@ledewire/browser 0.3.0 → 0.5.0

package/README.md

@@ -3,7 +3,7 @@
 [![npm](https://img.shields.io/npm/v/@ledewire/browser)](https://www.npmjs.com/package/@ledewire/browser)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](../../LICENSE)
 
-Browser SDK for the [LedeWire](https://api.ledewire.com/api-docs/index.html) content marketplace — embed buyer authentication, wallet funding, and content purchases on any website with a single script tag.
+Browser SDK for the [LedeWire](https://api.ledewire.com/api-docs/index.html) content marketplace — embed buyer authentication, wallet funding, content purchases, and seller content discovery on any website with a single script tag.
 
 ## CDN — No Install Required
 
@@ -40,14 +40,15 @@ const lw = init({
 
 ## Client Namespaces
 
-| Namespace      | Description                                      |
-| -------------- | ------------------------------------------------ |
-| `lw.config`    | Platform public config (no auth required)        |
-| `lw.auth`      | Buyer signup, email/password login, Google OAuth |
-| `lw.wallet`    | Wallet balance, fund wallet via payment session  |
-| `lw.purchases` | List and create content purchases                |
-| `lw.content`   | Fetch content with buyer access info             |
-| `lw.checkout`  | Checkout state — what action is required next    |
+| Namespace           | Description                                                                     |
+| ------------------- | ------------------------------------------------------------------------------- |
+| `lw.config`         | Platform public config (no auth required)                                       |
+| `lw.auth`           | Buyer signup, email/password login, Google OAuth, API key login, password reset |
+| `lw.wallet`         | Wallet balance, fund wallet via payment session                                 |
+| `lw.purchases`      | List and create content purchases                                               |
+| `lw.content`        | Fetch content with buyer access info                                            |
+| `lw.checkout`       | Checkout state — what action is required next                                   |
+| `lw.seller.content` | List, search, and get store content (API key auth)                              |
 
 ## Example: Fetch Google OAuth Client ID Before Sign-In
 
@@ -92,6 +93,28 @@ switch (checkout_state.next_required_action) {
 }
 ```
 
+## Example: Seller Content Discovery
+
+Use `lw.auth.loginWithApiKey` with only the `key` to obtain a read-only token,
+then browse your store's content catalogue directly from the browser:
+
+```ts
+const lw = Ledewire.init({ apiKey: 'your_api_key' })
+
+// Obtain a view-only seller token (key only — no secret needed)
+await lw.auth.loginWithApiKey({ key: 'your_api_key' })
+
+// List all content
+const items = await lw.seller.content.list()
+
+// Search by title, URI, or metadata
+const results = await lw.seller.content.search({ title: 'intro' })
+const byMeta = await lw.seller.content.search({ metadata: { author: 'Alice' } })
+
+// Fetch a single item
+const item = await lw.seller.content.get('content-id')
+```
+
 ## Token Storage
 
 By default tokens are stored **in memory** (most secure — cleared on page unload).

package/dist/index.d.ts

@@ -47,12 +47,47 @@ export declare class AuthError extends LedewireError {
     constructor(message: string, code?: number);
 }
 
+/** Request body for API key authentication (seller). */
+declare type AuthLoginApiKeyRequest = components['schemas']['AuthLoginApiKeyRequest'];
+
 /** Request body for buyer email/password login. */
 declare type AuthLoginEmailRequest = components['schemas']['AuthLoginEmailRequest'];
 
 /** Request body for buyer Google OAuth login. */
 declare type AuthLoginOAuthRequest = components['schemas']['AuthLoginOAuthRequest'];
 
+/**
+ * Request body for completing a buyer password reset.
+ * Sent to `POST /v1/auth/password/reset`.
+ */
+export declare interface AuthPasswordResetBody {
+    /** The buyer's registered email address. */
+    email: string;
+    /** 6-digit numeric code delivered to the buyer's email. */
+    reset_code: string;
+    /** New password (minimum 6 characters). */
+    password: string;
+}
+
+/**
+ * Request body for initiating a buyer password reset.
+ * Sent to `POST /v1/auth/password/reset-request`.
+ */
+export declare interface AuthPasswordResetRequestBody {
+    /** The buyer's registered email address. */
+    email: string;
+}
+
+/**
+ * Response returned by both password reset endpoints.
+ * Contains a human-readable confirmation message.
+ */
+export declare interface AuthPasswordResetResponse {
+    data?: {
+        message?: string;
+    };
+}
+
 /** Request body for buyer email/password signup. */
 declare type AuthSignupRequest = components['schemas']['AuthSignupRequest'];
 
@@ -95,6 +130,61 @@ declare class BrowserAuthNamespace {
      * @returns The authentication token response.
      */
     loginWithGoogle(body: AuthLoginOAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Log in using an API key to obtain a seller token.
+     * Provide only `key` for read-only (`view`) access.
+     * Provide both `key` and `secret` for read/write (`full`) access.
+     * Tokens are stored automatically after successful authentication.
+     *
+     * Use this before calling `lw.seller.content.*` methods.
+     *
+     * @param body - API key credentials.
+     * @returns The authentication token response.
+     *
+     * @example
+     * ```ts
+     * // View access (read-only) — sufficient for seller.content.list/search/get
+     * await lw.auth.loginWithApiKey({ key: 'your_api_key' })
+     *
+     * // Full access (read/write)
+     * await lw.auth.loginWithApiKey({ key: 'your_api_key', secret: 'your_secret' })
+     * ```
+     */
+    loginWithApiKey(body: AuthLoginApiKeyRequest): Promise<AuthenticationResponse>;
+    /**
+     * Request a password reset code to be sent to the buyer's email address.
+     *
+     * The response is intentionally ambiguous — if the email does not exist,
+     * the API returns the same success message to prevent account enumeration.
+     *
+     * @param body - The buyer's email address.
+     * @returns A response with a confirmation message.
+     *
+     * @example
+     * ```ts
+     * await lw.auth.requestPasswordReset({ email: 'buyer@example.com' })
+     * // → { data: { message: 'If an account with this email exists, a reset code has been sent.' } }
+     * ```
+     */
+    requestPasswordReset(body: AuthPasswordResetRequestBody): Promise<AuthPasswordResetResponse>;
+    /**
+     * Reset a buyer's password using the code delivered to their email.
+     *
+     * Obtain the reset code first by calling `requestPasswordReset()`.
+     *
+     * @param body - Email address, 6-digit reset code, and the new password.
+     * @returns A response with a confirmation message.
+     *
+     * @example
+     * ```ts
+     * await lw.auth.resetPassword({
+     *   email: 'buyer@example.com',
+     *   reset_code: '123456',
+     *   password: 'new-secure-password',
+     * })
+     * ```
+     */
+    resetPassword(body: AuthPasswordResetBody): Promise<AuthPasswordResetResponse>;
     private storeTokens;
 }
 
@@ -121,6 +211,8 @@ declare class BrowserClient {
     readonly purchases: BrowserPurchasesNamespace;
     /** Public content with per-user access information */
     readonly content: BrowserContentNamespace;
+    /** Seller content: list, search, and get (requires API key view token) */
+    readonly seller: BrowserSellerNamespace;
     /* Excluded from this release type: __constructor */
 }
 
@@ -248,6 +340,85 @@ declare class BrowserPurchasesNamespace {
     get(id: string): Promise<PurchaseResponse>;
 }
 
+/**
+ * Seller content namespace — list, search, and fetch store content by API key.
+ *
+ * Obtain via `lw.seller.content` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const lw = Ledewire.init({ apiKey: 'your_api_key' })
+ * await lw.auth.loginWithApiKey({ key: 'your_api_key' })
+ *
+ * const items = await lw.seller.content.list()
+ * const results = await lw.seller.content.search({ title: 'intro' })
+ * const item = await lw.seller.content.get('content-id')
+ * ```
+ */
+declare class BrowserSellerContentNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * List all content for the authenticated seller's store.
+     * Requires a token with at least `view` permission.
+     *
+     * @returns Array of content items.
+     *
+     * @example
+     * ```ts
+     * const items = await lw.seller.content.list()
+     * ```
+     */
+    list(): Promise<ContentResponse[]>;
+    /**
+     * Search content by title, URI, and/or metadata (AND logic).
+     * At least one criterion must be supplied.
+     * Requires a token with at least `view` permission.
+     *
+     * @param body - Search criteria (title, uri, and/or metadata).
+     * @returns Array of matching content items.
+     *
+     * @example
+     * ```ts
+     * const results = await lw.seller.content.search({ title: 'intro' })
+     * const byUri = await lw.seller.content.search({ uri: 'vimeo.com' })
+     * const byMeta = await lw.seller.content.search({ metadata: { author: 'Alice' } })
+     * ```
+     */
+    search(body: SellerContentSearchRequest): Promise<ContentResponse[]>;
+    /**
+     * Get a single content item by ID.
+     * Requires a token with at least `view` permission.
+     *
+     * @param id - The content ID.
+     * @returns The content item.
+     *
+     * @example
+     * ```ts
+     * const item = await lw.seller.content.get('content-id')
+     * ```
+     */
+    get(id: string): Promise<ContentResponse>;
+}
+
+/**
+ * Seller operations accessible with a view-permission API key token.
+ *
+ * Obtain via `lw.seller` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const lw = Ledewire.init({ apiKey: 'your_api_key' })
+ * await lw.auth.loginWithApiKey({ key: 'your_api_key' })
+ * const items = await lw.seller.content.list()
+ * ```
+ */
+declare class BrowserSellerNamespace {
+    /** Seller content: list, search, and get by API key. */
+    readonly content: BrowserSellerContentNamespace;
+    /* Excluded from this release type: __constructor */
+}
+
 /**
  * Buyer wallet namespace — balance, transactions, and payment session management.
  *
@@ -455,8 +626,8 @@ declare interface components {
             refresh_token?: string;
         };
         ManageableStore: {
-            store_id: string;
-            store_name: string;
+            id: string;
+            name: string;
             store_key: string;
             /**
              * @description Derived role. `owner` if the user owns this store; `author` if they have author permissions only.
@@ -986,7 +1157,7 @@ declare interface components {
             data: components['schemas']['MerchantUser'][];
             pagination: components['schemas']['PaginationMeta'];
         };
-        /** @description Lightweight content representation returned by list and search endpoints. Omits body fields to keep list payloads small. Use the detail endpoint (`GET /v1/merchant/:store_id/content/:id`) to retrieve the full body or URI. */
+        /** @description Lightweight content representation returned by list and search endpoints. Omits `content_body` to keep list payloads small. Use the detail endpoint (`GET /v1/merchant/:store_id/content/:id`) to retrieve the full body. */
         ContentListItem: {
             id: string;
             /** @enum {string} */
@@ -1002,6 +1173,8 @@ declare interface components {
             visibility: 'public' | 'unlisted' | 'private';
             /** Format: date-time */
             created_at: string;
+            /** @description External URI for `external_ref` content; optional supplementary link for `markdown` content. Null when not set. */
+            content_uri: string | null;
             /** @description Namespaced platform ID for `external_ref` content. Null for other types. */
             external_identifier?: string | null;
         };
@@ -1139,12 +1312,42 @@ declare interface components {
 /** Checkout state for a specific piece of content and user. */
 export declare type ContentAccessInfo = components['schemas']['ContentAccessInfo'];
 
+/** Full content item returned by all seller content endpoints. */
+declare type ContentResponse = components['schemas']['ContentResponse'];
+
 /** A piece of content with buyer access information. */
 export declare type ContentWithAccessResponse = components['schemas']['ContentWithAccessResponse'];
 
 /**
  * Thrown when the authenticated user does not have permission
  * to perform the requested operation.
+ *
+ * **Common cause — merchant login with the wrong account role:**
+ * `POST /v1/auth/merchant/login/email` and `POST /v1/auth/merchant/login/google`
+ * return `403 Forbidden` (not `401`) when the credentials are valid but the
+ * account has no merchant store associations (e.g. a buyer account used on the
+ * merchant endpoint). The `err.message` will be:
+ * `"This account does not have merchant access. Use a merchant or owner account."`
+ *
+ * Use a different account or ask a store owner to add your account as a member.
+ *
+ * @example
+ * ```ts
+ * import { ForbiddenError, AuthError } from '@ledewire/node'
+ *
+ * try {
+ *   await client.merchant.auth.loginWithGoogle({ id_token })
+ * } catch (err) {
+ *   if (err instanceof ForbiddenError) {
+ *     // Credentials were valid but account has no merchant store access.
+ *     // err.message → "This account does not have merchant access. Use a merchant or owner account."
+ *     console.error('Wrong account role:', err.message)
+ *   } else if (err instanceof AuthError) {
+ *     // Bad credentials or expired token — re-authenticate.
+ *     console.error('Authentication failed:', err.message)
+ *   }
+ * }
+ * ```
  */
 export declare class ForbiddenError extends LedewireError {
     constructor(message: string, code?: number);
@@ -1342,6 +1545,19 @@ export declare class PurchaseError extends LedewireError {
 /** A purchase record. */
 export declare type PurchaseResponse = components['schemas']['PurchaseResponse'];
 
+/**
+ * Search criteria for seller content search.
+ * At least one field must be supplied. All supplied fields must match (AND logic).
+ */
+export declare interface SellerContentSearchRequest {
+    /** Case-insensitive partial match against the content title. */
+    title?: string;
+    /** Case-insensitive partial match against the content URI (`external_ref` content only). */
+    uri?: string;
+    /** Exact key/value pairs to AND-match against content metadata. */
+    metadata?: Record<string, unknown>;
+}
+
 /** Internal representation of stored authentication tokens. */
 export declare interface StoredTokens {
     accessToken: string;
@@ -1396,13 +1612,18 @@ declare interface TokenManagerOptions {
      */
     refreshFn: (refreshToken: string) => Promise<StoredTokens>;
     /**
-     * Called after a successful token refresh.
-     * Use in server environments to persist the new tokens to a database or cache.
+     * Called after a successful background token refresh (not on initial login).
+     * Use for side-effects only — e.g. audit logging, cache invalidation, or
+     * notifying a secondary system when tokens rotate.
+     *
+     * **Do not use this for token persistence.** The `storage` adapter's
+     * `setTokens` is the canonical persistence hook and is already called on
+     * every refresh. Providing both will result in double-writes.
      *
      * @example
      * ```ts
      * onTokenRefreshed: async (tokens) => {
-     *   await redis.set('session:tokens', JSON.stringify(tokens))
+     *   await auditLog.record('token_refreshed', { expiresAt: tokens.expiresAt })
      * }
      * ```
      */

package/dist/index.js

@@ -21,23 +21,23 @@ class d extends c {
     super(e, 403, t), this.name = "ForbiddenError";
   }
 }
-class k extends c {
+class g extends c {
   constructor(e, t) {
     super(e, 404, t), this.name = "NotFoundError";
   }
 }
-class N extends c {
+class $ extends c {
   constructor(e, t, r) {
     super(e, t, r), this.name = "PurchaseError";
   }
 }
-const g = "https://api.ledewire.com";
+const k = "https://api.ledewire.com";
 class f {
   constructor(e = {}) {
     n(this, "baseUrl");
     n(this, "getAccessToken");
     n(this, "onUnauthorized");
-    this.baseUrl = (e.baseUrl ?? g).replace(/\/$/, ""), this.getAccessToken = e.getAccessToken ?? (() => null), this.onUnauthorized = e.onUnauthorized ?? (() => null);
+    this.baseUrl = (e.baseUrl ?? k).replace(/\/$/, ""), this.getAccessToken = e.getAccessToken ?? (() => null), this.onUnauthorized = e.onUnauthorized ?? (() => null);
   }
   /**
    * GET request with optional query parameters.
@@ -117,7 +117,7 @@ class f {
       case 403:
         throw new d(r, o);
       case 404:
-        throw new k(r, o);
+        throw new g(r, o);
       default:
         throw new c(r, e.status, o);
     }
@@ -226,6 +226,68 @@ class E {
     const t = await this.http.post("/v1/auth/login/google", e);
     return await this.storeTokens(t), t;
   }
+  /**
+   * Log in using an API key to obtain a seller token.
+   * Provide only `key` for read-only (`view`) access.
+   * Provide both `key` and `secret` for read/write (`full`) access.
+   * Tokens are stored automatically after successful authentication.
+   *
+   * Use this before calling `lw.seller.content.*` methods.
+   *
+   * @param body - API key credentials.
+   * @returns The authentication token response.
+   *
+   * @example
+   * ```ts
+   * // View access (read-only) — sufficient for seller.content.list/search/get
+   * await lw.auth.loginWithApiKey({ key: 'your_api_key' })
+   *
+   * // Full access (read/write)
+   * await lw.auth.loginWithApiKey({ key: 'your_api_key', secret: 'your_secret' })
+   * ```
+   */
+  async loginWithApiKey(e) {
+    const t = await this.http.post("/v1/auth/login/api-key", e);
+    return await this.storeTokens(t), t;
+  }
+  /**
+   * Request a password reset code to be sent to the buyer's email address.
+   *
+   * The response is intentionally ambiguous — if the email does not exist,
+   * the API returns the same success message to prevent account enumeration.
+   *
+   * @param body - The buyer's email address.
+   * @returns A response with a confirmation message.
+   *
+   * @example
+   * ```ts
+   * await lw.auth.requestPasswordReset({ email: 'buyer@example.com' })
+   * // → { data: { message: 'If an account with this email exists, a reset code has been sent.' } }
+   * ```
+   */
+  async requestPasswordReset(e) {
+    return this.http.post("/v1/auth/password/reset-request", e);
+  }
+  /**
+   * Reset a buyer's password using the code delivered to their email.
+   *
+   * Obtain the reset code first by calling `requestPasswordReset()`.
+   *
+   * @param body - Email address, 6-digit reset code, and the new password.
+   * @returns A response with a confirmation message.
+   *
+   * @example
+   * ```ts
+   * await lw.auth.resetPassword({
+   *   email: 'buyer@example.com',
+   *   reset_code: '123456',
+   *   password: 'new-secure-password',
+   * })
+   * ```
+   */
+  async resetPassword(e) {
+    return this.http.post("/v1/auth/password/reset", e);
+  }
   async storeTokens(e) {
     await this.tokenManager.setTokens({
       accessToken: e.access_token,
@@ -257,7 +319,7 @@ class A {
     return this.http.get("/v1/config/public");
   }
 }
-class x {
+class v {
   constructor(e) {
     this.http = e;
   }
@@ -277,7 +339,7 @@ class x {
     );
   }
 }
-class U {
+class x {
   constructor(e) {
     this.http = e;
   }
@@ -308,6 +370,67 @@ class U {
     return this.http.get(`/v1/purchases/${e}`);
   }
 }
+class U {
+  /** @internal */
+  constructor(e) {
+    this.http = e;
+  }
+  /**
+   * List all content for the authenticated seller's store.
+   * Requires a token with at least `view` permission.
+   *
+   * @returns Array of content items.
+   *
+   * @example
+   * ```ts
+   * const items = await lw.seller.content.list()
+   * ```
+   */
+  async list() {
+    return this.http.get("/v1/seller/content");
+  }
+  /**
+   * Search content by title, URI, and/or metadata (AND logic).
+   * At least one criterion must be supplied.
+   * Requires a token with at least `view` permission.
+   *
+   * @param body - Search criteria (title, uri, and/or metadata).
+   * @returns Array of matching content items.
+   *
+   * @example
+   * ```ts
+   * const results = await lw.seller.content.search({ title: 'intro' })
+   * const byUri = await lw.seller.content.search({ uri: 'vimeo.com' })
+   * const byMeta = await lw.seller.content.search({ metadata: { author: 'Alice' } })
+   * ```
+   */
+  async search(e) {
+    return this.http.post("/v1/seller/content/search", e);
+  }
+  /**
+   * Get a single content item by ID.
+   * Requires a token with at least `view` permission.
+   *
+   * @param id - The content ID.
+   * @returns The content item.
+   *
+   * @example
+   * ```ts
+   * const item = await lw.seller.content.get('content-id')
+   * ```
+   */
+  async get(e) {
+    return this.http.get(`/v1/seller/content/${e}`);
+  }
+}
+class S {
+  /** @internal */
+  constructor(e) {
+    /** Seller content: list, search, and get by API key. */
+    n(this, "content");
+    this.content = new U(e);
+  }
+}
 class b {
   constructor(e) {
     this.http = e;
@@ -347,7 +470,7 @@ class b {
     return this.http.get(`/v1/wallet/payment-status/${e}`);
   }
 }
-class v {
+class P {
   constructor(e) {
     this.http = e;
   }
@@ -366,7 +489,7 @@ class v {
     return this.http.get(`/v1/checkout/state/${e}`);
   }
 }
-function O(s) {
+function C(s) {
   const e = s.baseUrl ?? "https://api.ledewire.com", t = s.storage ?? new m(), r = new y({
     storage: t,
     refreshFn: async (h) => {
@@ -389,9 +512,9 @@ function O(s) {
     getAccessToken: () => r.getAccessToken(),
     onUnauthorized: () => r.handleUnauthorized()
   });
-  return new S(o, r, s);
+  return new N(o, r, s);
 }
-class S {
+class N {
   /** @internal */
   constructor(e, t, r) {
     /** Platform-level public configuration (no auth required) */
@@ -406,11 +529,13 @@ class S {
     n(this, "purchases");
     /** Public content with per-user access information */
     n(this, "content");
-    this._http = e, this._tokenManager = t, this._config = r, this.config = new A(e), this.auth = new E(e, t), this.checkout = new v(e), this.wallet = new b(e), this.purchases = new U(e), this.content = new x(e);
+    /** Seller content: list, search, and get (requires API key view token) */
+    n(this, "seller");
+    this._http = e, this._tokenManager = t, this._config = r, this.config = new A(e), this.auth = new E(e, t), this.checkout = new P(e), this.wallet = new b(e), this.purchases = new x(e), this.content = new v(e), this.seller = new S(e);
   }
 }
-const P = "lw:tokens";
-function _(s = P) {
+const R = "lw:tokens";
+function B(s = R) {
   return {
     getTokens() {
       const e = localStorage.getItem(s);
@@ -434,10 +559,10 @@ export {
   d as ForbiddenError,
   c as LedewireError,
   m as MemoryTokenStorage,
-  k as NotFoundError,
-  N as PurchaseError,
-  O as init,
-  _ as localStorageAdapter,
+  g as NotFoundError,
+  $ as PurchaseError,
+  C as init,
+  B as localStorageAdapter,
   l as parseExpiresAt
 };
 //# sourceMappingURL=index.js.map