests. Default: none (uses shop default) */
     locale?: string;
     /** Default currency for price resolution. Default: none (uses shop default) */
@@ -392,6 +400,25 @@ interface OrderItem {
     totalPrice: number;
     totalPriceWithTax: number;
 }
+/**
+ * PII-minimized order view returned by `orders.track(token)`. The tracking
+ * token is shared in URLs and e-mails, so this deliberately omits full
+ * address, phone, billing and customer note, and masks the email.
+ */
+interface OrderTracking {
+    orderNumber: string;
+    status: OrderStatus;
+    paymentStatus: PaymentStatus;
+    fulfillmentStatus: FulfillmentStatus;
+    currency: string;
+    grandTotal: number;
+    /** Masked, e.g. "j***@e***.cz" */
+    emailMasked: string;
+    shippingCity: string | null;
+    shippingCountry: string | null;
+    items: OrderItem[];
+    createdAt: number;
+}
 interface OrderStatusHistory {
     fromStatus?: OrderStatus;
     toStatus: OrderStatus;
@@ -421,6 +448,19 @@ interface OrderDetail extends OrderListItem {
      */
     paymentRedirectUrl?: string | null;
 }
+/** Generic response to `orders.requestAccessCode` — never reveals existence. */
+interface OrderAccessRequestResponse {
+    success: boolean;
+    message: string;
+}
+/** Response to a successful `orders.verifyAccessCode`. */
+interface OrderAccessVerifyResponse {
+    /** Short-lived JWT scoped to this single order (use with `getByAccessToken`). */
+    accessToken: string;
+    /** Token lifetime in seconds. */
+    expiresIn: number;
+    order: OrderDetail;
+}
 interface CustomerProfile {
     id: string;
     email: string;
@@ -854,6 +894,7 @@ interface SubmitQuoteInput {
 declare class BehioStorefront {
     private baseUrl;
     private apiKey;
+    private shopDomain?;
     private defaultLocale?;
     private defaultCurrency?;
     private fetchFn;
@@ -906,6 +947,19 @@ declare class BehioStorefront {
     getCartSession(): string | undefined;
     /** Clear cart session */
     clearCartSession(): void;
+    /**
+     * Set the default currency sent on every catalog request (unless a per-call
+     * `currency` overrides it). Read live at request time, so changing it takes
+     * effect immediately without rebuilding the client. Pass undefined to clear
+     * (falls back to the shop's default currency server-side).
+     */
+    setCurrency(currency: string | undefined): void;
+    /** Get the current default currency, if any. */
+    getCurrency(): string | undefined;
+    /** Set the default locale sent on every catalog request (per-call wins). */
+    setLocale(locale: string | undefined): void;
+    /** Get the current default locale, if any. */
+    getLocale(): string | undefined;
     /** Subscribe to SDK events. Returns an unsubscribe function. */
     on(event: BehioEventType, handler: BehioEventHandler): () => void;
     /** @internal Emit an event (fire-and-forget, handler errors are swallowed) */
@@ -933,6 +987,7 @@ declare class BehioStorefront {
         query?: Record<string, string | number | boolean | undefined | string[] | number[]>;
         auth?: boolean;
         signal?: AbortSignal;
+        headers?: Record<string, string>;
     }): Promise<SdkResult<T>>;
     /**
      * Throws on failure (API error / network / timeout). Kept private so
@@ -1094,8 +1149,33 @@ declare class OrdersModule {
     get(orderNumber: string): Promise<SdkResult<OrderDetail>>;
     /** Cancel a PENDING order (requires auth) */
     cancel(orderNumber: string): Promise<SdkResult<OrderDetail>>;
-    /** Track order by tracking token (no customer login required, only API key) */
-    track(trackingToken: string): Promise<SdkResult<OrderDetail>>;
+    /**
+     * Track an order by tracking token (no login, only API key). Returns a
+     * PII-minimized view: order status + items + masked email + destination
+     * city, never full address / phone / billing — the token travels in URLs
+     * and e-mails so it must not expose full personal data.
+     */
+    track(trackingToken: string): Promise<SdkResult<OrderTracking>>;
+    /**
+     * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+     * address on the order. The response is always generic (success) regardless
+     * of whether the order number + e-mail match, so order numbers can't be
+     * enumerated. No login, only API key.
+     */
+    requestAccessCode(orderNumber: string, email: string): Promise<SdkResult<OrderAccessRequestResponse>>;
+    /**
+     * Step 2 of guest order-access: verify the e-mailed code. On success returns
+     * the FULL order detail plus a short-lived `accessToken` you can pass to
+     * {@link getByAccessToken} to re-fetch the detail without re-entering the
+     * code. No login, only API key.
+     */
+    verifyAccessCode(orderNumber: string, email: string, code: string): Promise<SdkResult<OrderAccessVerifyResponse>>;
+    /**
+     * Re-fetch a guest order's full detail using the `accessToken` returned by
+     * {@link verifyAccessCode}. The token is scoped to that single order and
+     * expires after 30 minutes.
+     */
+    getByAccessToken(accessToken: string): Promise<SdkResult<OrderDetail>>;
 }
 declare class CustomerModule {
     private client;
@@ -1164,6 +1244,7 @@ declare class ReturnsModule {
      */
     lookupOrder(orderNumber: string, email: string): Promise<SdkResult<ReturnableOrder>>;
     submit(input: SubmitReturnInput): Promise<SdkResult<ReturnRequest>>;
+    /** Email is the ownership gate; POST so it never lands in a URL / log. */
     getStatus(returnId: string, email: string): Promise<SdkResult<ReturnStatus>>;
 }
 declare class ConsentModule {
@@ -1256,4 +1337,4 @@ declare class ShippingModule {
     }>>;
 }
 
-export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };
+export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderAccessRequestResponse, type OrderAccessVerifyResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type OrderTracking, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };

package/dist/index.d.ts

@@ -3,6 +3,14 @@ interface BehioStorefrontConfig {
     apiKey: string;
     /** Backend base URL. Default: https://api.behio.com */
     baseUrl?: string;
+    /**
+     * The domain this storefront is served on (e.g. "mujshop.cz"), sent as
+     * X-Shop-Domain. Only needed when ONE deployment serves several domains with
+     * a single "all domains" API key (e.g. a Vercel app behind mujshop.cz +
+     * mujshop.sk) AND there's no Origin header (server-side rendering). A
+     * domain-bound key, or a browser request (Origin), doesn't need it.
+     */
+    shopDomain?: string;
     /** Default locale for catalog requests. Default: none (uses shop default) */
     locale?: string;
     /** Default currency for price resolution. Default: none (uses shop default) */
@@ -392,6 +400,25 @@ interface OrderItem {
     totalPrice: number;
     totalPriceWithTax: number;
 }
+/**
+ * PII-minimized order view returned by `orders.track(token)`. The tracking
+ * token is shared in URLs and e-mails, so this deliberately omits full
+ * address, phone, billing and customer note, and masks the email.
+ */
+interface OrderTracking {
+    orderNumber: string;
+    status: OrderStatus;
+    paymentStatus: PaymentStatus;
+    fulfillmentStatus: FulfillmentStatus;
+    currency: string;
+    grandTotal: number;
+    /** Masked, e.g. "j***@e***.cz" */
+    emailMasked: string;
+    shippingCity: string | null;
+    shippingCountry: string | null;
+    items: OrderItem[];
+    createdAt: number;
+}
 interface OrderStatusHistory {
     fromStatus?: OrderStatus;
     toStatus: OrderStatus;
@@ -421,6 +448,19 @@ interface OrderDetail extends OrderListItem {
      */
     paymentRedirectUrl?: string | null;
 }
+/** Generic response to `orders.requestAccessCode` — never reveals existence. */
+interface OrderAccessRequestResponse {
+    success: boolean;
+    message: string;
+}
+/** Response to a successful `orders.verifyAccessCode`. */
+interface OrderAccessVerifyResponse {
+    /** Short-lived JWT scoped to this single order (use with `getByAccessToken`). */
+    accessToken: string;
+    /** Token lifetime in seconds. */
+    expiresIn: number;
+    order: OrderDetail;
+}
 interface CustomerProfile {
     id: string;
     email: string;
@@ -854,6 +894,7 @@ interface SubmitQuoteInput {
 declare class BehioStorefront {
     private baseUrl;
     private apiKey;
+    private shopDomain?;
     private defaultLocale?;
     private defaultCurrency?;
     private fetchFn;
@@ -906,6 +947,19 @@ declare class BehioStorefront {
     getCartSession(): string | undefined;
     /** Clear cart session */
     clearCartSession(): void;
+    /**
+     * Set the default currency sent on every catalog request (unless a per-call
+     * `currency` overrides it). Read live at request time, so changing it takes
+     * effect immediately without rebuilding the client. Pass undefined to clear
+     * (falls back to the shop's default currency server-side).
+     */
+    setCurrency(currency: string | undefined): void;
+    /** Get the current default currency, if any. */
+    getCurrency(): string | undefined;
+    /** Set the default locale sent on every catalog request (per-call wins). */
+    setLocale(locale: string | undefined): void;
+    /** Get the current default locale, if any. */
+    getLocale(): string | undefined;
     /** Subscribe to SDK events. Returns an unsubscribe function. */
     on(event: BehioEventType, handler: BehioEventHandler): () => void;
     /** @internal Emit an event (fire-and-forget, handler errors are swallowed) */
@@ -933,6 +987,7 @@ declare class BehioStorefront {
         query?: Record<string, string | number | boolean | undefined | string[] | number[]>;
         auth?: boolean;
         signal?: AbortSignal;
+        headers?: Record<string, string>;
     }): Promise<SdkResult<T>>;
     /**
      * Throws on failure (API error / network / timeout). Kept private so
@@ -1094,8 +1149,33 @@ declare class OrdersModule {
     get(orderNumber: string): Promise<SdkResult<OrderDetail>>;
     /** Cancel a PENDING order (requires auth) */
     cancel(orderNumber: string): Promise<SdkResult<OrderDetail>>;
-    /** Track order by tracking token (no customer login required, only API key) */
-    track(trackingToken: string): Promise<SdkResult<OrderDetail>>;
+    /**
+     * Track an order by tracking token (no login, only API key). Returns a
+     * PII-minimized view: order status + items + masked email + destination
+     * city, never full address / phone / billing — the token travels in URLs
+     * and e-mails so it must not expose full personal data.
+     */
+    track(trackingToken: string): Promise<SdkResult<OrderTracking>>;
+    /**
+     * Step 1 of guest order-access: request a 6-digit code e-mailed to the
+     * address on the order. The response is always generic (success) regardless
+     * of whether the order number + e-mail match, so order numbers can't be
+     * enumerated. No login, only API key.
+     */
+    requestAccessCode(orderNumber: string, email: string): Promise<SdkResult<OrderAccessRequestResponse>>;
+    /**
+     * Step 2 of guest order-access: verify the e-mailed code. On success returns
+     * the FULL order detail plus a short-lived `accessToken` you can pass to
+     * {@link getByAccessToken} to re-fetch the detail without re-entering the
+     * code. No login, only API key.
+     */
+    verifyAccessCode(orderNumber: string, email: string, code: string): Promise<SdkResult<OrderAccessVerifyResponse>>;
+    /**
+     * Re-fetch a guest order's full detail using the `accessToken` returned by
+     * {@link verifyAccessCode}. The token is scoped to that single order and
+     * expires after 30 minutes.
+     */
+    getByAccessToken(accessToken: string): Promise<SdkResult<OrderDetail>>;
 }
 declare class CustomerModule {
     private client;
@@ -1164,6 +1244,7 @@ declare class ReturnsModule {
      */
     lookupOrder(orderNumber: string, email: string): Promise<SdkResult<ReturnableOrder>>;
     submit(input: SubmitReturnInput): Promise<SdkResult<ReturnRequest>>;
+    /** Email is the ownership gate; POST so it never lands in a URL / log. */
     getStatus(returnId: string, email: string): Promise<SdkResult<ReturnStatus>>;
 }
 declare class ConsentModule {
@@ -1256,4 +1337,4 @@ declare class ShippingModule {
     }>>;
 }
 
-export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };
+export { type ActivePromotion, type AddToCartInput, type AddressDetail, type AddressSuggestion, type AddressType, AddressTypes, type AuthTokens, type BackInStockSubscription, BehioApiError, type BehioErrorCode, type BehioEventHandler, type BehioEventType, BehioNetworkError, BehioStorefront, type BehioStorefrontConfig, type Bundle, type BundleItem, type Cart, type CartDiscount, type CartItem, type CartItemProduct, type Category, type CategoryDetail, type CheckoutAddress, type CheckoutInput, type CheckoutPaymentMethod, type CookieConsent, type CookieConsentInput, type CrossSellItem, type CustomerAddress, type CustomerProfile, type DataGroupFieldType, type FilterField, type FulfillmentStatus, FulfillmentStatuses, type GiftCardBalance, type LoginInput, type MessageResponse, type OrderAccessRequestResponse, type OrderAccessVerifyResponse, type OrderDetail, type OrderItem, type OrderListItem, type OrderStatus, type OrderStatusHistory, OrderStatuses, type OrderTracking, type Page, type PageAttachment, type PageDetail, type PaginatedResponse, type PaymentStatus, PaymentStatuses, type ProductDetail, type ProductLabel, type ProductListItem, type ProductMedia, type ProductMediaVariant, type ProductPrice, type ProductReview, type ProductReviewsResponse, ProductSort, type ProductSortValue, type ProductVariant, type ProductVolumePrice, type ProductsQuery, type QuoteItem, type QuoteRequest, type RegisterInput, type RequestInterceptor, type RequestInterceptorConfig, type ResponseInterceptor, type ResponseInterceptorData, type ReturnRequest, type ReturnRequestItem, type ReturnStatus, type ReturnStatusItem, type ReturnableOrder, type ReturnableOrderItem, type SdkError, type SdkResult, type ShippingMethodSummary, type ShippingQuote, type ShippingQuoteInput, type ShopInfo, type ShopSeo, type SubmitQuoteInput, type SubmitReturnInput, type SubmitReviewInput, type WishlistItem, err, ok, toSdkError };

package/dist/index.js

@@ -10,7 +10,7 @@
 
 
 
-var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
+var _chunkGGUHYQNFjs = require('./chunk-GGUHYQNF.js');
 
 
 
@@ -23,4 +23,4 @@ var _chunkDMTMGPUZjs = require('./chunk-DMTMGPUZ.js');
 
 
 
-exports.AddressTypes = _chunkDMTMGPUZjs.AddressTypes; exports.BehioApiError = _chunkDMTMGPUZjs.BehioApiError; exports.BehioNetworkError = _chunkDMTMGPUZjs.BehioNetworkError; exports.BehioStorefront = _chunkDMTMGPUZjs.BehioStorefront; exports.FulfillmentStatuses = _chunkDMTMGPUZjs.FulfillmentStatuses; exports.OrderStatuses = _chunkDMTMGPUZjs.OrderStatuses; exports.PaymentStatuses = _chunkDMTMGPUZjs.PaymentStatuses; exports.ProductSort = _chunkDMTMGPUZjs.ProductSort; exports.err = _chunkDMTMGPUZjs.err; exports.ok = _chunkDMTMGPUZjs.ok; exports.toSdkError = _chunkDMTMGPUZjs.toSdkError;
+exports.AddressTypes = _chunkGGUHYQNFjs.AddressTypes; exports.BehioApiError = _chunkGGUHYQNFjs.BehioApiError; exports.BehioNetworkError = _chunkGGUHYQNFjs.BehioNetworkError; exports.BehioStorefront = _chunkGGUHYQNFjs.BehioStorefront; exports.FulfillmentStatuses = _chunkGGUHYQNFjs.FulfillmentStatuses; exports.OrderStatuses = _chunkGGUHYQNFjs.OrderStatuses; exports.PaymentStatuses = _chunkGGUHYQNFjs.PaymentStatuses; exports.ProductSort = _chunkGGUHYQNFjs.ProductSort; exports.err = _chunkGGUHYQNFjs.err; exports.ok = _chunkGGUHYQNFjs.ok; exports.toSdkError = _chunkGGUHYQNFjs.toSdkError;

package/dist/index.mjs

@@ -10,7 +10,7 @@ import {
   err,
   ok,
   toSdkError
-} from "./chunk-EZEZUV2B.mjs";
+} from "./chunk-XITY2WQN.mjs";
 export {
   AddressTypes,
   BehioApiError,

package/dist/next.d.mts

@@ -3,6 +3,8 @@ import { BehioStorefrontConfig, BehioStorefront } from './index.mjs';
 interface GetBehioOptions extends Partial<BehioStorefrontConfig> {
     /** Override the cart session cookie name (default: "behio_cart_session"). */
     cartCookieName?: string;
+    /** Override the currency cookie name (default: "behio_currency"). */
+    currencyCookieName?: string;
 }
 /**
  * Returns a per-request bound BehioStorefront instance. Reads the cart

package/dist/next.d.ts

@@ -3,6 +3,8 @@ import { BehioStorefrontConfig, BehioStorefront } from './index.js';
 interface GetBehioOptions extends Partial<BehioStorefrontConfig> {
     /** Override the cart session cookie name (default: "behio_cart_session"). */
     cartCookieName?: string;
+    /** Override the currency cookie name (default: "behio_currency"). */
+    currencyCookieName?: string;
 }
 /**
  * Returns a per-request bound BehioStorefront instance. Reads the cart