@innvoid/getmarket-sdk 0.2.6 → 0.2.8

package/dist/index.cjs

@@ -52,7 +52,6 @@ __export(src_exports, {
   buildInternalHeaders: () => buildInternalHeaders,
   closeCache: () => closeCache,
   createAuthMiddleware: () => createAuthMiddleware,
-  createAuthMiddlewareLegacySimple: () => createAuthMiddleware2,
   createBulkRefsClient: () => createBulkRefsClient,
   createFisClient: () => createFisClient,
   createHttpClient: () => createHttpClient,
@@ -63,6 +62,9 @@ __export(src_exports, {
   createPayClient: () => createPayClient,
   createPlatformClient: () => createPlatformClient,
   createResClient: () => createResClient,
+  extractCustomerUid: () => extractCustomerUid,
+  extractEmployeeUid: () => extractEmployeeUid,
+  getBearerToken: () => getBearerToken,
   getOrSet: () => getOrSet,
   getRequestContextFromHeaders: () => getRequestContextFromHeaders,
   getTwoLevelCache: () => getTwoLevelCache,
@@ -71,6 +73,7 @@ __export(src_exports, {
   mapAxiosToUpstreamError: () => mapAxiosToUpstreamError,
   newUid: () => newUid,
   newUidV4: () => newUidV4,
+  normalizeUid: () => normalizeUid,
   parseHeaders: () => parseHeaders,
   readRs256PublicKey: () => readRs256PublicKey,
   readServiceEnv: () => readServiceEnv,
@@ -82,7 +85,8 @@ __export(src_exports, {
   requireRolesOrAnyPermission: () => requireRolesOrAnyPermission,
   sendError: () => sendError,
   sendOk: () => sendOk,
-  verifyBackendJwtRS256: () => verifyBackendJwtRS256
+  verifyBackendJwtRS256: () => verifyBackendJwtRS256,
+  withRequestIdConfig: () => withRequestIdConfig
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -414,6 +418,16 @@ function createHttpClient(opts) {
     headers: opts.headers ?? {}
   });
 }
+function withRequestIdConfig(config = {}, requestId2) {
+  if (!requestId2) return config;
+  return {
+    ...config,
+    headers: {
+      ...config.headers ?? {},
+      "x-request-id": requestId2
+    }
+  };
+}
 
 // src/core/internalHttp.ts
 var DEFAULT_RETRY = {
@@ -781,12 +795,26 @@ function readFileIfExists(path) {
     return null;
   }
 }
+function getBearerToken(req) {
+  const auth = String(req?.headers?.authorization || "");
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  return token.length ? token : null;
+}
+function normalizeUid(v) {
+  const s = String(v ?? "").trim();
+  return s.length ? s : null;
+}
 function readRs256PublicKey() {
   const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);
   if (fromFile) return fromFile;
-  const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "").replace(/\\n/g, "\n").trim();
+  const fromEnv = String(
+    process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || ""
+  ).replace(/\\n/g, "\n").trim();
   if (fromEnv) return fromEnv;
-  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
+  throw new Error(
+    "Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)"
+  );
 }
 function verifyBackendJwtRS256(raw) {
   const publicKey = readRs256PublicKey();
@@ -798,20 +826,31 @@ function verifyBackendJwtRS256(raw) {
     issuer
   });
 }
-
-// src/auth/middleware.ts
-function getBearerToken(req) {
-  const auth = String(req.headers?.authorization || "");
-  if (!auth.startsWith("Bearer ")) return null;
-  const token = auth.slice(7).trim();
-  return token.length ? token : null;
+function extractEmployeeUid(decoded) {
+  const direct = normalizeUid(decoded?.employee_uid) ?? normalizeUid(decoded?.employee?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^emp:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
 }
-function normalizeUid(v) {
-  const s = String(v ?? "").trim();
-  return s.length ? s : null;
+function extractCustomerUid(decoded) {
+  const direct = normalizeUid(decoded?.customer_uid) ?? normalizeUid(decoded?.customer?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^cus:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
 }
+
+// src/auth/middleware.ts
 function createAuthMiddleware(opts) {
-  const { subject, allowFirebaseIdToken = false, requireSubject = true, hydrate } = opts;
+  const {
+    subject,
+    allowFirebaseIdToken = false,
+    requireSubject = true,
+    hydrate
+  } = opts;
   return async (req, res, next) => {
     const token = getBearerToken(req);
     if (!token) {
@@ -840,8 +879,33 @@ function createAuthMiddleware(opts) {
           expires_at: decoded?.exp
         }
       };
-      const hydrated = await hydrate({ decoded, req, subject, company_uid, branch_uid });
+      if (subject === "employee") {
+        baseCtx.employee_uid = extractEmployeeUid(decoded) ?? void 0;
+      } else {
+        baseCtx.customer_uid = extractCustomerUid(decoded) ?? void 0;
+      }
+      const hydrated = await hydrate({
+        decoded,
+        req,
+        subject,
+        company_uid,
+        branch_uid
+      });
       Object.assign(baseCtx, hydrated);
+      if (subject === "employee" && !baseCtx.employee_uid) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_EMPLOYEE_UID_MISSING",
+          message: "employee_uid missing in token/context (expected employee_uid or sub=emp:<uid>)"
+        });
+      }
+      if (subject === "customer" && !baseCtx.customer_uid) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_CUSTOMER_UID_MISSING",
+          message: "customer_uid missing in token/context (expected customer_uid or sub=cus:<uid>)"
+        });
+      }
       if (requireSubject) {
         if (subject === "employee" && !baseCtx.employee) {
           return res.status(401).json({
@@ -869,8 +933,8 @@ function createAuthMiddleware(opts) {
         });
       }
       try {
-        const { default: admin2 } = await import("firebase-admin");
-        const firebaseDecoded = await admin2.auth().verifyIdToken(token);
+        const { default: admin } = await import("firebase-admin");
+        const firebaseDecoded = await admin.auth().verifyIdToken(token);
         if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
           return res.status(401).json({
             ok: false,
@@ -902,169 +966,112 @@ function createAuthMiddleware(opts) {
 }
 
 // src/auth/authentication.ts
-var import_firebase_admin = __toESM(require("firebase-admin"), 1);
-var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
-var import_fs3 = __toESM(require("fs"), 1);
-function getBearerToken2(req) {
-  const auth = String(req.headers?.authorization || "");
-  if (!auth.startsWith("Bearer ")) return null;
-  const token = auth.slice(7).trim();
-  return token.length ? token : null;
-}
-function readPublicKey() {
-  const publicKeyPath = process.env.JWT_PUBLIC_KEY_PATH;
-  const publicKeyEnv = process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "";
-  if (publicKeyPath) {
-    const v = import_fs3.default.readFileSync(publicKeyPath, "utf8").trim();
-    if (v) return v;
-  }
-  const envKey = publicKeyEnv.replace(/\\n/g, "\n").trim();
-  if (envKey) return envKey;
-  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
-}
-function verifyBackendJwtRS2562(raw) {
-  const publicKey = readPublicKey();
-  const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || "getmarket.api";
-  const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || "getmarket-auth";
-  return import_jsonwebtoken2.default.verify(raw, publicKey, {
-    algorithms: ["RS256"],
-    audience,
-    issuer
-  });
-}
-function normalizeUid2(v) {
-  const s = String(v ?? "").trim();
-  return s.length ? s : null;
-}
 function deriveCompanyBranch(decoded, companyUid, branchUid) {
   const companiesFromToken = Array.isArray(decoded?.companies) ? decoded.companies : [];
   const company = decoded?.company ?? (companyUid ? companiesFromToken.find((c) => c?.uid === companyUid) : null) ?? null;
   const branch = decoded?.branch ?? (branchUid && company?.branches ? (company.branches || []).find((b) => b?.uid === branchUid) : null) ?? null;
-  return { companiesFromToken, company, branch };
-}
-function extractEmployeeUid(decoded) {
-  const direct = normalizeUid2(decoded?.employee_uid);
-  if (direct) return direct;
-  const sub = normalizeUid2(decoded?.sub);
-  if (!sub) return null;
-  const m = /^emp:(.+)$/i.exec(sub);
-  return m?.[1] ? normalizeUid2(m[1]) : null;
-}
-function extractCustomerUid(decoded) {
-  const direct = normalizeUid2(decoded?.customer_uid);
-  if (direct) return direct;
-  const sub = normalizeUid2(decoded?.sub);
-  if (!sub) return null;
-  const m = /^cus:(.+)$/i.exec(sub);
-  return m?.[1] ? normalizeUid2(m[1]) : null;
-}
-function createAuthMiddleware2(opts) {
-  const { subject, allowFirebaseIdToken = false } = opts;
-  return async (req, res, next) => {
-    const token = getBearerToken2(req);
-    if (!token) {
-      return res.status(401).json({
-        ok: false,
-        code: "AUTH_MISSING_TOKEN",
-        message: "Missing Authorization Bearer token"
-      });
-    }
-    try {
-      const decoded = verifyBackendJwtRS2562(token);
-      const headerCtx = req.context || {};
-      const companyUid = normalizeUid2(headerCtx.company_uid);
-      const branchUid = normalizeUid2(headerCtx.branch_uid);
-      const { companiesFromToken, company, branch } = deriveCompanyBranch(decoded, companyUid, branchUid);
-      const ctx = {
-        tokenType: "backend",
-        subject,
-        company_uid: companyUid ?? void 0,
-        branch_uid: branchUid ?? void 0,
-        companies: companiesFromToken,
-        company,
-        branch,
-        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
-        permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
-        denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],
-        session: {
-          jti: decoded?.jti,
-          device_id: decoded?.device_id,
-          expires_at: decoded?.exp
-        }
-      };
-      if (subject === "employee") {
-        const employee_uid = extractEmployeeUid(decoded);
-        if (!employee_uid) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_EMPLOYEE_UID_MISSING",
-            message: "employee_uid missing in token (expected employee_uid or sub=emp:<uid>)"
-          });
-        }
-        ctx.employee_uid = employee_uid;
-        const embedded = decoded?.employee ?? decoded?.user ?? null;
-        ctx.employee = embedded && typeof embedded === "object" ? embedded : { uid: employee_uid, email: decoded?.email ?? null };
-      } else {
-        const customer_uid = extractCustomerUid(decoded);
-        if (!customer_uid) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_CUSTOMER_UID_MISSING",
-            message: "customer_uid missing in token (expected customer_uid or sub=cus:<uid>)"
-          });
-        }
-        ctx.customer_uid = customer_uid;
-        const embedded = decoded?.customer ?? null;
-        ctx.customer = embedded && typeof embedded === "object" ? embedded : { uid: customer_uid };
-      }
-      req.auth = ctx;
-      return next();
-    } catch {
-      if (!allowFirebaseIdToken) {
-        return res.status(401).json({
-          ok: false,
-          code: "AUTH_INVALID_TOKEN",
-          message: "Invalid or expired token"
-        });
-      }
-      try {
-        const firebaseDecoded = await import_firebase_admin.default.auth().verifyIdToken(token);
-        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_EMAIL_NOT_VERIFIED",
-            message: "Email not verified"
-          });
-        }
-        const headerCtx = req.context || {};
-        const companyUid = normalizeUid2(headerCtx.company_uid);
-        const branchUid = normalizeUid2(headerCtx.branch_uid);
-        req.auth = {
-          tokenType: "backend",
-          subject,
-          firebase: firebaseDecoded,
-          company_uid: companyUid ?? void 0,
-          branch_uid: branchUid ?? void 0,
-          companies: [],
-          roles: [],
-          permissions: [],
-          denied_permissions: []
-        };
-        return next();
-      } catch {
-        return res.status(401).json({
-          ok: false,
-          code: "AUTH_INVALID_TOKEN",
-          message: "Invalid or expired token"
-        });
-      }
-    }
+  return {
+    companiesFromToken,
+    company,
+    branch
   };
 }
-var authEmployeeRequired = createAuthMiddleware2({ subject: "employee", allowFirebaseIdToken: false });
-var authCustomerRequired = createAuthMiddleware2({ subject: "customer", allowFirebaseIdToken: false });
-var authEmployeeAllowFirebase = createAuthMiddleware2({ subject: "employee", allowFirebaseIdToken: true });
-var authCustomerAllowFirebase = createAuthMiddleware2({ subject: "customer", allowFirebaseIdToken: true });
+var authEmployeeRequired = createAuthMiddleware({
+  subject: "employee",
+  allowFirebaseIdToken: false,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const employee_uid = extractEmployeeUid(decoded) ?? normalizeUid(decoded?.employee?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const employee = decoded?.employee && typeof decoded.employee === "object" ? decoded.employee : employee_uid ? { uid: employee_uid, email: decoded?.email ?? null } : void 0;
+    return {
+      employee_uid: employee_uid ?? void 0,
+      employee,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authCustomerRequired = createAuthMiddleware({
+  subject: "customer",
+  allowFirebaseIdToken: false,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const customer_uid = extractCustomerUid(decoded) ?? normalizeUid(decoded?.customer?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const customer = decoded?.customer && typeof decoded.customer === "object" ? decoded.customer : customer_uid ? { uid: customer_uid } : void 0;
+    return {
+      customer_uid: customer_uid ?? void 0,
+      customer,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authEmployeeAllowFirebase = createAuthMiddleware({
+  subject: "employee",
+  allowFirebaseIdToken: true,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const employee_uid = extractEmployeeUid(decoded) ?? normalizeUid(decoded?.employee?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const employee = decoded?.employee && typeof decoded.employee === "object" ? decoded.employee : employee_uid ? { uid: employee_uid, email: decoded?.email ?? null } : void 0;
+    return {
+      employee_uid: employee_uid ?? void 0,
+      employee,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authCustomerAllowFirebase = createAuthMiddleware({
+  subject: "customer",
+  allowFirebaseIdToken: true,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const customer_uid = extractCustomerUid(decoded) ?? normalizeUid(decoded?.customer?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const customer = decoded?.customer && typeof decoded.customer === "object" ? decoded.customer : customer_uid ? { uid: customer_uid } : void 0;
+    return {
+      customer_uid: customer_uid ?? void 0,
+      customer,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
 
 // src/middlewares/guards.ts
 function normalizeRole(r) {
@@ -1184,7 +1191,7 @@ function allowAuthAdminOrPerm(permission) {
 }
 
 // src/internalHttpClient.ts
-var import_fs4 = __toESM(require("fs"), 1);
+var import_fs3 = __toESM(require("fs"), 1);
 var InternalHttpError = class extends Error {
   status;
   code;
@@ -1199,7 +1206,7 @@ var InternalHttpError = class extends Error {
 function readSecretFile2(path) {
   if (!path) return null;
   try {
-    const v = import_fs4.default.readFileSync(path, "utf8").trim();
+    const v = import_fs3.default.readFileSync(path, "utf8").trim();
     return v.length ? v : null;
   } catch {
     return null;
@@ -1481,8 +1488,43 @@ function createResClient() {
     apiPrefix: env.apiPrefix,
     path: "/refs/varieties"
   });
+  const resources = createBulkRefsClient({
+    namespace: "res:resource",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/resources"
+  });
+  const categories = createBulkRefsClient({
+    namespace: "res:category",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/categories"
+  });
+  const attributes = createBulkRefsClient({
+    namespace: "res:attribute",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/attributes"
+  });
+  const attributeOptions = createBulkRefsClient({
+    namespace: "res:attribute_option",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/attribute-options"
+  });
+  const attributeValues = createBulkRefsClient({
+    namespace: "res:attribute_value",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/attribute-values"
+  });
   return {
-    varietiesRefs: (uids, opts) => varieties.bulkRefs(uids, opts)
+    varietiesRefs: (uids, opts) => varieties.bulkRefs(uids, opts),
+    resourcesRefs: (uids, opts) => resources.bulkRefs(uids, opts),
+    categoriesRefs: (uids, opts) => categories.bulkRefs(uids, opts),
+    attributesRefs: (uids, opts) => attributes.bulkRefs(uids, opts),
+    attributeOptionsRefs: (uids, opts) => attributeOptions.bulkRefs(uids, opts),
+    attributeValuesRefs: (uids, opts) => attributeValues.bulkRefs(uids, opts)
   };
 }
 
@@ -1507,10 +1549,31 @@ function createMdClient() {
     apiPrefix: env.apiPrefix,
     path: "/refs/countries"
   });
+  const currencies = createBulkRefsClient({
+    namespace: "md:currency",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/currencies"
+  });
+  const regions = createBulkRefsClient({
+    namespace: "md:region",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/regions"
+  });
+  const communes = createBulkRefsClient({
+    namespace: "md:commune",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/communes"
+  });
   return {
     measuresRefs: (uids, opts) => measures.bulkRefs(uids, opts),
     measureTypesRefs: (uids, opts) => measureTypes.bulkRefs(uids, opts),
-    countriesRefs: (uids, opts) => countries.bulkRefs(uids, opts)
+    countriesRefs: (uids, opts) => countries.bulkRefs(uids, opts),
+    currenciesRefs: (uids, opts) => currencies.bulkRefs(uids, opts),
+    regionsRefs: (uids, opts) => regions.bulkRefs(uids, opts),
+    communesRefs: (uids, opts) => communes.bulkRefs(uids, opts)
   };
 }
 
@@ -1521,11 +1584,11 @@ function createFisClient() {
     baseURL: `${env.baseURL}${env.apiPrefix}`,
     timeoutMs: 8e3
   });
-  const taxes = createBulkRefsClient({
-    namespace: "fis:tax",
+  const profiles = createBulkRefsClient({
+    namespace: "fis:profile",
     baseURL: env.baseURL,
     apiPrefix: env.apiPrefix,
-    path: "/refs/taxes"
+    path: "/refs/profiles"
   });
   const documents = createBulkRefsClient({
     namespace: "fis:document",
@@ -1533,77 +1596,113 @@ function createFisClient() {
     apiPrefix: env.apiPrefix,
     path: "/refs/documents"
   });
+  const snapshots = createBulkRefsClient({
+    namespace: "fis:snapshot",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/snapshots"
+  });
   const submissions = createBulkRefsClient({
     namespace: "fis:submission",
     baseURL: env.baseURL,
     apiPrefix: env.apiPrefix,
     path: "/refs/submissions"
   });
+  const folioPools = createBulkRefsClient({
+    namespace: "fis:folio_pool",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/folio-pools"
+  });
+  const taxRules = createBulkRefsClient({
+    namespace: "fis:tax_rule",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/tax-rules"
+  });
   return {
     // -----------------------------------------------------------------------
     // Bulk refs
     // -----------------------------------------------------------------------
-    taxesRefs: (uids, opts) => taxes.bulkRefs(uids, opts),
+    profilesRefs: (uids, opts) => profiles.bulkRefs(uids, opts),
     documentsRefs: (uids, opts) => documents.bulkRefs(uids, opts),
+    snapshotsRefs: (uids, opts) => snapshots.bulkRefs(uids, opts),
     submissionsRefs: (uids, opts) => submissions.bulkRefs(uids, opts),
+    folioPoolsRefs: (uids, opts) => folioPools.bulkRefs(uids, opts),
+    taxRulesRefs: (uids, opts) => taxRules.bulkRefs(uids, opts),
     // -----------------------------------------------------------------------
     // Fiscal calculation / build / lifecycle
     // -----------------------------------------------------------------------
-    calculate: async (body) => {
+    async calculate(body) {
       const { data } = await http.post("/calculate", body);
       return data;
     },
-    buildDocument: async (body) => {
-      const { data } = await http.post("/documents/build", body);
+    async calculateTaxes(body) {
+      const { data } = await http.post("/tax/calculate", body);
       return data;
     },
-    signDocument: async (body) => {
-      const { data } = await http.post("/documents/sign", body);
+    async buildDocument(body) {
+      const { data } = await http.post("/documents", body);
       return data;
     },
-    submitDocument: async (body) => {
-      const { data } = await http.post("/documents/submit", body);
+    async signDocument(body) {
+      const { data } = await http.post(
+        `/documents/${body.document_uid}/sign`,
+        body
+      );
       return data;
     },
-    cancelDocument: async (body) => {
-      const { data } = await http.post("/documents/cancel", body);
+    async submitDocument(body) {
+      const { data } = await http.post(
+        `/documents/${body.document_uid}/submit`,
+        body
+      );
+      return data;
+    },
+    async cancelDocument(body) {
+      const { data } = await http.post(
+        `/documents/${body.document_uid}/cancel`,
+        body
+      );
       return data;
     },
     // -----------------------------------------------------------------------
     // Folios / series
     // -----------------------------------------------------------------------
-    reserveFolio: async (body) => {
+    async reserveFolio(body) {
       const { data } = await http.post("/folios/reserve", body);
       return data;
     },
-    consumeFolio: async (body) => {
+    async consumeFolio(body) {
       const { data } = await http.post("/folios/consume", body);
       return data;
     },
     // -----------------------------------------------------------------------
     // Queries / detail
     // -----------------------------------------------------------------------
-    queryDocuments: async (params) => {
-      const { data } = await http.get("/documents", { params });
+    async queryDocuments(body) {
+      const { data } = await http.post("/documents/query", body);
       return data;
     },
-    getDocumentByUid: async (uid) => {
+    async getDocumentByUid(uid) {
       const { data } = await http.get(`/documents/${uid}`);
       return data;
     },
-    getSnapshotByUid: async (uid) => {
+    async getSnapshotByUid(uid) {
       const { data } = await http.get(`/snapshots/${uid}`);
       return data;
     },
-    getSubmissionByUid: async (uid) => {
+    async getSubmissionByUid(uid) {
       const { data } = await http.get(`/submissions/${uid}`);
       return data;
     },
-    getStatusEventsByDocumentUid: async (documentUid) => {
-      const { data } = await http.get(`/documents/${documentUid}/status-events`);
+    async getStatusEventsByDocumentUid(documentUid) {
+      const { data } = await http.get(
+        `/documents/${documentUid}/status-events`
+      );
       return data;
     },
-    retrySubmission: async (body) => {
+    async retrySubmission(body) {
       const { data } = await http.post("/submissions/retry", body);
       return data;
     }
@@ -1659,25 +1758,107 @@ function createPayClient() {
     baseURL: `${env.baseURL}${env.apiPrefix}`,
     timeoutMs: 8e3
   });
+  const intents = createBulkRefsClient({
+    namespace: "pay:intent",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/intents"
+  });
+  const attempts = createBulkRefsClient({
+    namespace: "pay:attempt",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/attempts"
+  });
+  const transactions = createBulkRefsClient({
+    namespace: "pay:transaction",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/transactions"
+  });
+  const refunds = createBulkRefsClient({
+    namespace: "pay:refund",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/refunds"
+  });
+  const allocations = createBulkRefsClient({
+    namespace: "pay:allocation",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/allocations"
+  });
+  const providerAccounts = createBulkRefsClient({
+    namespace: "pay:provider_account",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/provider-accounts"
+  });
+  const paymentMethods = createBulkRefsClient({
+    namespace: "pay:payment_method",
+    baseURL: env.baseURL,
+    apiPrefix: env.apiPrefix,
+    path: "/refs/payment-methods"
+  });
   return {
+    // -----------------------------------------------------------------------
+    // Payment intents
+    // -----------------------------------------------------------------------
     async createIntent(body) {
-      const { data } = await http.post("/intents", body);
+      const { data } = await http.post("/payment-intents", body);
+      return data;
+    },
+    async getIntentByUid(uid) {
+      const { data } = await http.get(`/payment-intents/${uid}`);
+      return data;
+    },
+    async confirmIntent(body) {
+      const { data } = await http.post(
+        `/payment-intents/${body.intent_uid}/confirm`,
+        body
+      );
       return data;
     },
+    // -----------------------------------------------------------------------
+    // Attempts
+    // -----------------------------------------------------------------------
     async startAttempt(body) {
       const { data } = await http.post("/attempts", body);
       return data;
     },
+    // -----------------------------------------------------------------------
+    // Methods / availability
+    // -----------------------------------------------------------------------
     async getAvailableMethods(params) {
       const { data } = await http.get("/methods/available", {
         params
       });
       return data;
     },
-    async getIntentByUid(uid) {
-      const { data } = await http.get(`/intents/${uid}`);
+    // -----------------------------------------------------------------------
+    // Queries / allocations
+    // -----------------------------------------------------------------------
+    async queryPayments(body) {
+      const { data } = await http.post("/payments/query", body);
       return data;
-    }
+    },
+    async getAllocationsByTarget(body) {
+      const { data } = await http.post(
+        "/allocations/by-target",
+        body
+      );
+      return data;
+    },
+    // -----------------------------------------------------------------------
+    // Bulk refs
+    // -----------------------------------------------------------------------
+    intentsRefs: (uids, opts) => intents.bulkRefs(uids, opts),
+    attemptsRefs: (uids, opts) => attempts.bulkRefs(uids, opts),
+    transactionsRefs: (uids, opts) => transactions.bulkRefs(uids, opts),
+    refundsRefs: (uids, opts) => refunds.bulkRefs(uids, opts),
+    allocationsRefs: (uids, opts) => allocations.bulkRefs(uids, opts),
+    providerAccountsRefs: (uids, opts) => providerAccounts.bulkRefs(uids, opts),
+    paymentMethodsRefs: (uids, opts) => paymentMethods.bulkRefs(uids, opts)
   };
 }
 
@@ -1716,7 +1897,6 @@ function isUid(value) {
   buildInternalHeaders,
   closeCache,
   createAuthMiddleware,
-  createAuthMiddlewareLegacySimple,
   createBulkRefsClient,
   createFisClient,
   createHttpClient,
@@ -1727,6 +1907,9 @@ function isUid(value) {
   createPayClient,
   createPlatformClient,
   createResClient,
+  extractCustomerUid,
+  extractEmployeeUid,
+  getBearerToken,
   getOrSet,
   getRequestContextFromHeaders,
   getTwoLevelCache,
@@ -1735,6 +1918,7 @@ function isUid(value) {
   mapAxiosToUpstreamError,
   newUid,
   newUidV4,
+  normalizeUid,
   parseHeaders,
   readRs256PublicKey,
   readServiceEnv,
@@ -1746,6 +1930,7 @@ function isUid(value) {
   requireRolesOrAnyPermission,
   sendError,
   sendOk,
-  verifyBackendJwtRS256
+  verifyBackendJwtRS256,
+  withRequestIdConfig
 });
 //# sourceMappingURL=index.cjs.map