@commercengine/pos 0.4.6 → 0.6.0

package/dist/index.mjs

@@ -427,6 +427,696 @@ function getPathnameFromUrl(url) {
 	}
 }
 //#endregion
+//#region src/lib/auth-token-storage.ts
+const DEFAULT_PREFIX = "ce_pos_";
+const AUTH_SESSION_LOCK = "ce-pos-auth-session";
+const AUTH_CONTEXT_LOCK = "ce-pos-auth-context";
+const SESSION_VERSION = 1;
+/**
+* A refresh the server answered, and refused — or one that could not even be
+* asked, because the refresh token itself has expired.
+*
+* Only this ends a session. Everything else a refresh can run into — no
+* network, a gateway timeout, a 5xx, a response that would not parse — says
+* nothing about whether the session is still good, so the tokens are kept
+* and the next request tries again. A refresh handler an app installs
+* (`setRefreshHandler`) says "refused" by throwing this, or any error with
+* the same `name` and shape: the check is by shape, not by class, so an app
+* on an older package can speak the contract.
+*/
+var RefreshRejectedError = class extends Error {
+	status;
+	reason;
+	constructor(detail) {
+		const reason = detail.reason ?? "rejected";
+		super(reason === "expired" ? "No valid refresh token available" : `POS token refresh rejected: ${detail.status ?? "unknown"}`);
+		this.name = "RefreshRejectedError";
+		this.status = detail.status ?? null;
+		this.reason = reason;
+	}
+};
+/**
+* A refresh that could not complete — no network, a timeout, a 5xx, a body
+* that would not parse. Wrapped so a caller can tell it from a lost lease or
+* a failed store: those are not the refresh's fault, and a request that
+* would otherwise go out on the API key alone must stay closed for them.
+* The cause keeps its message, so callers reading the message see the
+* original failure.
+*/
+var RefreshUnavailableError = class extends Error {
+	cause;
+	constructor(cause) {
+		super(cause instanceof Error ? cause.message : "POS token refresh could not complete");
+		this.name = "RefreshUnavailableError";
+		this.cause = cause;
+	}
+};
+/** Whether a thrown error came out of the refresh itself, refused or not. */
+function isRefreshFailure(error) {
+	if (!error || typeof error !== "object") return false;
+	const name = error.name;
+	return name === "RefreshRejectedError" || name === "RefreshUnavailableError";
+}
+const DEFINITIVE_REFRESH_STATUSES = /* @__PURE__ */ new Set([
+	400,
+	401,
+	403
+]);
+/** Whether a refresh failure means the session is over — see `RefreshRejectedError`. */
+function refreshEndsSession(error) {
+	if (!error || typeof error !== "object") return false;
+	const shaped = error;
+	if (shaped.name !== "RefreshRejectedError") return false;
+	if (shaped.reason === "expired") return true;
+	return typeof shaped.status === "number" && DEFINITIVE_REFRESH_STATUSES.has(shaped.status);
+}
+/**
+* How long a new page waits for the context lock before concluding that
+* another page really holds it.
+*
+* A reload is the common case: the old document's lock is released when it is
+* destroyed, and that release and the new document's request race in the
+* browser process. Asking with `ifAvailable` lost that race on a slower
+* WebView every time, and a lost race read as "another tab owns this till" —
+* a login screen over a session that was still on the device. Queueing for
+* the lock is granted the moment the old document lets go, which is
+* milliseconds; only a page that is genuinely still open keeps it this long.
+*/
+const DEFAULT_LEASE_WAIT_MS = 4e3;
+const browserStorage = () => {
+	try {
+		return typeof localStorage === "undefined" ? null : localStorage;
+	} catch {
+		return null;
+	}
+};
+const browserLocks = () => {
+	try {
+		return typeof navigator === "undefined" ? null : navigator.locks ?? null;
+	} catch {
+		return null;
+	}
+};
+const newRevision = () => {
+	try {
+		if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+	} catch {}
+	return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+};
+const tokenNeedsRefresh = (token) => {
+	try {
+		const payloadPart = token.split(".")[1];
+		if (!payloadPart) return true;
+		let base64 = payloadPart.replace(/-/g, "+").replace(/_/g, "/");
+		const padding = base64.length % 4;
+		if (padding) base64 += "=".repeat(4 - padding);
+		const payload = JSON.parse(atob(base64));
+		return typeof payload.exp !== "number" || Math.floor(Date.now() / 1e3) >= payload.exp - 30;
+	} catch {
+		return true;
+	}
+};
+const isNonemptyString = (value) => typeof value === "string" && value.length > 0;
+const normalizeStoredTokenPair = (value) => {
+	if (!value || typeof value !== "object") throw new Error("Invalid POS auth token pair.");
+	const tokens = value;
+	const hasCanonicalShape = "access_token" in tokens || "refresh_token" in tokens;
+	const hasLegacyShape = "accessToken" in tokens || "refreshToken" in tokens;
+	if (hasCanonicalShape === hasLegacyShape) throw new Error("Invalid POS auth token pair.");
+	const accessToken = hasCanonicalShape ? tokens.access_token : tokens.accessToken;
+	const refreshToken = hasCanonicalShape ? tokens.refresh_token : tokens.refreshToken;
+	if (!isNonemptyString(accessToken) || !isNonemptyString(refreshToken)) throw new Error("Invalid POS auth token pair.");
+	return {
+		pair: {
+			access_token: accessToken,
+			refresh_token: refreshToken
+		},
+		wasLegacy: hasLegacyShape
+	};
+};
+const parseSession = (raw) => {
+	const parsed = JSON.parse(raw);
+	if (!parsed || typeof parsed !== "object") throw new Error("Invalid POS auth session record.");
+	const record = parsed;
+	if (record.version !== SESSION_VERSION || !isNonemptyString(record.revision)) throw new Error("Unsupported POS auth session record.");
+	if (record.tokens === null) return {
+		session: {
+			version: SESSION_VERSION,
+			revision: record.revision,
+			tokens: null
+		},
+		wasLegacy: false
+	};
+	const normalized = normalizeStoredTokenPair(record.tokens);
+	return {
+		session: {
+			version: SESSION_VERSION,
+			revision: record.revision,
+			tokens: normalized.pair
+		},
+		wasLegacy: normalized.wasLegacy
+	};
+};
+/**
+* Browser token storage with one same-origin session owner.
+*
+* Revision and both tokens live in one versioned localStorage value. A Web
+* Storage write is atomic, so process termination can expose either the old
+* complete session or the new complete session, never a mixed token pair or an
+* old pair relabelled with a new owner revision.
+*/
+var CoordinatedBrowserTokenStorage = class {
+	#sessionKey;
+	#legacyAccessKey;
+	#legacyRefreshKey;
+	#legacyRevisionKey;
+	#storage;
+	#locks;
+	#createRevision;
+	#listeners = /* @__PURE__ */ new Set();
+	#onStorage = (event) => {
+		if (!this.#leaseHeld || event.key !== this.#sessionKey) return;
+		try {
+			if ((event.newValue === null ? null : parseSession(event.newValue).session.revision) === this.#ownedRevision) return;
+		} catch {}
+		this.#pendingAccess = null;
+		this.#notify("stale");
+	};
+	#ownedRevision = null;
+	#leaseReady;
+	#leaseWaitMs;
+	#leaseHeld = false;
+	#releaseLease = null;
+	#lastReadRefreshToken = null;
+	#refreshHandler = null;
+	#refreshInFlight = null;
+	#pendingAccess = null;
+	constructor(prefix = DEFAULT_PREFIX, options = {}) {
+		this.#leaseWaitMs = options.leaseWaitMs ?? DEFAULT_LEASE_WAIT_MS;
+		this.#sessionKey = `${prefix}auth_session`;
+		this.#legacyAccessKey = `${prefix}access_token`;
+		this.#legacyRefreshKey = `${prefix}refresh_token`;
+		this.#legacyRevisionKey = `${prefix}auth_revision`;
+		this.#storage = options.storage ?? browserStorage;
+		this.#locks = options.locks ?? browserLocks;
+		this.#createRevision = options.createRevision ?? newRevision;
+		this.#leaseReady = this.#acquireContextLease();
+		try {
+			if (typeof window !== "undefined") window.addEventListener("storage", this.#onStorage);
+		} catch {}
+	}
+	onOwnershipLost(listener) {
+		this.#listeners.add(listener);
+		return () => this.#listeners.delete(listener);
+	}
+	setRefreshHandler(handler) {
+		this.#refreshHandler = handler;
+	}
+	waitForContextLease() {
+		return this.#leaseReady;
+	}
+	/** Test/lifecycle hook; a destroyed page releases the Web Lock implicitly. */
+	releaseContextLease() {
+		this.#releaseLease?.();
+		this.#releaseLease = null;
+	}
+	/** Claim credentials already written by an SDK/login test boundary. */
+	adoptExistingSessionOwner() {
+		if (!this.#leaseHeld) {
+			this.#notify("storage");
+			return null;
+		}
+		return this.#beginSessionOwner(true);
+	}
+	/** Logout retains its exact bearer pair until the server request is sent. */
+	beginLogoutSession() {
+		if (!this.#leaseHeld) {
+			this.#notify("storage");
+			return null;
+		}
+		return this.#beginSessionOwner(true);
+	}
+	/** Login atomically advances ownership and retires the previous pair. */
+	async beginLoginSession() {
+		if (!this.#leaseHeld && !await this.#leaseReady) {
+			this.#notify("storage");
+			return false;
+		}
+		if (!this.#leaseHeld) {
+			this.#notify("storage");
+			return false;
+		}
+		return this.#beginSessionOwner(false) !== null;
+	}
+	#beginSessionOwner(preservePair) {
+		this.#pendingAccess = null;
+		this.#lastReadRefreshToken = null;
+		try {
+			const current = this.#readSessionOrMigrate();
+			const revision = this.#createRevision();
+			const next = {
+				version: SESSION_VERSION,
+				revision,
+				tokens: preservePair ? current?.tokens ?? null : null
+			};
+			this.#writeSession(next);
+			this.#ownedRevision = revision;
+			return revision;
+		} catch {
+			this.#notify("storage");
+			return null;
+		}
+	}
+	captureOwner() {
+		try {
+			if (!this.#leaseHeld) throw new Error("This browser context does not own the POS session.");
+			const session = this.#readSessionOrMigrate();
+			return {
+				revision: this.#ownedRevision,
+				accessToken: session?.tokens?.access_token ?? null,
+				refreshToken: session?.tokens?.refresh_token ?? null
+			};
+		} catch {
+			this.#notify("storage");
+			return {
+				revision: this.#ownedRevision,
+				accessToken: null,
+				refreshToken: null
+			};
+		}
+	}
+	owns(owner) {
+		return this.#leaseHeld && owner.revision === this.#ownedRevision && this.#ownsSharedRevision(owner.revision);
+	}
+	sharesRevision(owner) {
+		if (owner.revision === null) return false;
+		try {
+			return this.#readSessionOrMigrate()?.revision === owner.revision;
+		} catch {
+			this.#notify("storage");
+			return false;
+		}
+	}
+	ownsCurrentSession() {
+		return this.#ownsSharedRevision(this.#ownedRevision);
+	}
+	/** Pure ownership probe for transaction code that must not mutate auth. */
+	isCurrentSessionOwner() {
+		if (!this.#leaseHeld) return false;
+		try {
+			const sharedRevision = this.#readSessionOrMigrate()?.revision ?? null;
+			return sharedRevision === null || this.#ownedRevision !== null && sharedRevision === this.#ownedRevision;
+		} catch {
+			return false;
+		}
+	}
+	hasCurrentPair(accessToken, refreshToken) {
+		if (!this.#ownsSharedRevision(this.#ownedRevision)) return false;
+		try {
+			const pair = this.#readSessionOrMigrate()?.tokens;
+			return pair?.access_token === accessToken && pair.refresh_token === refreshToken;
+		} catch {
+			this.#notify("storage");
+			return false;
+		}
+	}
+	assertCurrentSession() {
+		const current = this.ownsCurrentSession();
+		if (!current) this.#notify("stale");
+		return current;
+	}
+	/** Used by the SDK callback after its request-owned clear attempt. */
+	notifySdkTokensCleared() {
+		this.#notify("stale");
+	}
+	async getAccessToken() {
+		return (await this.getRequestOwner()).accessToken;
+	}
+	/**
+	* Atomically capture the bearer and revision for one SDK request.
+	*
+	* Return the private operation's promise directly. That operation performs
+	* any proactive refresh and captures both fields in its final synchronous
+	* continuation, leaving no second await where a same-token revision change
+	* could pair an old bearer with a new owner.
+	*/
+	getRequestOwner() {
+		const initiatingRevision = this.#ownedRevision;
+		return this.#readRequestOwner(initiatingRevision);
+	}
+	async #readRequestOwner(initiatingRevision) {
+		await this.#requireLease();
+		this.#assertRequestRevision(initiatingRevision);
+		const pair = this.#readPairOrThrow();
+		const accessToken = pair?.access_token ?? null;
+		const refreshToken = pair?.refresh_token;
+		if (accessToken && tokenNeedsRefresh(accessToken) && refreshToken && this.#refreshHandler) await this.#refreshOwnedPair({
+			revision: initiatingRevision,
+			accessToken,
+			refreshToken
+		});
+		this.#assertRequestRevision(initiatingRevision);
+		const current = this.#readSessionOrThrow();
+		return {
+			accessToken: current.tokens?.access_token ?? null,
+			refreshToken: current.tokens?.refresh_token ?? null,
+			revision: current.revision
+		};
+	}
+	/**
+	* Recover one request whose bearer the server rejected before its JWT expiry.
+	*
+	* The SDK's response middleware refreshes a 401 only after its own expiry
+	* check has elapsed. A server-side expiry can lead that clock, so long-lived
+	* pollers use this request-owned boundary to join the same storage
+	* single-flight and retry once with the rotated pair.
+	*/
+	async recoverAfterUnauthorized(owner) {
+		try {
+			await this.#requireLease();
+		} catch {
+			return "failed";
+		}
+		if (this.#pairReplaced(owner)) return "refreshed";
+		if (!this.owns(owner) || !owner.accessToken || !owner.refreshToken || !this.#refreshHandler) return "stale";
+		try {
+			await this.#refreshOwnedPair(owner);
+		} catch {
+			return this.#pairReplaced(owner) ? "refreshed" : "failed";
+		}
+		if (this.#pairReplaced(owner)) return "refreshed";
+		return this.owns(owner) ? "failed" : "stale";
+	}
+	async #refreshOwnedPair(owner) {
+		const refreshHandler = this.#refreshHandler;
+		const refreshToken = owner.refreshToken;
+		if (!refreshHandler || !refreshToken) throw new Error("No POS refresh token is available.");
+		const refreshOperation = this.#refreshInFlight ?? (async () => {
+			try {
+				if (tokenNeedsRefresh(refreshToken)) throw new RefreshRejectedError({ reason: "expired" });
+				await this.#runSdkRefresh(owner.revision, refreshToken, (ownedAccessToken) => refreshHandler(refreshToken, ownedAccessToken));
+			} catch (error) {
+				if (this.#pairReplaced(owner)) return;
+				if (!refreshEndsSession(error)) throw new RefreshUnavailableError(error);
+				const outcome = await this.#clearOwnedPair(owner);
+				if (outcome === "cleared") this.#notify("stale");
+				if (outcome === "failed") this.#notify("storage");
+				if (outcome !== "stale") throw error;
+			}
+		})();
+		this.#refreshInFlight = refreshOperation;
+		try {
+			await refreshOperation;
+		} finally {
+			if (this.#refreshInFlight === refreshOperation) this.#refreshInFlight = null;
+		}
+	}
+	#pairReplaced(owner) {
+		try {
+			const current = this.#readSessionOrMigrate();
+			return current?.revision === owner.revision && current.tokens !== null && current.tokens.access_token !== owner.accessToken;
+		} catch {
+			this.#notify("storage");
+			return false;
+		}
+	}
+	async getRefreshToken() {
+		await this.#requireLease();
+		this.#assertRequestOwner();
+		const token = this.#readPairOrThrow()?.refresh_token ?? null;
+		this.#lastReadRefreshToken = token;
+		return token;
+	}
+	/** Stage only; the pair becomes visible together from setRefreshToken. */
+	async setAccessToken(token) {
+		await this.#requireLease();
+		if (!this.#ownsSharedRevision(this.#ownedRevision)) {
+			this.#pendingAccess = null;
+			this.#notify("stale");
+			return;
+		}
+		this.#pendingAccess = {
+			revision: this.#ownedRevision,
+			expectedRefreshToken: this.#lastReadRefreshToken,
+			token
+		};
+	}
+	async setRefreshToken(token) {
+		await this.#requireLease();
+		const pending = this.#pendingAccess;
+		this.#pendingAccess = null;
+		if (!pending) {
+			this.#notify("storage");
+			return;
+		}
+		await this.#commitPair(pending.revision, pending.expectedRefreshToken, pending.token, token);
+	}
+	/**
+	* SDK compatibility boundary.
+	*
+	* The patched POS middleware supplies the bearer that produced a 403/logout
+	* response. An older response is therefore inert after login or refresh. SDK
+	* internal cleanup without a request bearer still captures the exact current
+	* pair before entering the serialized clear.
+	*/
+	async clearTokens(expectedAccessToken, expectedRevision) {
+		await this.#requireLease();
+		this.#pendingAccess = null;
+		const owner = this.captureOwner();
+		if ((expectedAccessToken !== void 0 || expectedRevision !== void 0) && (owner.accessToken !== (expectedAccessToken ?? null) || owner.revision !== (expectedRevision ?? null))) return false;
+		const outcome = await this.#clearOwnedPair(owner);
+		if (outcome === "failed") this.#notify("storage");
+		return outcome === "cleared";
+	}
+	/** Own the SDK's automatic refresh from token read through pair commit. */
+	async runSdkRefresh(refreshToken, execute) {
+		const initiatingRevision = this.#ownedRevision;
+		return this.#runSdkRefresh(initiatingRevision, refreshToken, execute);
+	}
+	async #runSdkRefresh(initiatingRevision, refreshToken, execute) {
+		await this.#requireLease();
+		const locks = this.#locks();
+		if (!locks) {
+			this.#notify("storage");
+			throw new Error("Cross-context token coordination is unavailable.");
+		}
+		return locks.request(AUTH_SESSION_LOCK, { mode: "exclusive" }, async () => {
+			if (initiatingRevision !== this.#ownedRevision || !this.#ownsSharedRevision(initiatingRevision)) throw new Error("The authenticated session changed before token refresh.");
+			const current = this.#readSessionOrThrow();
+			if (current.tokens?.refresh_token !== refreshToken || !current.tokens.access_token) throw new Error("A newer token refresh already completed.");
+			const originalPair = current.tokens;
+			const pair = await execute(originalPair.access_token);
+			if (!pair.access_token || !pair.refresh_token) throw new Error("Token refresh returned an incomplete pair.");
+			if (initiatingRevision !== this.#ownedRevision || !this.#ownsSharedRevision(initiatingRevision)) throw new Error("The authenticated session changed during token refresh.");
+			const latest = this.#readSessionOrThrow();
+			if (latest.tokens?.refresh_token !== refreshToken) throw new Error("A newer token refresh already completed.");
+			this.#writeSession({
+				version: SESSION_VERSION,
+				revision: latest.revision,
+				tokens: pair
+			});
+			this.#lastReadRefreshToken = pair.refresh_token;
+			return pair;
+		});
+	}
+	/** Commit a side-effect-free direct refresh against its captured pair. */
+	async adoptTokens(owner, accessToken, refreshToken) {
+		try {
+			await this.#requireLease();
+		} catch {
+			return "failed";
+		}
+		if (!this.owns(owner)) return "stale";
+		return this.#commitPair(owner.revision, owner.refreshToken, accessToken, refreshToken);
+	}
+	#notify(reason) {
+		const hadOwner = this.#ownedRevision !== null;
+		this.#ownedRevision = null;
+		this.#pendingAccess = null;
+		this.#lastReadRefreshToken = null;
+		if (reason === "stale" && !hadOwner) return;
+		for (const listener of this.#listeners) listener(reason);
+	}
+	#acquireContextLease() {
+		const locks = this.#locks();
+		if (!locks) return Promise.resolve(false);
+		return new Promise((resolve) => {
+			let readySettled = false;
+			const settleReady = (held) => {
+				if (readySettled) return;
+				readySettled = true;
+				resolve(held);
+			};
+			const waiting = new AbortController();
+			const deadline = setTimeout(() => waiting.abort(), this.#leaseWaitMs);
+			locks.request(AUTH_CONTEXT_LOCK, {
+				mode: "exclusive",
+				signal: waiting.signal
+			}, async (lock) => {
+				clearTimeout(deadline);
+				if (!lock) {
+					settleReady(false);
+					return;
+				}
+				try {
+					const session = this.#readSessionOrMigrate();
+					this.#leaseHeld = true;
+					this.#ownedRevision = session?.revision ?? null;
+				} catch {
+					this.#leaseHeld = false;
+					this.#notify("storage");
+					settleReady(false);
+					return;
+				}
+				settleReady(true);
+				await new Promise((release) => {
+					this.#releaseLease = release;
+				});
+				this.#releaseLease = null;
+				this.#leaseHeld = false;
+				this.#ownedRevision = null;
+				this.#pendingAccess = null;
+			}).catch(() => {
+				clearTimeout(deadline);
+				settleReady(false);
+			});
+		});
+	}
+	async #requireLease() {
+		if (await this.#leaseReady && this.#leaseHeld) return;
+		this.#notify("storage");
+		throw new Error("Another browser tab owns this POS session.");
+	}
+	#assertRequestOwner() {
+		if (this.#ownsSharedRevision(this.#ownedRevision)) return;
+		this.#notify("stale");
+		throw new Error("The authenticated session belongs to another browser context.");
+	}
+	#assertRequestRevision(revision) {
+		if (revision === this.#ownedRevision && this.#ownsSharedRevision(revision)) return;
+		if (this.#ownsSharedRevision(this.#ownedRevision)) throw new Error("The authenticated session changed before the POS request was sent.");
+		this.#notify("stale");
+		throw new Error("The authenticated session belongs to another browser context.");
+	}
+	#ownsSharedRevision(revision) {
+		if (!this.#leaseHeld || revision === null) return false;
+		try {
+			return this.#readSessionOrMigrate()?.revision === revision;
+		} catch {
+			this.#notify("storage");
+			return false;
+		}
+	}
+	#readPairOrThrow() {
+		return this.#readSessionOrThrow().tokens;
+	}
+	#readSessionOrThrow() {
+		const session = this.#readSessionOrMigrate();
+		if (!session) throw new Error("No POS auth session exists.");
+		return session;
+	}
+	#readSessionOrMigrate() {
+		const storage = this.#storageOrThrow();
+		const raw = storage.getItem(this.#sessionKey);
+		if (raw !== null) {
+			const parsed = parseSession(raw);
+			if (parsed.wasLegacy) this.#writeSession(parsed.session);
+			return parsed.session;
+		}
+		const accessToken = storage.getItem(this.#legacyAccessKey);
+		const refreshToken = storage.getItem(this.#legacyRefreshKey);
+		const legacyRevision = storage.getItem(this.#legacyRevisionKey);
+		if (accessToken === null && refreshToken === null && legacyRevision === null) return null;
+		if (accessToken === null !== (refreshToken === null)) throw new Error("Incomplete legacy POS auth token pair.");
+		if (accessToken !== null && (!accessToken || !refreshToken)) throw new Error("Invalid legacy POS auth token pair.");
+		if (legacyRevision !== null && !legacyRevision) throw new Error("Invalid legacy POS auth revision.");
+		const migrated = {
+			version: SESSION_VERSION,
+			revision: legacyRevision ?? this.#createRevision(),
+			tokens: accessToken === null ? null : {
+				access_token: accessToken,
+				refresh_token: refreshToken
+			}
+		};
+		this.#writeSession(migrated);
+		try {
+			storage.removeItem(this.#legacyAccessKey);
+			storage.removeItem(this.#legacyRefreshKey);
+			storage.removeItem(this.#legacyRevisionKey);
+		} catch {}
+		return migrated;
+	}
+	#writeSession(session) {
+		this.#storageOrThrow().setItem(this.#sessionKey, JSON.stringify(session));
+	}
+	#storageOrThrow() {
+		const storage = this.#storage();
+		if (!storage) throw new Error("Browser storage is unavailable.");
+		return storage;
+	}
+	async #clearOwnedPair(owner) {
+		const locks = this.#locks();
+		if (!locks) return "failed";
+		try {
+			return await locks.request(AUTH_SESSION_LOCK, { mode: "exclusive" }, () => {
+				if (!this.owns(owner)) return "stale";
+				const current = this.#readSessionOrThrow();
+				if (current.tokens?.access_token !== owner.accessToken || current.tokens?.refresh_token !== owner.refreshToken) return "stale";
+				try {
+					this.#writeSession({
+						...current,
+						tokens: null
+					});
+				} catch {
+					return "failed";
+				}
+				this.#lastReadRefreshToken = null;
+				return "cleared";
+			});
+		} catch {
+			return "failed";
+		}
+	}
+	async #commitPair(revision, expectedRefreshToken, accessToken, refreshToken) {
+		const locks = this.#locks();
+		if (!locks) {
+			this.#notify("storage");
+			return "failed";
+		}
+		try {
+			return await locks.request(AUTH_SESSION_LOCK, { mode: "exclusive" }, () => {
+				if (revision !== this.#ownedRevision || !this.#ownsSharedRevision(revision)) {
+					this.#notify("stale");
+					return "stale";
+				}
+				const current = this.#readSessionOrThrow();
+				if ((current.tokens?.refresh_token ?? null) !== expectedRefreshToken) return "stale";
+				try {
+					this.#writeSession({
+						version: SESSION_VERSION,
+						revision: current.revision,
+						tokens: {
+							access_token: accessToken,
+							refresh_token: refreshToken
+						}
+					});
+				} catch {
+					this.#notify("storage");
+					return "failed";
+				}
+				this.#lastReadRefreshToken = refreshToken;
+				return "adopted";
+			});
+		} catch {
+			this.#notify("storage");
+			return "failed";
+		}
+	}
+};
+const hotData = import.meta.hot?.data;
+const authTokenStorage = hotData?.authTokenStorage ?? new CoordinatedBrowserTokenStorage();
+if (hotData) hotData.authTokenStorage = authTokenStorage;
+//#endregion
 //#region src/lib/utils/jwt.ts
 /**
 * Decode a JWT token payload without signature verification.
@@ -625,9 +1315,11 @@ var MemoryTokenStorage = class {
 	async setRefreshToken(token) {
 		this.refreshToken = token;
 	}
-	async clearTokens() {
+	async clearTokens(expectedAccessToken, _expectedRevision) {
+		if (expectedAccessToken !== void 0 && this.accessToken !== expectedAccessToken) return false;
 		this.accessToken = null;
 		this.refreshToken = null;
+		return true;
 	}
 };
 /**
@@ -654,11 +1346,13 @@ var BrowserTokenStorage = class {
 	async setRefreshToken(token) {
 		if (typeof localStorage !== "undefined") localStorage.setItem(this.refreshTokenKey, token);
 	}
-	async clearTokens() {
+	async clearTokens(expectedAccessToken, _expectedRevision) {
 		if (typeof localStorage !== "undefined") {
+			if (expectedAccessToken !== void 0 && localStorage.getItem(this.accessTokenKey) !== expectedAccessToken) return false;
 			localStorage.removeItem(this.accessTokenKey);
 			localStorage.removeItem(this.refreshTokenKey);
 		}
+		return true;
 	}
 };
 /**
@@ -668,65 +1362,82 @@ var BrowserTokenStorage = class {
 * 1. API Key endpoints (X-Api-Key): login/email, login/phone, login/whatsapp, pair-device, verify-otp
 * 2. Bearer token endpoints: All other endpoints
 * 3. Token returning endpoints: verify-otp, refresh-token
+*
+* When the token storage implements `getRequestOwner()`, every destructive
+* operation (clear on failed refresh, logout, 403) is scoped to the session
+* that initiated it, and a request whose session changed between scheduling
+* and dispatch is refused instead of sent with another session's identity.
 */
 function createPosAuthMiddleware(config) {
 	let isRefreshing = false;
 	let refreshPromise = null;
 	let hasAssessedTokens = false;
-	const assessTokenStateOnce = async () => {
+	/** The owner each in-flight request was signed for, keyed by Request. */
+	const requestOwners = /* @__PURE__ */ new WeakMap();
+	/**
+	* Clear tokens on behalf of `owner`. With an owner this is a
+	* compare-and-swap — a session that replaced the failing one survives —
+	* and `onTokensCleared` only fires when something was actually cleared.
+	*/
+	const clearAssessedOwner = async (owner) => {
+		const cleared = owner ? await config.tokenStorage.clearTokens(owner.accessToken, owner.revision) : await config.tokenStorage.clearTokens();
+		if (cleared !== false) config.onTokensCleared?.();
+		return cleared !== false;
+	};
+	const assessTokenStateOnce = async (initiatingOwner) => {
 		if (hasAssessedTokens) return;
 		hasAssessedTokens = true;
 		try {
-			const accessToken = await config.tokenStorage.getAccessToken();
-			const refreshToken = await config.tokenStorage.getRefreshToken();
+			const owner = initiatingOwner ?? await config.tokenStorage.getRequestOwner?.();
+			const accessToken = owner ? owner.accessToken : await config.tokenStorage.getAccessToken();
+			const refreshToken = owner ? owner.refreshToken : await config.tokenStorage.getRefreshToken();
 			if (accessToken && !isTokenExpired(accessToken)) return;
 			if (!accessToken && refreshToken) {
-				await config.tokenStorage.clearTokens();
-				config.onTokensCleared?.();
+				await clearAssessedOwner(owner);
 				console.info("Cleaned up orphaned refresh token in POS");
 				return;
 			}
 			if (accessToken && refreshToken && !isTokenExpired(refreshToken)) {
 				try {
-					await refreshTokens();
+					await refreshTokens(owner);
 					console.info("POS tokens refreshed proactively on startup");
 				} catch (error) {
-					await config.tokenStorage.clearTokens();
-					config.onTokensCleared?.();
-					console.info("POS tokens cleared after failed refresh on startup");
+					console.info(refreshEndsSession(error) ? "POS tokens cleared after a rejected refresh on startup" : "POS startup refresh could not complete; tokens kept");
 				}
 				return;
 			}
 			if (accessToken && isTokenExpired(accessToken) || refreshToken && isTokenExpired(refreshToken)) {
-				await config.tokenStorage.clearTokens();
-				config.onTokensCleared?.();
+				await clearAssessedOwner(owner);
 				console.info("POS stale tokens cleared on startup - user needs to re-authenticate");
 				return;
 			}
 			if (!accessToken && !refreshToken) return;
 		} catch (error) {
 			console.warn("POS token state assessment failed:", error);
+			if (config.tokenStorage.getRequestOwner) throw error;
 		}
 	};
-	const refreshTokens = async () => {
+	const refreshTokens = async (initiatingOwner) => {
 		if (isRefreshing && refreshPromise) return refreshPromise;
 		isRefreshing = true;
 		refreshPromise = (async () => {
 			try {
-				const refreshToken = await config.tokenStorage.getRefreshToken();
-				if (!refreshToken || isTokenExpired(refreshToken)) throw new Error("No valid refresh token available");
+				const refreshToken = initiatingOwner ? initiatingOwner.refreshToken : await config.tokenStorage.getRefreshToken();
+				if (!refreshToken || isTokenExpired(refreshToken)) throw new RefreshRejectedError({ reason: "expired" });
 				let newTokens;
 				if (config.refreshTokenFn) newTokens = await config.refreshTokenFn(refreshToken);
 				else {
+					const accessToken = initiatingOwner ? initiatingOwner.accessToken : await config.tokenStorage.getAccessToken();
+					if (!accessToken) throw new Error("No valid access token available for POS token refresh");
 					const response = await fetch(`${config.baseUrl}/pos/auth/refresh-token`, {
 						method: "POST",
 						headers: {
 							"Content-Type": "application/json",
-							Authorization: `Bearer ${await config.tokenStorage.getAccessToken()}`
+							Authorization: `Bearer ${accessToken}`
 						},
 						body: JSON.stringify({ refresh_token: refreshToken })
 					});
-					if (!response.ok) throw new Error(`POS token refresh failed: ${response.status}`);
+					if (!response.ok) throw new RefreshRejectedError({ status: response.status });
 					const data = await response.json();
 					newTokens = data.content || data;
 				}
@@ -734,9 +1445,10 @@ function createPosAuthMiddleware(config) {
 				await config.tokenStorage.setRefreshToken(newTokens.refresh_token);
 				config.onTokensUpdated?.(newTokens.access_token, newTokens.refresh_token);
 			} catch (error) {
-				console.error("POS token refresh failed:", error);
-				await config.tokenStorage.clearTokens();
-				config.onTokensCleared?.();
+				if (refreshEndsSession(error)) {
+					console.error("POS token refresh rejected; tokens cleared:", error);
+					await clearAssessedOwner(initiatingOwner);
+				} else console.warn("POS token refresh could not complete; tokens kept:", error);
 				throw error;
 			} finally {
 				isRefreshing = false;
@@ -748,25 +1460,43 @@ function createPosAuthMiddleware(config) {
 	return {
 		async onRequest({ request }) {
 			const pathname = getPathnameFromUrl(request.url);
-			await assessTokenStateOnce();
+			let initiatingOwner;
+			try {
+				initiatingOwner = await config.tokenStorage.getRequestOwner?.();
+			} catch (error) {
+				if (!isApiKeyEndpoint(pathname) || !isRefreshFailure(error)) throw error;
+				request.headers.set("X-Api-Key", config.apiKey);
+				return request;
+			}
+			await assessTokenStateOnce(initiatingOwner);
 			if (isApiKeyEndpoint(pathname)) {
 				request.headers.set("X-Api-Key", config.apiKey);
 				return request;
 			}
-			let accessToken = await config.tokenStorage.getAccessToken();
+			let requestOwner = await config.tokenStorage.getRequestOwner?.();
+			if (initiatingOwner && requestOwner?.revision !== initiatingOwner.revision) throw new Error("The authenticated session changed before the POS request was sent.");
+			let accessToken = requestOwner ? requestOwner.accessToken : await config.tokenStorage.getAccessToken();
 			if (accessToken && isTokenExpired(accessToken)) try {
-				await refreshTokens();
-				accessToken = await config.tokenStorage.getAccessToken();
+				await refreshTokens(requestOwner);
+				requestOwner = await config.tokenStorage.getRequestOwner?.();
+				if (initiatingOwner && requestOwner?.revision !== initiatingOwner.revision) throw new Error("The authenticated session changed before the POS request was sent.");
+				accessToken = requestOwner ? requestOwner.accessToken : await config.tokenStorage.getAccessToken();
 			} catch (error) {
 				console.warn("Token refresh failed:", error);
 				accessToken = null;
 			}
-			if (accessToken) request.headers.set("Authorization", `Bearer ${accessToken}`);
+			if (accessToken) {
+				request.headers.set("Authorization", `Bearer ${accessToken}`);
+				requestOwners.set(request, {
+					accessToken,
+					revision: requestOwner?.revision
+				});
+			}
 			return request;
 		},
 		async onResponse({ request, response }) {
 			const pathname = getPathnameFromUrl(request.url);
-			if (response.ok && isTokenReturningEndpoint(pathname)) try {
+			if (config.storeTokenResponses !== false && response.ok && isTokenReturningEndpoint(pathname)) try {
 				const data = await response.clone().json();
 				const content = data.content || data;
 				if (content?.access_token && content?.refresh_token) {
@@ -778,8 +1508,10 @@ function createPosAuthMiddleware(config) {
 				console.warn("Failed to extract tokens from POS response:", error);
 			}
 			else if (response.ok && isLogoutEndpoint(pathname)) {
-				await config.tokenStorage.clearTokens();
-				config.onTokensCleared?.();
+				const owner = requestOwners.get(request);
+				if (owner?.accessToken) {
+					if (await config.tokenStorage.clearTokens(owner.accessToken, owner.revision) !== false) config.onTokensCleared?.();
+				}
 			}
 			if (response.status === 401 && !isApiKeyEndpoint(pathname)) {
 				const currentToken = await config.tokenStorage.getAccessToken();
@@ -796,8 +1528,10 @@ function createPosAuthMiddleware(config) {
 				}
 			}
 			if (response.status === 403 && !isApiKeyEndpoint(pathname)) {
-				await config.tokenStorage.clearTokens();
-				config.onTokensCleared?.();
+				const owner = requestOwners.get(request);
+				if (owner?.accessToken) {
+					if (await config.tokenStorage.clearTokens(owner.accessToken, owner.revision) !== false) config.onTokensCleared?.();
+				}
 				console.info("POS tokens cleared due to 403 - session revoked. This can happen when a user has more than 5 active sessions. Please re-authenticate.");
 			}
 			return response;
@@ -813,7 +1547,8 @@ function createDefaultPosAuthMiddleware(options) {
 		apiKey: options.apiKey,
 		baseUrl: options.baseUrl,
 		onTokensUpdated: options.onTokensUpdated,
-		onTokensCleared: options.onTokensCleared
+		onTokensCleared: options.onTokensCleared,
+		storeTokenResponses: options.storeTokenResponses
 	});
 }
 //#endregion
@@ -914,7 +1649,8 @@ var PosAPIClient = class PosAPIClient extends BaseAPIClient {
 				baseUrl: this.getBaseUrl(),
 				tokenStorage: config.tokenStorage,
 				onTokensUpdated: config.onTokensUpdated,
-				onTokensCleared: config.onTokensCleared
+				onTokensCleared: config.onTokensCleared,
+				storeTokenResponses: config.storeTokenResponses
 			});
 			this.client.use(authMiddleware);
 			if (config.accessToken) {
@@ -998,20 +1734,6 @@ var PosAPIClient = class PosAPIClient extends BaseAPIClient {
 			console.warn("Failed to initialize tokens in storage:", error);
 		}
 	}
-	/**
-	* Get client typed for storefront POS operations (paths schema)
-	* This provides proper typing for storefront POS endpoints
-	*/
-	get storefrontClient() {
-		return this.client;
-	}
-	/**
-	* Get client typed for admin POS operations (AdminPaths schema)
-	* This provides proper typing for admin POS endpoints
-	*/
-	get adminClient() {
-		return this.client;
-	}
 };
 //#endregion
 //#region src/lib/pos.ts
@@ -1805,7 +2527,7 @@ var PosClient = class extends PosAPIClient {
 	* ```
 	*/
 	async getFulfillmentOptions(body) {
-		return this.executeRequest(() => this.client.POST("/pos/fulfillment-options", { body }));
+		return this.executeRequest(() => this.client.POST("/pos/carts/fulfillment-options", { body }));
 	}
 	/**
 	* Update cart customer information
@@ -1839,24 +2561,60 @@ var PosClient = class extends PosAPIClient {
 	}
 	/**
 	* Create order from cart
-	* @param body - Order creation data
-	* @returns Promise with created order
+	* @param body - Cart ID, plus an optional payment method to create the
+	*   initial payment request in the same call
+	* @returns Promise with the created order, `payment_required`, and gateway
+	*   initiation details (`payment_info`) when an auto payment method was used
 	* @example
 	* ```typescript
 	* const { data, error } = await pos.createOrder({
-	*   cart_id: "01H9CART12345ABCDE"
+	*   cart_id: "01H9CART12345ABCDE",
+	*   payment_method: { payment_provider_slug: "cash" },
 	* });
 	*
 	* if (error) {
 	*   console.error("Failed to create order:", error.message);
 	* } else {
-	*   console.log("Order created:", data.order.id);
+	*   console.log("Order created:", data.order.order_number);
 	*   console.log("Payment required:", data.payment_required);
 	* }
 	* ```
 	*/
 	async createOrder(body) {
-		return this.executeRequest(() => this.storefrontClient.POST("/pos/orders", { body }));
+		return this.executeRequest(() => this.client.POST("/pos/orders", { body }));
+	}
+	/**
+	* Create a payment request for an order
+	*
+	* Use this when the order was created without a payment method, or to
+	* collect the remaining `to_be_paid` amount with another method (split
+	* tender). The total requested across payment requests cannot exceed the
+	* order's `to_be_paid`.
+	* @param pathParams - Order number
+	* @param body - Amount to request and the payment method to use
+	* @returns Promise with all payment records for the order, the remaining
+	*   `pending_amount`, and gateway initiation details (`payment_info`) when
+	*   an auto payment method was used
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.createOrderPaymentRequest(
+	*   { order_number: "1234567890" },
+	*   { amount: 500, payment_method: { payment_provider_slug: "cash" } }
+	* );
+	*
+	* if (error) {
+	*   console.error("Failed to create payment request:", error.message);
+	* } else {
+	*   console.log("Pending amount:", data.pending_amount);
+	*   console.log("Payments:", data.payments.length);
+	* }
+	* ```
+	*/
+	async createOrderPaymentRequest(pathParams, body) {
+		return this.executeRequest(() => this.client.POST("/pos/orders/{order_number}/payments", {
+			params: { path: pathParams },
+			body
+		}));
 	}
 	/**
 	* Get payment status
@@ -1880,6 +2638,124 @@ var PosClient = class extends PosAPIClient {
 		return this.executeRequest(() => this.client.GET("/pos/orders/{order_number}/payment-status", { params: { path: pathParams } }));
 	}
 	/**
+	* List available payment methods
+	* @param query - Optional query parameters (e.g. amount for method filtering)
+	* @returns Promise with the payment methods enabled for the store
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.listPaymentMethods();
+	*
+	* if (error) {
+	*   console.error("Failed to list payment methods:", error.message);
+	* } else {
+	*   data.payment_methods.forEach(method => {
+	*     console.log(`${method.name} (${method.code})`);
+	*   });
+	* }
+	* ```
+	*/
+	async listPaymentMethods(query) {
+		return this.executeRequest(() => this.client.GET("/pos/payments/payment-methods", { params: { query } }));
+	}
+	/**
+	* Verify a UPI VPA (virtual payment address)
+	* @param query - The VPA to verify
+	* @returns Promise with the verification result and account holder name
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.verifyVpa({ vpa: "customer@upi" });
+	*
+	* if (error) {
+	*   console.error("VPA verification failed:", error.message);
+	* } else if (data.is_valid) {
+	*   console.log("Paying to:", data.customer_name);
+	* }
+	* ```
+	*/
+	async verifyVpa(query) {
+		return this.executeRequest(() => this.client.GET("/pos/payments/verify-vpa", { params: { query } }));
+	}
+	/**
+	* Get card metadata for a card number prefix
+	* @param query - Card number prefix (BIN) to look up
+	* @returns Promise with card brand, type, and issuer details
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.getCardInfo({ card_number: "411111" });
+	*
+	* if (error) {
+	*   console.error("Card lookup failed:", error.message);
+	* } else {
+	*   console.log(`${data.card_brand} ${data.card_type}`);
+	* }
+	* ```
+	*/
+	async getCardInfo(query) {
+		return this.executeRequest(() => this.client.GET("/pos/payments/card-info", { params: { query } }));
+	}
+	/**
+	* Authenticate a direct (headless) card payment with an OTP
+	* @param body - OTP authentication payload from the payment flow
+	* @returns Promise with the authentication result
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.authenticateDirectOtp({
+	*   transaction_id: "txn_123",
+	*   otp: "123456"
+	* });
+	*
+	* if (error) {
+	*   console.error("OTP authentication failed:", error.message);
+	* }
+	* ```
+	*/
+	async authenticateDirectOtp(body) {
+		return this.executeRequest(() => this.client.POST("/pos/payments/authenticate-direct-otp", { body }));
+	}
+	/**
+	* Resend the OTP for a direct (headless) card payment
+	* @param body - The transaction whose OTP should be resent
+	* @returns Promise with the resend confirmation
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.resendDirectOtp({
+	*   transaction_id: "txn_123"
+	* });
+	*
+	* if (error) {
+	*   console.error("Failed to resend OTP:", error.message);
+	* }
+	* ```
+	*/
+	async resendDirectOtp(body) {
+		return this.executeRequest(() => this.client.POST("/pos/payments/resend-direct-otp", { body }));
+	}
+	/**
+	* Retry payment for an order whose previous payment failed or is unpaid
+	* @param pathParams - Order number
+	* @param body - Payment method details for the retry
+	* @returns Promise with fresh payment info for the retried payment
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.retryOrderPayment(
+	*   { order_number: "ORD-2024-001" },
+	*   { payment_method: "upi" }
+	* );
+	*
+	* if (error) {
+	*   console.error("Payment retry failed:", error.message);
+	* } else {
+	*   console.log("New payment initiated:", data.payment_info);
+	* }
+	* ```
+	*/
+	async retryOrderPayment(pathParams, body) {
+		return this.executeRequest(() => this.client.POST("/pos/orders/{order_number}/retry-payment", {
+			params: { path: pathParams },
+			body
+		}));
+	}
+	/**
 	* List all categories
 	* @param query - Optional query parameters for filtering categories
 	* @returns Promise with list of categories
@@ -2229,43 +3105,6 @@ var PosClient = class extends PosAPIClient {
 		} }));
 	}
 	/**
-	* List product reviews
-	* @param pathParams - Product ID
-	* @param query - Optional query parameters for filtering reviews
-	* @returns Promise with product reviews
-	* @example
-	* ```typescript
-	* const { data, error } = await pos.listProductReviews(
-	*   { product_id: "prod_123" }
-	* );
-	*
-	* if (error) {
-	*   console.error("Failed to list product reviews:", error.message);
-	* } else {
-	*   console.log("Reviews found:", data.reviews?.length || 0);
-	*   data.reviews?.forEach(review => {
-	*     console.log(`Review by ${review.customer_name}: ${review.rating}/5`);
-	*     console.log("Comment:", review.comment);
-	*   });
-	* }
-	*
-	* // With pagination
-	* const { data: reviewData, error: reviewError } = await pos.listProductReviews(
-	*   { product_id: "prod_123" },
-	*   {
-	*     page: 1,
-	*     limit: 5
-	*   }
-	* );
-	* ```
-	*/
-	async listProductReviews(pathParams, query) {
-		return this.executeRequest(() => this.client.GET("/pos/catalog/products/{product_id}/reviews", { params: {
-			path: pathParams,
-			query
-		} }));
-	}
-	/**
 	* List product variants
 	* @param pathParams - The path parameters. Accepts product ID or product slug.
 	* @param headers - Optional header parameters
@@ -2560,6 +3399,142 @@ var PosClient = class extends PosAPIClient {
 		return this.executeRequest(() => this.client.GET("/pos/customers/{id}", { params: { path: pathParams } }));
 	}
 	/**
+	* List a customer's saved addresses (Admin)
+	* @param pathParams - Customer ID
+	* @returns Promise with the customer's addresses
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.listAddresses({ id: "cust_123" });
+	*
+	* if (error) {
+	*   console.error("Failed to list addresses:", error.message);
+	* } else {
+	*   data.addresses?.forEach(address => {
+	*     console.log(`${address.name}: ${address.city}, ${address.state}`);
+	*   });
+	* }
+	* ```
+	*/
+	async listAddresses(pathParams) {
+		return this.executeRequest(() => this.client.GET("/pos/customers/{id}/addresses", { params: { path: pathParams } }));
+	}
+	/**
+	* Create an address on a customer's profile (Admin)
+	* @param pathParams - Customer ID
+	* @param body - The address to save
+	* @returns Promise with the created address
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.createAddress(
+	*   { id: "cust_123" },
+	*   {
+	*     name: "Home",
+	*     address_line_1: "123 Main St",
+	*     city: "Mumbai",
+	*     state: "Maharashtra",
+	*     country: "India",
+	*     pincode: "400001",
+	*     phone: "9876543210"
+	*   }
+	* );
+	*
+	* if (error) {
+	*   console.error("Failed to create address:", error.message);
+	* }
+	* ```
+	*/
+	async createAddress(pathParams, body) {
+		return this.executeRequest(() => this.client.POST("/pos/customers/{id}/addresses", {
+			params: { path: pathParams },
+			body
+		}));
+	}
+	/**
+	* Update a customer's saved address (Admin)
+	* @param pathParams - Customer ID and address ID
+	* @param body - The address fields to update
+	* @returns Promise with the updated address
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.updateAddress(
+	*   { id: "cust_123", address_id: "addr_456" },
+	*   { phone: "9876543210" }
+	* );
+	*
+	* if (error) {
+	*   console.error("Failed to update address:", error.message);
+	* }
+	* ```
+	*/
+	async updateAddress(pathParams, body) {
+		return this.executeRequest(() => this.client.PUT("/pos/customers/{id}/addresses/{address_id}", {
+			params: { path: pathParams },
+			body
+		}));
+	}
+	/**
+	* Delete a customer's saved address (Admin)
+	* @param pathParams - Customer ID and address ID
+	* @returns Promise with the deletion confirmation
+	* @example
+	* ```typescript
+	* const { error } = await pos.deleteAddress({
+	*   id: "cust_123",
+	*   address_id: "addr_456"
+	* });
+	*
+	* if (error) {
+	*   console.error("Failed to delete address:", error.message);
+	* }
+	* ```
+	*/
+	async deleteAddress(pathParams) {
+		return this.executeRequest(() => this.client.DELETE("/pos/customers/{id}/addresses/{address_id}", { params: { path: pathParams } }));
+	}
+	/**
+	* List states for a country
+	* @param pathParams - ISO country code
+	* @returns Promise with the country's states
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.listCountryStates({
+	*   country_iso_code: "IN"
+	* });
+	*
+	* if (error) {
+	*   console.error("Failed to list states:", error.message);
+	* } else {
+	*   data.states?.forEach(state => console.log(state.name));
+	* }
+	* ```
+	*/
+	async listCountryStates(pathParams) {
+		return this.executeRequest(() => this.client.GET("/pos/common/countries/{country_iso_code}/states", { params: { path: pathParams } }));
+	}
+	/**
+	* List pincodes for a country
+	* @param pathParams - ISO country code
+	* @param query - Optional query parameters for search and pagination
+	* @returns Promise with the country's serviceable pincodes
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.listCountryPincodes(
+	*   { country_iso_code: "IN" },
+	*   { search: "4000" }
+	* );
+	*
+	* if (error) {
+	*   console.error("Failed to list pincodes:", error.message);
+	* }
+	* ```
+	*/
+	async listCountryPincodes(pathParams, query) {
+		return this.executeRequest(() => this.client.GET("/pos/common/countries/{country_iso_code}/pincodes", { params: {
+			path: pathParams,
+			query
+		} }));
+	}
+	/**
 	* List all orders (Admin)
 	* @param query - Optional query parameters for filtering orders
 	* @returns Promise with list of orders
@@ -2589,7 +3564,7 @@ var PosClient = class extends PosAPIClient {
 	* ```
 	*/
 	async listOrders(query) {
-		return this.executeRequest(() => this.adminClient.GET("/pos/orders", { params: { query } }));
+		return this.executeRequest(() => this.client.GET("/pos/orders", { params: { query } }));
 	}
 	/**
 	* Get order details (Admin)
@@ -2778,9 +3753,13 @@ var PosClient = class extends PosAPIClient {
 	/**
 	* Check inventory for order (Admin)
 	* @param pathParams - Order number
+	* @param query - Optional shipment number and fulfillment type to evaluate against.
+	*   Defaults to the order's `unscheduled` shipment and that shipment's own
+	*   `fulfillment_type` when omitted.
 	* @returns Promise with inventory check results
 	* @example
 	* ```typescript
+	* // Check the order's unscheduled shipment
 	* const { data, error } = await pos.checkInventory({
 	*   order_number: "ORD-2024-001234"
 	* });
@@ -2788,17 +3767,31 @@ var PosClient = class extends PosAPIClient {
 	* if (error) {
 	*   console.error("Failed to check inventory:", error.message);
 	* } else {
-	*   const inventory = data.content;
+	*   const inventory = data.inventory;
 	*   console.log(`Inventory Status: ${inventory?.inventory_status}`);
 	*   console.log(`Shipment Items:`, inventory?.shipment_items);
 	*   console.log(`Recommended Warehouses:`, inventory?.recommended_warehouses);
 	*   console.log(`Inventory Detail:`, inventory?.inventory_detail);
-	*   console.log(`Allowed Actions:`, inventory?.allowed_action);
+	*   console.log(`Allowed Actions:`, inventory?.allowed_actions);
 	* }
+	*
+	* // Check a specific shipment, evaluated as an in-store collection
+	* const { data: pickupData } = await pos.checkInventory(
+	*   { order_number: "ORD-2024-001234" },
+	*   {
+	*     shipment_number: "SHIP-2024-001234",
+	*     fulfillment_type: "collect-in-store"
+	*   }
+	* );
+	*
+	* console.log(`Can fulfill from store:`, pickupData?.inventory?.inventory_status);
 	* ```
 	*/
-	async checkInventory(pathParams) {
-		return this.executeRequest(() => this.adminClient.GET("/pos/orders/{order_number}/check-inventory", { params: { path: pathParams } }));
+	async checkInventory(pathParams, query) {
+		return this.executeRequest(() => this.client.GET("/pos/orders/{order_number}/check-inventory", { params: {
+			path: pathParams,
+			query
+		} }));
 	}
 	/**
 	* Refund shortfall for order (Admin)
@@ -2873,6 +3866,30 @@ var PosClient = class extends PosAPIClient {
 		return this.executeRequest(() => this.client.GET("/pos/shipping/shipments/{reference_number}", { params: { path: pathParams } }));
 	}
 	/**
+	* Get shipment activities (Admin)
+	* @param pathParams - Shipment reference number
+	* @returns Promise with the shipment's activity trail
+	* @example
+	* ```typescript
+	* const { data, error } = await pos.getShipmentActivities({
+	*   reference_number: "SHIP-2024-001234"
+	* });
+	*
+	* if (error) {
+	*   console.error("Failed to get shipment activities:", error.message);
+	* } else {
+	*   data.activities?.forEach(activity => {
+	*     console.log(`[${activity.created_at}] ${activity.activity_type} - ${activity.status}`);
+	*     console.log(`  ${activity.comment} (by ${activity.user_name}, ${activity.user_type})`);
+	*   });
+	*   console.log(`Total activities: ${data.pagination?.total_records}`);
+	* }
+	* ```
+	*/
+	async getShipmentActivities(pathParams) {
+		return this.executeRequest(() => this.client.GET("/pos/shipping/shipments/{reference_number}/activities", { params: { path: pathParams } }));
+	}
+	/**
 	* Get shipment invoice (Admin)
 	* @param pathParams - Shipment reference number
 	* @param query - Optional format parameter
@@ -2952,6 +3969,93 @@ var PosClient = class extends PosAPIClient {
 			body
 		}));
 	}
+	/**
+	* Create a replacement shipment against an existing shipment (Admin)
+	* @param pathParams - Reference number of the original shipment being replaced
+	* @param body - Replacement payload. Use `shipping_option: "manual"` to dispatch
+	*   outside an integrated carrier, `shipping_option: "auto"` to fulfill through an
+	*   integrated carrier with system-managed rates, or `fulfillment_type:
+	*   "collect-in-store"` when the customer picks the items up in store.
+	* @returns Promise with replacement confirmation
+	* @example
+	* ```typescript
+	* // Replacement shipped through an integrated carrier, system-packed
+	* const { data, error } = await pos.createReplacementShipment(
+	*   { reference_number: "SHIP-2024-001234" },
+	*   {
+	*     fulfillment_type: "delivery",
+	*     warehouse_id: "WH-001",
+	*     shipment_items: [
+	*       { product_id: "PROD-123", variant_id: "VAR-456", quantity: 1 }
+	*     ],
+	*     shipping_option: "auto",
+	*     shipping_provider_id: "SP-001",
+	*     packing_option: "auto",
+	*     total_weight: 1.5,
+	*     reason: "Damaged on delivery"
+	*   }
+	* );
+	*
+	* if (error) {
+	*   console.error("Failed to create replacement:", error.message);
+	* } else {
+	*   console.log("Replacement created:", data.message);
+	* }
+	*
+	* // Replacement dispatched manually, with explicit box packing
+	* const { data: manualData } = await pos.createReplacementShipment(
+	*   { reference_number: "SHIP-2024-001234" },
+	*   {
+	*     fulfillment_type: "delivery",
+	*     warehouse_id: "WH-001",
+	*     shipment_items: [
+	*       { product_id: "PROD-123", variant_id: null, quantity: 2 }
+	*     ],
+	*     shipping_option: "manual",
+	*     shipping_provider_id: "SP-MANUAL-01",
+	*     packing_option: "manual",
+	*     boxes: [
+	*       {
+	*         box_name: "Medium",
+	*         box_length: 30,
+	*         box_width: 20,
+	*         box_height: 15,
+	*         box_weight: 2,
+	*         items_count: 2,
+	*         box_count: 1
+	*       }
+	*     ],
+	*     total_weight: 2,
+	*     expected_delivery_date: "2024-01-20",
+	*     tracking_link: "https://tracking.example.com/AWB123456789",
+	*     manual_shipping_charges: 120,
+	*     reason: "Wrong item shipped"
+	*   }
+	* );
+	*
+	* // Replacement collected by the customer in store
+	* const { data: pickupData } = await pos.createReplacementShipment(
+	*   { reference_number: "SHIP-2024-001234" },
+	*   {
+	*     fulfillment_type: "collect-in-store",
+	*     warehouse_id: "STORE-042",
+	*     shipment_items: [
+	*       { product_id: "PROD-123", variant_id: "VAR-456", quantity: 1 }
+	*     ],
+	*     shipping_option: "manual",
+	*     shipping_provider_id: "SP-MANUAL-01",
+	*     packing_option: "auto",
+	*     reason: "Size exchange"
+	*   }
+	* );
+	* ```
+	*/
+	async createReplacementShipment(pathParams, body) {
+		return this.executeRequest(() => this.client.POST("/pos/shipping/shipments/{reference_number}/replacement", {
+			params: { path: pathParams },
+			body
+		}));
+	}
 };
 //#endregion
 //#region src/index.ts
@@ -2981,6 +4085,7 @@ var PosSDK = class {
 			tokenStorage: options.tokenStorage,
 			onTokensUpdated: options.onTokensUpdated,
 			onTokensCleared: options.onTokensCleared,
+			storeTokenResponses: options.storeTokenResponses,
 			defaultHeaders: options.defaultHeaders,
 			debug: options.debug,
 			logger: options.logger
@@ -3113,6 +4218,6 @@ var PosSDK = class {
 	}
 };
 //#endregion
-export { BrowserTokenStorage, Environment, MemoryTokenStorage, PosAPIClient, PosClient, PosSDK, PosSDK as default, ResponseUtils };
+export { BrowserTokenStorage, CoordinatedBrowserTokenStorage, Environment, MemoryTokenStorage, PosAPIClient, PosClient, PosSDK, PosSDK as default, RefreshRejectedError, RefreshUnavailableError, ResponseUtils, authTokenStorage, isRefreshFailure, refreshEndsSession };
 
 //# sourceMappingURL=index.mjs.map