@ledewire/browser 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.ts +312 -13
  2. package/dist/index.js +172 -85
  3. package/dist/index.js.map +1 -1
  4. package/dist/ledewire.min.js +1 -1
  5. package/dist/ledewire.min.js.map +1 -1
  6. package/llms.txt +24 -6
  7. package/package.json +1 -1
package/dist/ledewire.min.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"ledewire.min.js","sources":["../../core/src/base64.ts","../../core/src/errors.ts","../../core/src/http-client.ts","../../core/src/token-manager.ts","../src/resources/auth.ts","../src/resources/config.ts","../src/resources/content.ts","../src/resources/purchases.ts","../src/resources/seller/content.ts","../src/resources/seller/index.ts","../src/resources/wallet.ts","../src/resources/checkout.ts","../src/client.ts","../src/local-storage-adapter.ts","../src/session-storage-adapter.ts"],"sourcesContent":["/**\n * Decode a base64-encoded string to plain UTF-8 text.\n *\n * Used internally by SDK response handlers to transparently decode\n * `content_body` and `teaser` fields from the API wire format.\n *\n * @internal\n */\nexport function decodeBase64(value: string): string {\n return atob(value)\n}\n\n/**\n * Encode a plain UTF-8 string to base64.\n *\n * Used internally by SDK request handlers to re-encode plain-text\n * `content_body` and `teaser` fields before they are sent to the API.\n *\n * @internal\n */\nexport function encodeBase64(value: string): string {\n return btoa(value)\n}\n\n/**\n * Decode base64-encoded `content_body` and `teaser` fields on a content\n * response object. Works with both `ContentResponse` (which may carry\n * `content_body`) and `ContentListItem` (which only carries `teaser`).\n * Null and absent fields are left untouched.\n *\n * @internal\n */\nexport function decodeContentFields<\n T extends { content_body?: string | null; teaser?: string | null },\n>(item: T): T {\n return {\n ...item,\n ...(typeof item.content_body === 'string' && {\n content_body: decodeBase64(item.content_body),\n }),\n ...(typeof item.teaser === 'string' && { teaser: decodeBase64(item.teaser) }),\n } as T\n}\n\n/**\n * Encode plain-text `content_body` and `teaser` fields to base64 before\n * they are sent to the API. Absent and undefined fields are left untouched.\n *\n * @internal\n */\nexport function encodeContentFields(body: Record<string, unknown>): Record<string, unknown> {\n const out: Record<string, unknown> = { ...body }\n if (typeof out['content_body'] === 'string')\n out['content_body'] = encodeBase64(out['content_body'])\n if (typeof out['teaser'] === 'string') out['teaser'] = encodeBase64(out['teaser'])\n return out\n}\n","/**\n * Base error class for all LedeWire SDK errors.\n * All errors thrown by the SDK are instances of this class,\n * making it safe to use `err instanceof LedewireError` as a type guard.\n *\n * @example\n * ```ts\n * try {\n * await client.purchases.create({ contentId: '...' })\n * } catch (err) {\n * if (err instanceof LedewireError) {\n * console.error(err.statusCode, err.message)\n * }\n * }\n * ```\n */\nexport class LedewireError extends Error {\n /** HTTP status code returned by the API (e.g. 400, 401, 404, 422). */\n public readonly statusCode: number\n\n /** Machine-readable error code from the API error body, if present. */\n public readonly code: number | undefined\n\n constructor(message: string, statusCode: number, code?: number) {\n super(message)\n this.name = 'LedewireError'\n this.statusCode = statusCode\n this.code = code\n // Restore prototype chain (required for extending built-in Error in TS)\n Object.setPrototypeOf(this, new.target.prototype)\n }\n}\n\n/**\n * Thrown when the request lacks valid authentication credentials,\n * or when a token refresh fails and re-authentication is required.\n */\nexport class AuthError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 401, code)\n this.name = 'AuthError'\n }\n}\n\n/**\n * Thrown when the authenticated user does not have permission\n * to perform the requested operation.\n *\n * **Common cause — merchant login with the wrong account role:**\n * `POST /v1/auth/merchant/login/email` and `POST /v1/auth/merchant/login/google`\n * return `403 Forbidden` (not `401`) when the credentials are valid but the\n * account has no merchant store associations (e.g. a buyer account used on the\n * merchant endpoint). The `err.message` will be:\n * `\"This account does not have merchant access. Use a merchant or owner account.\"`\n *\n * Use a different account or ask a store owner to add your account as a member.\n *\n * @example\n * ```ts\n * // Browser\n * import { ForbiddenError, AuthError } from '@ledewire/browser'\n *\n * try {\n * await lw.auth.loginWithGoogle({ id_token })\n * } catch (err) {\n * if (err instanceof ForbiddenError) {\n * // Credentials were valid but account lacks the required role.\n * console.error('Access denied:', err.message)\n * } else if (err instanceof AuthError) {\n * // Bad credentials or expired token — re-authenticate.\n * console.error('Authentication failed:', err.message)\n * }\n * }\n * ```\n *\n * @example\n * ```ts\n * // Node\n * import { ForbiddenError, AuthError } from '@ledewire/node'\n *\n * try {\n * await client.merchant.auth.loginWithGoogle({ id_token })\n * } catch (err) {\n * if (err instanceof ForbiddenError) {\n * // Credentials were valid but account has no merchant store access.\n * // err.message → \"This account does not have merchant access. Use a merchant or owner account.\"\n * console.error('Wrong account role:', err.message)\n * } else if (err instanceof AuthError) {\n * // Bad credentials or expired token — re-authenticate.\n * console.error('Authentication failed:', err.message)\n * }\n * }\n * ```\n */\nexport class ForbiddenError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 403, code)\n this.name = 'ForbiddenError'\n }\n}\n\n/**\n * Thrown when the requested resource does not exist.\n */\nexport class NotFoundError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 404, code)\n this.name = 'NotFoundError'\n }\n}\n\n/**\n * Thrown when the purchase cannot be completed due to a validation\n * failure, such as a price mismatch or a duplicate purchase.\n */\nexport class PurchaseError extends LedewireError {\n constructor(message: string, statusCode: number, code?: number) {\n super(message, statusCode, code)\n this.name = 'PurchaseError'\n }\n}\n","import type { components } from './api.gen.js'\nimport { AuthError, ForbiddenError, LedewireError, NotFoundError } from './errors.js'\n\n/** @internal */\ntype ApiErrorBody = components['schemas']['ErrorResponse']\n\n/**\n * Configuration options for `HttpClient`.\n */\nexport interface HttpClientConfig {\n /** API base URL. Defaults to the production API. */\n baseUrl?: string\n /**\n * Returns the current access token (or null) before each request.\n * If null, requests are sent without an Authorization header.\n */\n getAccessToken?: () => string | null | Promise<string | null>\n /**\n * Called when a 401 is received on the first attempt.\n * Should refresh and return the new access token, or null to propagate\n * an `AuthError` to the caller.\n */\n onUnauthorized?: () => string | null | Promise<string | null>\n}\n\nconst DEFAULT_BASE_URL = 'https://api.ledewire.com'\n\n/**\n * Core HTTP client used by all SDK packages.\n *\n * Features:\n * - Injects `Authorization: Bearer <token>` headers automatically\n * - Maps HTTP error responses to typed `LedewireError` subclasses\n * - On receiving a 401, calls `onUnauthorized` once and retries the request\n *\n * This is an internal class - consumers should use the\n * package-level client factories (`init` / `createClient`) instead.\n */\nexport class HttpClient {\n private readonly baseUrl: string\n private readonly getAccessToken: NonNullable<HttpClientConfig['getAccessToken']>\n private readonly onUnauthorized: NonNullable<HttpClientConfig['onUnauthorized']>\n\n constructor(config: HttpClientConfig = {}) {\n this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n this.getAccessToken = config.getAccessToken ?? (() => null)\n this.onUnauthorized = config.onUnauthorized ?? (() => null)\n }\n\n /**\n * GET request with optional query parameters.\n * @param path - API path (e.g. `/v1/wallet/balance`)\n * @param params - Query string parameters\n */\n async get<T>(path: string, params?: Record<string, string>): Promise<T> {\n return this.request<T>('GET', this.buildUrl(path, params))\n }\n\n /**\n * POST request.\n * @param path - API path\n * @param body - Request body (JSON-serialized)\n */\n async post<T>(path: string, body?: unknown): Promise<T> {\n return this.request<T>('POST', this.buildUrl(path), body)\n }\n\n /**\n * PUT request.\n * @param path - API path\n * @param body - Request body (JSON-serialized)\n */\n async put<T>(path: string, body?: unknown): Promise<T> {\n return this.request<T>('PUT', this.buildUrl(path), body)\n }\n\n /**\n * PATCH request.\n * @param path - API path\n * @param body - Partial update body (JSON-serialized)\n */\n async patch<T>(path: string, body?: unknown): Promise<T> {\n return this.request<T>('PATCH', this.buildUrl(path), body)\n }\n\n /**\n * DELETE request.\n * @param path - API path\n */\n async delete<T = void>(path: string): Promise<T> {\n return this.request<T>('DELETE', this.buildUrl(path))\n }\n\n // ---------------------------------------------------------------------------\n // Private helpers\n // ---------------------------------------------------------------------------\n\n private buildUrl(path: string, params?: Record<string, string>): string {\n const url = `${this.baseUrl}${path}`\n if (!params || Object.keys(params).length === 0) return url\n return `${url}?${new URLSearchParams(params).toString()}`\n }\n\n private async request<T>(\n method: string,\n url: string,\n body?: unknown,\n isRetry = false,\n ): Promise<T> {\n const token = await this.getAccessToken()\n const headers: Record<string, string> = {\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n }\n if (token) headers['Authorization'] = `Bearer ${token}`\n\n const response = await fetch(url, {\n method,\n headers,\n ...(body !== undefined && { body: JSON.stringify(body) }),\n })\n\n if (response.status === 401 && !isRetry) {\n const newToken = await this.onUnauthorized()\n if (newToken) {\n return this.request<T>(method, url, body, true)\n }\n throw new AuthError('Session expired. Please re-authenticate.')\n }\n\n if (!response.ok) {\n await this.throwApiError(response)\n }\n\n if (response.status === 204) {\n return undefined as T\n }\n\n return response.json() as Promise<T>\n }\n\n private async throwApiError(response: Response): Promise<never> {\n let body: ApiErrorBody | undefined\n try {\n body = (await response.json()) as ApiErrorBody\n } catch {\n // Non-JSON body - fall through to use statusText\n }\n\n const message = body?.error.message ?? response.statusText\n const code = body?.error.code\n\n switch (response.status) {\n case 401:\n throw new AuthError(message, code)\n case 403:\n throw new ForbiddenError(message, code)\n case 404:\n throw new NotFoundError(message, code)\n default:\n throw new LedewireError(message, response.status, code)\n }\n }\n}\n","import type { StoredTokens, TokenStorage } from './types.js'\nimport { AuthError } from './errors.js'\n\n/** How many milliseconds before expiry to proactively refresh the token. */\nconst REFRESH_THRESHOLD_MS = 60_000 // 60 seconds\n\n/**\n * Options for constructing a `TokenManager`.\n */\nexport interface TokenManagerOptions {\n storage: TokenStorage\n /**\n * Exchanges a refresh token for a new token pair.\n * Implemented by each package's client factory using the\n * `/v1/auth/token/refresh` endpoint.\n */\n refreshFn: (refreshToken: string) => Promise<StoredTokens>\n /**\n * Called after a successful background token refresh (not on initial login).\n * Use for side-effects only — e.g. audit logging, cache invalidation, or\n * notifying a secondary system when tokens rotate.\n *\n * **Do not use this for token persistence.** The `storage` adapter's\n * `setTokens` is the canonical persistence hook and is already called on\n * every refresh. Providing both will result in double-writes.\n *\n * @example\n * ```ts\n * onTokenRefreshed: async (tokens) => {\n * await auditLog.record('token_refreshed', { expiresAt: tokens.expiresAt })\n * }\n * ```\n */\n onTokenRefreshed?: (tokens: StoredTokens) => void | Promise<void>\n /**\n * Called when a refresh attempt fails and the user must re-authenticate.\n * Typically used to redirect to login or emit a UI event.\n *\n * @example\n * ```ts\n * onAuthExpired: () => { window.location.href = '/login' }\n * ```\n */\n onAuthExpired?: () => void | Promise<void>\n}\n\n/**\n * Manages the JWT token lifecycle transparently.\n *\n * - Proactively refreshes the access token when it expires within 60 seconds\n * - Handles reactive refresh on 401 responses from the HTTP client\n * - Deduplicates concurrent refresh calls (only one in-flight refresh at a time)\n * - Fires `onAuthExpired` when refresh fails so the UI can prompt re-login\n *\n * This is an internal class - use the package-level client factories instead.\n */\nexport class TokenManager {\n private readonly storage: TokenStorage\n private readonly refreshFn: TokenManagerOptions['refreshFn']\n private readonly onTokenRefreshed: TokenManagerOptions['onTokenRefreshed']\n private readonly onAuthExpired: TokenManagerOptions['onAuthExpired']\n private refreshPromise: Promise<StoredTokens | null> | null = null\n\n constructor(options: TokenManagerOptions) {\n this.storage = options.storage\n this.refreshFn = options.refreshFn\n this.onTokenRefreshed = options.onTokenRefreshed\n this.onAuthExpired = options.onAuthExpired\n }\n\n /**\n * Returns a valid access token, refreshing proactively if needed.\n * Returns `null` if no tokens are stored (user not authenticated).\n */\n async getAccessToken(): Promise<string | null> {\n const stored = await this.storage.getTokens()\n if (!stored) return null\n\n const expiresInMs = stored.expiresAt - Date.now()\n if (expiresInMs < REFRESH_THRESHOLD_MS) {\n const refreshed = await this.performRefresh(stored.refreshToken)\n return refreshed?.accessToken ?? null\n }\n\n return stored.accessToken\n }\n\n /**\n * Called by `HttpClient` when a 401 is received.\n * Attempts one refresh; returns the new access token or null.\n */\n async handleUnauthorized(): Promise<string | null> {\n const stored = await this.storage.getTokens()\n if (!stored) {\n await this.onAuthExpired?.()\n return null\n }\n const refreshed = await this.performRefresh(stored.refreshToken)\n if (!refreshed) await this.onAuthExpired?.()\n return refreshed?.accessToken ?? null\n }\n\n /** Store new tokens after a successful login or signup. */\n async setTokens(tokens: StoredTokens): Promise<void> {\n await this.storage.setTokens(tokens)\n }\n\n /** Clear all stored tokens (call on logout). */\n async clearTokens(): Promise<void> {\n await this.storage.clearTokens()\n }\n\n // ---------------------------------------------------------------------------\n // Private\n // ---------------------------------------------------------------------------\n\n private performRefresh(refreshToken: string): Promise<StoredTokens | null> {\n if (this.refreshPromise) return this.refreshPromise\n\n this.refreshPromise = this.refreshFn(refreshToken)\n .then(async (tokens) => {\n await this.storage.setTokens(tokens)\n await this.onTokenRefreshed?.(tokens)\n return tokens\n })\n .catch((_err: unknown) => {\n void this.storage.clearTokens()\n throw new AuthError('Token refresh failed. Please re-authenticate.')\n })\n .finally(() => {\n this.refreshPromise = null\n })\n\n return this.refreshPromise\n }\n}\n\n// ---------------------------------------------------------------------------\n// Built-in storage adapters\n// ---------------------------------------------------------------------------\n\n/**\n * In-memory token storage (default for both packages).\n * Tokens are cleared when the page unloads or the process exits.\n * This is the most secure default for browser environments.\n */\nexport class MemoryTokenStorage implements TokenStorage {\n private tokens: StoredTokens | null = null\n\n getTokens(): StoredTokens | null {\n return this.tokens\n }\n\n setTokens(tokens: StoredTokens): void {\n this.tokens = tokens\n }\n\n clearTokens(): void {\n this.tokens = null\n }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Converts an `expires_at` ISO 8601 string from an API auth response\n * into a Unix timestamp (milliseconds) for use in `StoredTokens.expiresAt`.\n *\n * @param expiresAt - ISO 8601 datetime string, e.g. `\"2026-01-01T12:00:00Z\"`\n * @returns Unix timestamp in milliseconds\n */\nexport function parseExpiresAt(expiresAt: string): number {\n return new Date(expiresAt).getTime()\n}\n","/**\n * Buyer authentication namespace for browser environments.\n *\n * Handles buyer signup, email/password login, Google OAuth, and password reset.\n * Tokens are stored automatically in the `TokenManager` after every\n * successful call — callers never need to manage tokens directly.\n *\n * For seller/API key authentication, use {@link BrowserSellerNamespace.loginWithApiKey}\n * via `lw.seller.loginWithApiKey()`.\n *\n * @module\n */\nimport { parseExpiresAt } from '@ledewire/core'\nimport type { HttpClient, TokenManager } from '@ledewire/core'\nimport type {\n AuthLoginEmailRequest,\n AuthLoginOAuthRequest,\n AuthPasswordResetBody,\n AuthPasswordResetRequestBody,\n AuthPasswordResetResponse,\n AuthSignupRequest,\n AuthenticationResponse,\n} from '@ledewire/core'\n\n/**\n * Buyer authentication: signup, email/password login, Google OAuth, password reset.\n *\n * Obtain via `lw.auth` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * await lw.auth.loginWithEmail({ email: 'u@example.com', password: 'pw' })\n * ```\n */\nexport class BrowserAuthNamespace {\n /** @internal */\n constructor(\n private readonly http: HttpClient,\n private readonly tokenManager: TokenManager,\n ) {}\n\n /**\n * Register a new buyer account with email and password.\n * Tokens are stored automatically after successful signup.\n *\n * @param body - Signup credentials and display name.\n * @returns The authentication token response.\n */\n async signup(body: AuthSignupRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/signup', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Log in with email and password.\n * Tokens are stored automatically after successful login.\n *\n * @param body - Email and password credentials.\n * @returns The authentication token response.\n */\n async loginWithEmail(body: AuthLoginEmailRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/email', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Log in with a Google ID token obtained from the Google OAuth flow.\n * Tokens are stored automatically after successful login.\n *\n * @param body - The Google ID token.\n * @returns The authentication token response.\n */\n async loginWithGoogle(body: AuthLoginOAuthRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/google', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Request a password reset code to be sent to the buyer's email address.\n *\n * The response is intentionally ambiguous — if the email does not exist,\n * the API returns the same success message to prevent account enumeration.\n *\n * @param body - The buyer's email address.\n * @returns A response with a confirmation message.\n *\n * @example\n * ```ts\n * await lw.auth.requestPasswordReset({ email: 'buyer@example.com' })\n * // → { data: { message: 'If an account with this email exists, a reset code has been sent.' } }\n * ```\n */\n async requestPasswordReset(\n body: AuthPasswordResetRequestBody,\n ): Promise<AuthPasswordResetResponse> {\n return this.http.post<AuthPasswordResetResponse>('/v1/auth/password/reset-request', body)\n }\n\n /**\n * Reset a buyer's password using the code delivered to their email.\n *\n * Obtain the reset code first by calling `requestPasswordReset()`.\n *\n * @param body - Email address, 6-digit reset code, and the new password.\n * @returns A response with a confirmation message.\n *\n * @example\n * ```ts\n * await lw.auth.resetPassword({\n * email: 'buyer@example.com',\n * reset_code: '123456',\n * password: 'new-secure-password',\n * })\n * ```\n */\n async resetPassword(body: AuthPasswordResetBody): Promise<AuthPasswordResetResponse> {\n return this.http.post<AuthPasswordResetResponse>('/v1/auth/password/reset', body)\n }\n\n private async storeTokens(res: AuthenticationResponse): Promise<void> {\n await this.tokenManager.setTokens({\n accessToken: res.access_token,\n refreshToken: res.refresh_token,\n expiresAt: parseExpiresAt(res.expires_at),\n })\n }\n}\n","/**\n * Platform configuration namespace (browser).\n *\n * Provides access to public (unauthenticated) platform-level configuration.\n *\n * @module\n */\nimport type { HttpClient } from '@ledewire/core'\nimport type { PublicConfigResponse } from '@ledewire/core'\n\n/**\n * Platform-level configuration for browser clients.\n *\n * Obtain via `client.config` — do not construct directly.\n */\nexport class BrowserConfigNamespace {\n /** @internal */\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns platform-level public configuration.\n * No authentication required — safe to call before the user has signed in.\n *\n * Use `google_client_id` to initialise the Google Identity Services library\n * on the storefront login page without requiring a prior authenticated call.\n *\n * @example\n * ```ts\n * const lw = init({ apiKey: 'your_api_key' })\n * const { google_client_id } = await lw.config.getPublic()\n * google.accounts.id.initialize({ client_id: google_client_id, callback })\n * ```\n */\n async getPublic(): Promise<PublicConfigResponse> {\n return this.http.get<PublicConfigResponse>('/v1/config/public')\n }\n}\n","import { decodeContentFields } from '@ledewire/core'\nimport type { HttpClient } from '@ledewire/core'\nimport type { ContentWithAccessResponse } from '@ledewire/core'\n\n/**\n * Buyer content namespace — fetch content with real-time access information.\n *\n * Obtain via `lw.content` — do not construct directly.\n *\n * @example\n * ```ts\n * const result = await lw.content.getWithAccess('content-id')\n * if (result.access_info.next_required_action === 'view_content') {\n * renderMarkdown(result.content_body ?? '')\n * }\n * ```\n */\nexport class BrowserContentNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns a content item together with access information for the\n * authenticated buyer (or a generic access response when unauthenticated).\n *\n * @param id - The content ID.\n * @returns The content item with access information. `content_body` and\n * `teaser` are returned as plain UTF-8 text — the SDK decodes base64\n * transparently so you can render them directly.\n *\n * @example\n * ```ts\n * const result = await lw.content.getWithAccess('article-123')\n * if (result.access_info.next_required_action === 'view_content') {\n * renderMarkdown(result.content_body ?? '')\n * }\n * ```\n */\n async getWithAccess(id: string): Promise<ContentWithAccessResponse> {\n const res = await this.http.get<ContentWithAccessResponse>(`/v1/content/${id}/with-access`)\n return decodeContentFields(res)\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type { PurchaseCreateRequest, PurchaseResponse } from '@ledewire/core'\n\n/**\n * Buyer purchases namespace — create and retrieve content purchases.\n *\n * Obtain via `lw.purchases` — do not construct directly.\n *\n * @example\n * ```ts\n * await lw.purchases.create({ content_id: 'content-id' })\n * const all = await lw.purchases.list()\n * ```\n */\nexport class BrowserPurchasesNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Completes a content purchase using the buyer's wallet balance.\n *\n * @param body - The content ID and expected price in cents.\n * @returns The completed purchase record.\n */\n async create(body: PurchaseCreateRequest): Promise<PurchaseResponse> {\n return this.http.post<PurchaseResponse>('/v1/purchases', body)\n }\n\n /**\n * Returns all purchases made by the authenticated buyer.\n *\n * @returns A list of purchase records, newest first.\n */\n async list(): Promise<PurchaseResponse[]> {\n return this.http.get<PurchaseResponse[]>('/v1/purchases')\n }\n\n /**\n * Returns a single purchase by ID.\n *\n * @param id - The purchase ID.\n * @returns The purchase record.\n */\n async get(id: string): Promise<PurchaseResponse> {\n return this.http.get<PurchaseResponse>(`/v1/purchases/${id}`)\n }\n}\n","/**\n * Seller content namespace for browser environments.\n *\n * Read-only operations using a view-permission API key token.\n * Hits the `/v1/seller/content` family of endpoints — store identity is\n * derived server-side from the token, so no `store_id` is required.\n *\n * @module\n */\nimport { decodeContentFields } from '@ledewire/core'\nimport type { HttpClient } from '@ledewire/core'\nimport type { ContentResponse } from '@ledewire/core'\n\n/**\n * Search criteria for seller content search.\n * At least one field must be supplied. All supplied fields must match (AND logic).\n */\nexport interface SellerContentSearchRequest {\n /** Case-insensitive partial match against the content title. */\n title?: string\n /** Case-insensitive partial match against the content URI (`external_ref` content only). */\n uri?: string\n /**\n * Exact match against the content's external identifier.\n * Use the full formatted value as it appears in `ContentResponse.external_identifier`,\n * e.g. `'vimeo:123456789'`.\n */\n external_identifier?: string\n /** Exact key/value pairs to AND-match against content metadata. */\n metadata?: Record<string, unknown>\n}\n\n/**\n * Seller content namespace — list, search, and fetch store content by API key.\n *\n * Obtain via `lw.seller.content` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n *\n * const items = await lw.seller.content.list()\n * const results = await lw.seller.content.search({ title: 'intro' })\n * const item = await lw.seller.content.get('content-id')\n * ```\n */\nexport class BrowserSellerContentNamespace {\n /** @internal */\n constructor(private readonly http: HttpClient) {}\n\n /**\n * List all content for the authenticated seller's store.\n * Requires a token with at least `view` permission.\n *\n * @returns Array of content items. `teaser` is returned as plain text —\n * the SDK decodes base64 automatically.\n *\n * @example\n * ```ts\n * const items = await lw.seller.content.list()\n * ```\n */\n async list(): Promise<ContentResponse[]> {\n const res = await this.http.get<ContentResponse[]>('/v1/seller/content')\n return res.map(decodeContentFields)\n }\n\n /**\n * Search content by title, URI, and/or metadata (AND logic).\n * At least one criterion must be supplied.\n * Requires a token with at least `view` permission.\n *\n * @param body - Search criteria (title, uri, and/or metadata).\n * @returns Array of matching content items. `teaser` is returned as plain\n * text — the SDK decodes base64 automatically.\n *\n * @example\n * ```ts\n * const results = await lw.seller.content.search({ title: 'intro' })\n * const byUri = await lw.seller.content.search({ uri: 'vimeo.com' })\n * const byId = await lw.seller.content.search({ external_identifier: 'vimeo:123456789' })\n * const byMeta = await lw.seller.content.search({ metadata: { author: 'Alice' } })\n * ```\n */\n async search(body: SellerContentSearchRequest): Promise<ContentResponse[]> {\n const res = await this.http.post<ContentResponse[]>('/v1/seller/content/search', body)\n return res.map(decodeContentFields)\n }\n\n /**\n * Get a single content item by ID.\n * Requires a token with at least `view` permission.\n *\n * @param id - The content ID.\n * @returns The content item. `content_body` and `teaser` are returned as\n * plain UTF-8 text — the SDK decodes base64 automatically so you can render\n * them directly without calling `atob()`.\n *\n * @example\n * ```ts\n * const item = await lw.seller.content.get('content-id')\n * // item.content_body is plain markdown — no atob() needed\n * ```\n */\n async get(id: string): Promise<ContentResponse> {\n const res = await this.http.get<ContentResponse>(`/v1/seller/content/${id}`)\n return decodeContentFields(res)\n }\n}\n","/**\n * Browser seller namespace — API-key-authenticated read operations.\n *\n * @module\n */\nimport { parseExpiresAt } from '@ledewire/core'\nimport type { HttpClient, TokenManager } from '@ledewire/core'\nimport type { AuthLoginApiKeyRequest, AuthenticationResponse } from '@ledewire/core'\nimport { BrowserSellerContentNamespace } from './content.js'\n\n/**\n * Seller operations accessible with a view-permission API key token.\n *\n * Obtain via `lw.seller` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n *\n * // Authenticate as a seller (key-only = view; key+secret = full)\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n * const items = await lw.seller.content.list()\n * ```\n */\nexport class BrowserSellerNamespace {\n /** Seller content: list, search, and get by API key. */\n readonly content: BrowserSellerContentNamespace\n\n /** @internal */\n constructor(\n private readonly http: HttpClient,\n private readonly tokenManager: TokenManager,\n ) {\n this.content = new BrowserSellerContentNamespace(http)\n }\n\n /**\n * Log in using an API key to obtain a seller token.\n * Provide only `key` for read-only (`view`) access.\n * Provide both `key` and `secret` for read/write (`full`) access.\n * Tokens are stored automatically after successful authentication.\n *\n * Use this before calling `lw.seller.content.*` methods.\n *\n * @param body - API key credentials.\n * @returns The authentication token response.\n *\n * @example\n * ```ts\n * // View access (read-only) — sufficient for seller.content.list/search/get\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n *\n * // Full access (read/write)\n * await lw.seller.loginWithApiKey({ key: 'your_api_key', secret: 'your_secret' })\n * ```\n */\n async loginWithApiKey(body: AuthLoginApiKeyRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/api-key', body)\n await this.tokenManager.setTokens({\n accessToken: res.access_token,\n refreshToken: res.refresh_token,\n expiresAt: parseExpiresAt(res.expires_at),\n })\n return res\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type {\n WalletBalanceResponse,\n WalletPaymentSessionRequest,\n WalletPaymentSessionResponse,\n WalletPaymentStatusResponse,\n WalletTransactionItem,\n} from '@ledewire/core'\n\n/**\n * Buyer wallet namespace — balance, transactions, and payment session management.\n *\n * Obtain via `lw.wallet` — do not construct directly.\n *\n * @example\n * ```ts\n * const { balance_cents } = await lw.wallet.balance()\n * const session = await lw.wallet.createPaymentSession({ amount_cents: 500 })\n * ```\n */\nexport class BrowserWalletNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns the authenticated buyer's current wallet balance.\n *\n * @returns The current wallet balance in cents.\n */\n async balance(): Promise<WalletBalanceResponse> {\n return this.http.get<WalletBalanceResponse>('/v1/wallet/balance')\n }\n\n /**\n * Returns the authenticated buyer's wallet transaction history, newest first.\n *\n * @returns A list of completed wallet transaction entries.\n */\n async transactions(): Promise<WalletTransactionItem[]> {\n return this.http.get<WalletTransactionItem[]>('/v1/wallet/transactions')\n }\n\n /**\n * Creates a payment session for funding the buyer's wallet.\n *\n * @param body - The amount and currency to fund.\n * @returns Payment session details for use with the payment provider widget.\n */\n async createPaymentSession(\n body: WalletPaymentSessionRequest,\n ): Promise<WalletPaymentSessionResponse> {\n return this.http.post<WalletPaymentSessionResponse>('/v1/wallet/payment-session', body)\n }\n\n /**\n * Polls the status of a wallet funding payment session.\n *\n * @param sessionId - The session ID returned by `createPaymentSession`.\n * @returns The current payment status.\n */\n async getPaymentStatus(sessionId: string): Promise<WalletPaymentStatusResponse> {\n return this.http.get<WalletPaymentStatusResponse>(`/v1/wallet/payment-status/${sessionId}`)\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type { CheckoutStateResponse } from '@ledewire/core'\n\n/**\n * Checkout namespace — buyer checkout state for a specific content item.\n *\n * Obtain via `lw.checkout` — do not construct directly.\n *\n * @example\n * ```ts\n * const state = await lw.checkout.state('content-id')\n * // state.checkout_state.next_required_action:\n * // 'authenticate' | 'fund_wallet' | 'purchase' | 'view_content'\n * ```\n */\nexport class CheckoutNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns the authenticated buyer's checkout readiness for a given piece of\n * content. Indicates whether the buyer needs to authenticate, fund their\n * wallet, or purchase before accessing the content.\n *\n * Works without authentication — returns anonymous checkout state when the\n * buyer is not logged in.\n *\n * @param contentId - The content item ID.\n * @returns The checkout state, including what action is required next.\n */\n async state(contentId: string): Promise<CheckoutStateResponse> {\n return this.http.get<CheckoutStateResponse>(`/v1/checkout/state/${contentId}`)\n }\n}\n","import { HttpClient, MemoryTokenStorage, TokenManager, parseExpiresAt } from '@ledewire/core'\nimport type { TokenStorage } from '@ledewire/core'\nimport { BrowserAuthNamespace } from './resources/auth.js'\nimport { BrowserConfigNamespace } from './resources/config.js'\nimport { BrowserContentNamespace } from './resources/content.js'\nimport { BrowserPurchasesNamespace } from './resources/purchases.js'\nimport { BrowserSellerNamespace } from './resources/seller/index.js'\nimport { BrowserWalletNamespace } from './resources/wallet.js'\nimport { CheckoutNamespace } from './resources/checkout.js'\n\n/**\n * Configuration options for the LedeWire browser client.\n */\nexport interface BrowserClientConfig {\n /**\n * LedeWire API key that identifies the store.\n * Obtained from the LedeWire merchant dashboard.\n */\n apiKey: string\n /**\n * Override the API base URL.\n * Defaults to `https://api.ledewire.com`.\n */\n baseUrl?: string\n /**\n * Token storage adapter.\n * Defaults to {@link MemoryTokenStorage} (in-memory, most secure).\n *\n * To persist sessions across page reloads, use the built-in\n * `localStorageAdapter`:\n * ```ts\n * import { init, localStorageAdapter } from '@ledewire/browser'\n * const lw = init({ apiKey: '...', storage: localStorageAdapter() })\n * ```\n */\n storage?: TokenStorage\n /**\n * Called when the user's session expires and cannot be refreshed.\n * Use this to show a re-authentication prompt.\n *\n * @example\n * ```ts\n * onAuthExpired: () => showLoginModal()\n * ```\n */\n onAuthExpired?: () => void\n}\n\n/**\n * Initialises a LedeWire browser client.\n * This is the primary entry point for the browser SDK.\n *\n * @example CDN usage:\n * ```html\n * <script src=\"https://cdn.jsdelivr.net/npm/@ledewire/browser@1/dist/ledewire.min.js\"></script>\n * <script>\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * const state = await lw.checkout.state('content-id')\n * </script>\n * ```\n *\n * @example npm usage:\n * ```ts\n * import { init } from '@ledewire/browser'\n * const lw = init({ apiKey: 'your_api_key' })\n * ```\n */\nexport function init(config: BrowserClientConfig): BrowserClient {\n const baseUrl = config.baseUrl ?? 'https://api.ledewire.com'\n const storage = config.storage ?? new MemoryTokenStorage()\n\n const tokenManager = new TokenManager({\n storage,\n refreshFn: async (refreshToken) => {\n const res = await fetch(`${baseUrl}/v1/auth/token/refresh`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ refresh_token: refreshToken }),\n })\n if (!res.ok) throw new Error('Token refresh failed')\n const data = (await res.json()) as {\n access_token: string\n refresh_token: string\n expires_at: string\n }\n return {\n accessToken: data.access_token,\n refreshToken: data.refresh_token,\n expiresAt: parseExpiresAt(data.expires_at),\n }\n },\n ...(config.onAuthExpired !== undefined && { onAuthExpired: config.onAuthExpired }),\n })\n\n const http = new HttpClient({\n baseUrl,\n getAccessToken: () => tokenManager.getAccessToken(),\n onUnauthorized: () => tokenManager.handleUnauthorized(),\n })\n\n return new BrowserClient(http, tokenManager, config)\n}\n\n/**\n * The LedeWire browser client.\n * Access buyer flows through the namespaced properties.\n *\n * @remarks\n * Instantiate with {@link init} rather than constructing directly.\n */\nexport class BrowserClient {\n /** Platform-level public configuration (no auth required) */\n readonly config: BrowserConfigNamespace\n\n /** Buyer authentication: email/password signup/login, Google OAuth, password reset */\n readonly auth: BrowserAuthNamespace\n\n /** Checkout state machine: determines next action for a piece of content */\n readonly checkout: CheckoutNamespace\n\n /** Wallet: balance, fund via payment session, transaction history */\n readonly wallet: BrowserWalletNamespace\n\n /** Content purchases for the authenticated buyer */\n readonly purchases: BrowserPurchasesNamespace\n\n /** Public content with per-user access information */\n readonly content: BrowserContentNamespace\n\n /** Seller operations: API key login, content list/search/get */\n readonly seller: BrowserSellerNamespace\n\n /** @internal */\n constructor(\n public readonly _http: HttpClient,\n public readonly _tokenManager: TokenManager,\n public readonly _config: BrowserClientConfig,\n ) {\n this.config = new BrowserConfigNamespace(_http)\n this.auth = new BrowserAuthNamespace(_http, _tokenManager)\n this.checkout = new CheckoutNamespace(_http)\n this.wallet = new BrowserWalletNamespace(_http)\n this.purchases = new BrowserPurchasesNamespace(_http)\n this.content = new BrowserContentNamespace(_http)\n this.seller = new BrowserSellerNamespace(_http, _tokenManager)\n }\n}\n","import type { TokenStorage, StoredTokens } from '@ledewire/core'\n\nconst DEFAULT_STORAGE_KEY = 'lw:tokens'\n\n/**\n * A {@link TokenStorage} adapter that persists tokens in `localStorage`.\n *\n * Tokens survive page reloads and browser restarts, which is convenient\n * for sites where users expect persistent sessions.\n *\n * **Security note:** `localStorage` is accessible to any JavaScript on the\n * same origin. Only use this adapter on sites you fully control and trust.\n * The default in-memory storage is safer for high-security use cases.\n *\n * @param key - The `localStorage` key used to store tokens.\n * Defaults to `'lw:tokens'`. Override this if you have multiple\n * LedeWire integrations on the same origin.\n *\n * @example\n * ```ts\n * import { init, localStorageAdapter } from '@ledewire/browser'\n *\n * const lw = init({\n * apiKey: 'your_api_key',\n * storage: localStorageAdapter(),\n * })\n * ```\n */\nexport function localStorageAdapter(key = DEFAULT_STORAGE_KEY): TokenStorage {\n return {\n getTokens(): StoredTokens | null {\n const raw = localStorage.getItem(key)\n if (!raw) return null\n try {\n return JSON.parse(raw) as StoredTokens\n } catch {\n // Corrupted value - treat as empty\n return null\n }\n },\n setTokens(tokens: StoredTokens): void {\n localStorage.setItem(key, JSON.stringify(tokens))\n },\n clearTokens(): void {\n localStorage.removeItem(key)\n },\n }\n}\n","import type { TokenStorage, StoredTokens } from '@ledewire/core'\n\nconst DEFAULT_STORAGE_KEY = 'lw:tokens'\n\n/**\n * A {@link TokenStorage} adapter that persists tokens in `sessionStorage`.\n *\n * Tokens survive page reloads within the same tab but are cleared when the\n * tab is closed or the session ends. This prevents token leakage across\n * tabs and is a good default for sites where users do not expect persistent\n * sessions (e.g. embedded checkout widgets, kiosk-mode UIs).\n *\n * **Security note:** `sessionStorage` is accessible to any JavaScript on the\n * same origin and tab. It is more isolated than `localStorage` (no\n * cross-tab sharing), but the default in-memory storage is still safer for\n * high-security use cases.\n *\n * @param key - The `sessionStorage` key used to store tokens.\n * Defaults to `'lw:tokens'`. Override this if you have multiple\n * LedeWire integrations on the same origin.\n *\n * @example\n * ```ts\n * import { init, sessionStorageAdapter } from '@ledewire/browser'\n *\n * const lw = init({\n * apiKey: 'your_api_key',\n * storage: sessionStorageAdapter(),\n * })\n * ```\n */\nexport function sessionStorageAdapter(key = DEFAULT_STORAGE_KEY): TokenStorage {\n return {\n getTokens(): StoredTokens | null {\n const raw = sessionStorage.getItem(key)\n if (!raw) return null\n try {\n return JSON.parse(raw) as StoredTokens\n } catch {\n // Corrupted value - treat as empty\n return null\n }\n },\n setTokens(tokens: StoredTokens): void {\n sessionStorage.setItem(key, JSON.stringify(tokens))\n },\n clearTokens(): void {\n sessionStorage.removeItem(key)\n },\n }\n}\n"],"names":["decodeBase64","value","decodeContentFields","item","LedewireError","message","statusCode","code","__publicField","AuthError","ForbiddenError","NotFoundError","PurchaseError","DEFAULT_BASE_URL","HttpClient","config","path","params","body","url","method","isRetry","token","headers","response","REFRESH_THRESHOLD_MS","TokenManager","options","stored","refreshed","tokens","refreshToken","_err","MemoryTokenStorage","parseExpiresAt","expiresAt","BrowserAuthNamespace","http","tokenManager","res","BrowserConfigNamespace","BrowserContentNamespace","id","BrowserPurchasesNamespace","BrowserSellerContentNamespace","BrowserSellerNamespace","BrowserWalletNamespace","sessionId","CheckoutNamespace","contentId","init","baseUrl","storage","data","BrowserClient","_http","_tokenManager","_config","DEFAULT_STORAGE_KEY","localStorageAdapter","key","raw","sessionStorageAdapter"],"mappings":"2MAQO,SAASA,EAAaC,EAAuB,CAClD,OAAO,KAAKA,CAAK,CACnB,CAsBO,SAASC,EAEdC,EAAY,CACZ,MAAO,CACL,GAAGA,EACH,GAAI,OAAOA,EAAK,cAAiB,UAAY,CAC3C,aAAcH,EAAaG,EAAK,YAAY,CAAA,EAE9C,GAAI,OAAOA,EAAK,QAAW,UAAY,CAAE,OAAQH,EAAaG,EAAK,MAAM,CAAA,CAAE,CAE/E,CC1BO,MAAMC,UAAsB,KAAM,CAOvC,YAAYC,EAAiBC,EAAoBC,EAAe,CAC9D,MAAMF,CAAO,EANCG,EAAA,mBAGAA,EAAA,aAId,KAAK,KAAO,gBACZ,KAAK,WAAaF,EAClB,KAAK,KAAOC,EAEZ,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,CAMO,MAAME,UAAkBL,CAAc,CAC3C,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,WACd,CACF,CAoDO,MAAMG,UAAuBN,CAAc,CAChD,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,gBACd,CACF,CAKO,MAAMI,UAAsBP,CAAc,CAC/C,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,eACd,CACF,CAMO,MAAMK,UAAsBR,CAAc,CAC/C,YAAYC,EAAiBC,EAAoBC,EAAe,CAC9D,MAAMF,EAASC,EAAYC,CAAI,EAC/B,KAAK,KAAO,eACd,CACF,CC/FA,MAAMM,EAAmB,2BAalB,MAAMC,CAAW,CAKtB,YAAYC,EAA2B,GAAI,CAJ1BP,EAAA,gBACAA,EAAA,uBACAA,EAAA,uBAGf,KAAK,SAAWO,EAAO,SAAWF,GAAkB,QAAQ,MAAO,EAAE,EACrE,KAAK,eAAiBE,EAAO,iBAAmB,IAAM,MACtD,KAAK,eAAiBA,EAAO,iBAAmB,IAAM,KACxD,CAOA,MAAM,IAAOC,EAAcC,EAA6C,CACtE,OAAO,KAAK,QAAW,MAAO,KAAK,SAASD,EAAMC,CAAM,CAAC,CAC3D,CAOA,MAAM,KAAQD,EAAcE,EAA4B,CACtD,OAAO,KAAK,QAAW,OAAQ,KAAK,SAASF,CAAI,EAAGE,CAAI,CAC1D,CAOA,MAAM,IAAOF,EAAcE,EAA4B,CACrD,OAAO,KAAK,QAAW,MAAO,KAAK,SAASF,CAAI,EAAGE,CAAI,CACzD,CAOA,MAAM,MAASF,EAAcE,EAA4B,CACvD,OAAO,KAAK,QAAW,QAAS,KAAK,SAASF,CAAI,EAAGE,CAAI,CAC3D,CAMA,MAAM,OAAiBF,EAA0B,CAC/C,OAAO,KAAK,QAAW,SAAU,KAAK,SAASA,CAAI,CAAC,CACtD,CAMQ,SAASA,EAAcC,EAAyC,CACtE,MAAME,EAAM,GAAG,KAAK,OAAO,GAAGH,CAAI,GAClC,MAAI,CAACC,GAAU,OAAO,KAAKA,CAAM,EAAE,SAAW,EAAUE,EACjD,GAAGA,CAAG,IAAI,IAAI,gBAAgBF,CAAM,EAAE,UAAU,EACzD,CAEA,MAAc,QACZG,EACAD,EACAD,EACAG,EAAU,GACE,CACZ,MAAMC,EAAQ,MAAM,KAAK,eAAA,EACnBC,EAAkC,CACtC,eAAgB,mBAChB,OAAQ,kBAAA,EAEND,IAAOC,EAAQ,cAAmB,UAAUD,CAAK,IAErD,MAAME,EAAW,MAAM,MAAML,EAAK,CAChC,OAAAC,EACA,QAAAG,EACA,GAAIL,IAAS,QAAa,CAAE,KAAM,KAAK,UAAUA,CAAI,CAAA,CAAE,CACxD,EAED,GAAIM,EAAS,SAAW,KAAO,CAACH,EAAS,CAEvC,GADiB,MAAM,KAAK,eAAA,EAE1B,OAAO,KAAK,QAAWD,EAAQD,EAAKD,EAAM,EAAI,EAEhD,MAAM,IAAIT,EAAU,0CAA0C,CAChE,CAMA,GAJKe,EAAS,IACZ,MAAM,KAAK,cAAcA,CAAQ,EAG/BA,EAAS,SAAW,IAIxB,OAAOA,EAAS,KAAA,CAClB,CAEA,MAAc,cAAcA,EAAoC,CAC9D,IAAIN,EACJ,GAAI,CACFA,EAAQ,MAAMM,EAAS,KAAA,CACzB,MAAQ,CAER,CAEA,MAAMnB,EAAUa,GAAM,MAAM,SAAWM,EAAS,WAC1CjB,EAAOW,GAAM,MAAM,KAEzB,OAAQM,EAAS,OAAA,CACf,IAAK,KACH,MAAM,IAAIf,EAAUJ,EAASE,CAAI,EACnC,IAAK,KACH,MAAM,IAAIG,EAAeL,EAASE,CAAI,EACxC,IAAK,KACH,MAAM,IAAII,EAAcN,EAASE,CAAI,EACvC,QACE,MAAM,IAAIH,EAAcC,EAASmB,EAAS,OAAQjB,CAAI,CAAA,CAE5D,CACF,CC/JA,MAAMkB,EAAuB,IAoDtB,MAAMC,CAAa,CAOxB,YAAYC,EAA8B,CANzBnB,EAAA,gBACAA,EAAA,kBACAA,EAAA,yBACAA,EAAA,sBACTA,EAAA,sBAAsD,MAG5D,KAAK,QAAUmB,EAAQ,QACvB,KAAK,UAAYA,EAAQ,UACzB,KAAK,iBAAmBA,EAAQ,iBAChC,KAAK,cAAgBA,EAAQ,aAC/B,CAMA,MAAM,gBAAyC,CAC7C,MAAMC,EAAS,MAAM,KAAK,QAAQ,UAAA,EAClC,OAAKA,EAEeA,EAAO,UAAY,KAAK,IAAA,EAC1BH,GACE,MAAM,KAAK,eAAeG,EAAO,YAAY,IAC7C,aAAe,KAG5BA,EAAO,YARM,IAStB,CAMA,MAAM,oBAA6C,CACjD,MAAMA,EAAS,MAAM,KAAK,QAAQ,UAAA,EAClC,GAAI,CAACA,EACH,aAAM,KAAK,gBAAA,EACJ,KAET,MAAMC,EAAY,MAAM,KAAK,eAAeD,EAAO,YAAY,EAC/D,OAAKC,GAAW,MAAM,KAAK,gBAAA,EACpBA,GAAW,aAAe,IACnC,CAGA,MAAM,UAAUC,EAAqC,CACnD,MAAM,KAAK,QAAQ,UAAUA,CAAM,CACrC,CAGA,MAAM,aAA6B,CACjC,MAAM,KAAK,QAAQ,YAAA,CACrB,CAMQ,eAAeC,EAAoD,CACzE,OAAI,KAAK,eAAuB,KAAK,gBAErC,KAAK,eAAiB,KAAK,UAAUA,CAAY,EAC9C,KAAK,MAAOD,IACX,MAAM,KAAK,QAAQ,UAAUA,CAAM,EACnC,MAAM,KAAK,mBAAmBA,CAAM,EAC7BA,EACR,EACA,MAAOE,GAAkB,CACxB,MAAK,KAAK,QAAQ,YAAA,EACZ,IAAIvB,EAAU,+CAA+C,CACrE,CAAC,EACA,QAAQ,IAAM,CACb,KAAK,eAAiB,IACxB,CAAC,EAEI,KAAK,eACd,CACF,CAWO,MAAMwB,CAA2C,CAAjD,cACGzB,EAAA,cAA8B,MAEtC,WAAiC,CAC/B,OAAO,KAAK,MACd,CAEA,UAAUsB,EAA4B,CACpC,KAAK,OAASA,CAChB,CAEA,aAAoB,CAClB,KAAK,OAAS,IAChB,CACF,CAaO,SAASI,EAAeC,EAA2B,CACxD,OAAO,IAAI,KAAKA,CAAS,EAAE,QAAA,CAC7B,CC5IO,MAAMC,CAAqB,CAEhC,YACmBC,EACAC,EACjB,CAFiB,KAAA,KAAAD,EACA,KAAA,aAAAC,CAChB,CASH,MAAM,OAAOpB,EAA0D,CACrE,MAAMqB,EAAM,MAAM,KAAK,KAAK,KAA6B,kBAAmBrB,CAAI,EAChF,aAAM,KAAK,YAAYqB,CAAG,EACnBA,CACT,CASA,MAAM,eAAerB,EAA8D,CACjF,MAAMqB,EAAM,MAAM,KAAK,KAAK,KAA6B,uBAAwBrB,CAAI,EACrF,aAAM,KAAK,YAAYqB,CAAG,EACnBA,CACT,CASA,MAAM,gBAAgBrB,EAA8D,CAClF,MAAMqB,EAAM,MAAM,KAAK,KAAK,KAA6B,wBAAyBrB,CAAI,EACtF,aAAM,KAAK,YAAYqB,CAAG,EACnBA,CACT,CAiBA,MAAM,qBACJrB,EACoC,CACpC,OAAO,KAAK,KAAK,KAAgC,kCAAmCA,CAAI,CAC1F,CAmBA,MAAM,cAAcA,EAAiE,CACnF,OAAO,KAAK,KAAK,KAAgC,0BAA2BA,CAAI,CAClF,CAEA,MAAc,YAAYqB,EAA4C,CACpE,MAAM,KAAK,aAAa,UAAU,CAChC,YAAaA,EAAI,aACjB,aAAcA,EAAI,cAClB,UAAWL,EAAeK,EAAI,UAAU,CAAA,CACzC,CACH,CACF,CCnHO,MAAMC,CAAuB,CAElC,YAA+BH,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAgBlD,MAAM,WAA2C,CAC/C,OAAO,KAAK,KAAK,IAA0B,mBAAmB,CAChE,CACF,CCnBO,MAAMI,CAAwB,CACnC,YAA+BJ,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAmBlD,MAAM,cAAcK,EAAgD,CAClE,MAAMH,EAAM,MAAM,KAAK,KAAK,IAA+B,eAAeG,CAAE,cAAc,EAC1F,OAAOxC,EAAoBqC,CAAG,CAChC,CACF,CC3BO,MAAMI,CAA0B,CACrC,YAA+BN,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAQlD,MAAM,OAAOnB,EAAwD,CACnE,OAAO,KAAK,KAAK,KAAuB,gBAAiBA,CAAI,CAC/D,CAOA,MAAM,MAAoC,CACxC,OAAO,KAAK,KAAK,IAAwB,eAAe,CAC1D,CAQA,MAAM,IAAIwB,EAAuC,CAC/C,OAAO,KAAK,KAAK,IAAsB,iBAAiBA,CAAE,EAAE,CAC9D,CACF,CCEO,MAAME,CAA8B,CAEzC,YAA6BP,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAchD,MAAM,MAAmC,CAEvC,OADY,MAAM,KAAK,KAAK,IAAuB,oBAAoB,GAC5D,IAAInC,CAAmB,CACpC,CAmBA,MAAM,OAAOgB,EAA8D,CAEzE,OADY,MAAM,KAAK,KAAK,KAAwB,4BAA6BA,CAAI,GAC1E,IAAIhB,CAAmB,CACpC,CAiBA,MAAM,IAAIwC,EAAsC,CAC9C,MAAMH,EAAM,MAAM,KAAK,KAAK,IAAqB,sBAAsBG,CAAE,EAAE,EAC3E,OAAOxC,EAAoBqC,CAAG,CAChC,CACF,CCrFO,MAAMM,CAAuB,CAKlC,YACmBR,EACAC,EACjB,CANO9B,EAAA,gBAIU,KAAA,KAAA6B,EACA,KAAA,aAAAC,EAEjB,KAAK,QAAU,IAAIM,EAA8BP,CAAI,CACvD,CAsBA,MAAM,gBAAgBnB,EAA+D,CACnF,MAAMqB,EAAM,MAAM,KAAK,KAAK,KAA6B,yBAA0BrB,CAAI,EACvF,aAAM,KAAK,aAAa,UAAU,CAChC,YAAaqB,EAAI,aACjB,aAAcA,EAAI,cAClB,UAAWL,EAAeK,EAAI,UAAU,CAAA,CACzC,EACMA,CACT,CACF,CC7CO,MAAMO,CAAuB,CAClC,YAA+BT,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAOlD,MAAM,SAA0C,CAC9C,OAAO,KAAK,KAAK,IAA2B,oBAAoB,CAClE,CAOA,MAAM,cAAiD,CACrD,OAAO,KAAK,KAAK,IAA6B,yBAAyB,CACzE,CAQA,MAAM,qBACJnB,EACuC,CACvC,OAAO,KAAK,KAAK,KAAmC,6BAA8BA,CAAI,CACxF,CAQA,MAAM,iBAAiB6B,EAAyD,CAC9E,OAAO,KAAK,KAAK,IAAiC,6BAA6BA,CAAS,EAAE,CAC5F,CACF,CC/CO,MAAMC,CAAkB,CAC7B,YAA+BX,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAalD,MAAM,MAAMY,EAAmD,CAC7D,OAAO,KAAK,KAAK,IAA2B,sBAAsBA,CAAS,EAAE,CAC/E,CACF,CCmCO,SAASC,EAAKnC,EAA4C,CAC/D,MAAMoC,EAAUpC,EAAO,SAAW,2BAC5BqC,EAAUrC,EAAO,SAAW,IAAIkB,EAEhCK,EAAe,IAAIZ,EAAa,CACpC,QAAA0B,EACA,UAAW,MAAOrB,GAAiB,CACjC,MAAMQ,EAAM,MAAM,MAAM,GAAGY,CAAO,yBAA0B,CAC1D,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAA,EAC3B,KAAM,KAAK,UAAU,CAAE,cAAepB,EAAc,CAAA,CACrD,EACD,GAAI,CAACQ,EAAI,GAAI,MAAM,IAAI,MAAM,sBAAsB,EACnD,MAAMc,EAAQ,MAAMd,EAAI,KAAA,EAKxB,MAAO,CACL,YAAac,EAAK,aAClB,aAAcA,EAAK,cACnB,UAAWnB,EAAemB,EAAK,UAAU,CAAA,CAE7C,EACA,GAAItC,EAAO,gBAAkB,QAAa,CAAE,cAAeA,EAAO,aAAA,CAAc,CACjF,EAEKsB,EAAO,IAAIvB,EAAW,CAC1B,QAAAqC,EACA,eAAgB,IAAMb,EAAa,eAAA,EACnC,eAAgB,IAAMA,EAAa,mBAAA,CAAmB,CACvD,EAED,OAAO,IAAIgB,EAAcjB,EAAMC,EAAcvB,CAAM,CACrD,CASO,MAAMuC,CAAc,CAuBzB,YACkBC,EACAC,EACAC,EAChB,CAzBOjD,EAAA,eAGAA,EAAA,aAGAA,EAAA,iBAGAA,EAAA,eAGAA,EAAA,kBAGAA,EAAA,gBAGAA,EAAA,eAIS,KAAA,MAAA+C,EACA,KAAA,cAAAC,EACA,KAAA,QAAAC,EAEhB,KAAK,OAAS,IAAIjB,EAAuBe,CAAK,EAC9C,KAAK,KAAO,IAAInB,EAAqBmB,EAAOC,CAAa,EACzD,KAAK,SAAW,IAAIR,EAAkBO,CAAK,EAC3C,KAAK,OAAS,IAAIT,EAAuBS,CAAK,EAC9C,KAAK,UAAY,IAAIZ,EAA0BY,CAAK,EACpD,KAAK,QAAU,IAAId,EAAwBc,CAAK,EAChD,KAAK,OAAS,IAAIV,EAAuBU,EAAOC,CAAa,CAC/D,CACF,CChJA,MAAME,EAAsB,YA0BrB,SAASC,EAAoBC,EAAMF,EAAmC,CAC3E,MAAO,CACL,WAAiC,CAC/B,MAAMG,EAAM,aAAa,QAAQD,CAAG,EACpC,GAAI,CAACC,EAAK,OAAO,KACjB,GAAI,CACF,OAAO,KAAK,MAAMA,CAAG,CACvB,MAAQ,CAEN,OAAO,IACT,CACF,EACA,UAAU/B,EAA4B,CACpC,aAAa,QAAQ8B,EAAK,KAAK,UAAU9B,CAAM,CAAC,CAClD,EACA,aAAoB,CAClB,aAAa,WAAW8B,CAAG,CAC7B,CAAA,CAEJ,CC7CA,MAAMF,EAAsB,YA6BrB,SAASI,EAAsBF,EAAMF,EAAmC,CAC7E,MAAO,CACL,WAAiC,CAC/B,MAAMG,EAAM,eAAe,QAAQD,CAAG,EACtC,GAAI,CAACC,EAAK,OAAO,KACjB,GAAI,CACF,OAAO,KAAK,MAAMA,CAAG,CACvB,MAAQ,CAEN,OAAO,IACT,CACF,EACA,UAAU/B,EAA4B,CACpC,eAAe,QAAQ8B,EAAK,KAAK,UAAU9B,CAAM,CAAC,CACpD,EACA,aAAoB,CAClB,eAAe,WAAW8B,CAAG,CAC/B,CAAA,CAEJ"}
1
+ {"version":3,"file":"ledewire.min.js","sources":["../../core/src/base64.ts","../../core/src/errors.ts","../../core/src/http-client.ts","../../core/src/token-manager.ts","../src/resources/auth.ts","../src/resources/config.ts","../src/resources/content.ts","../src/resources/purchases.ts","../src/resources/seller/content.ts","../src/resources/seller/index.ts","../src/resources/wallet.ts","../src/resources/checkout.ts","../src/resources/user/api-keys.ts","../src/resources/user/index.ts","../src/client.ts","../src/web-storage-adapter.ts","../src/local-storage-adapter.ts","../src/session-storage-adapter.ts"],"sourcesContent":["/**\n * Decode a base64-encoded string to plain UTF-8 text.\n *\n * Used internally by SDK response handlers to transparently decode\n * `content_body` and `teaser` fields from the API wire format.\n *\n * @internal\n */\nexport function decodeBase64(value: string): string {\n return atob(value)\n}\n\n/**\n * Encode a plain UTF-8 string to base64.\n *\n * Used internally by SDK request handlers to re-encode plain-text\n * `content_body` and `teaser` fields before they are sent to the API.\n *\n * @internal\n */\nexport function encodeBase64(value: string): string {\n return btoa(value)\n}\n\n/**\n * Decode base64-encoded `content_body` and `teaser` fields on a content\n * response object. Works with both `ContentResponse` (which may carry\n * `content_body`) and `ContentListItem` (which only carries `teaser`).\n * Null and absent fields are left untouched.\n *\n * @internal\n */\nexport function decodeContentFields<\n T extends { content_body?: string | null; teaser?: string | null },\n>(item: T): T {\n return {\n ...item,\n ...(typeof item.content_body === 'string' && {\n content_body: decodeBase64(item.content_body),\n }),\n ...(typeof item.teaser === 'string' && { teaser: decodeBase64(item.teaser) }),\n } as T\n}\n\n/**\n * Encode plain-text `content_body` and `teaser` fields to base64 before\n * they are sent to the API. Absent and undefined fields are left untouched.\n *\n * @internal\n */\nexport function encodeContentFields<\n T extends {\n content_body?: string | undefined\n teaser?: string | undefined\n [key: string]: unknown\n },\n>(body: T): T {\n const out = { ...body } as Record<string, unknown>\n if (typeof out['content_body'] === 'string')\n out['content_body'] = encodeBase64(out['content_body'])\n if (typeof out['teaser'] === 'string') out['teaser'] = encodeBase64(out['teaser'])\n return out as T\n}\n","/**\n * Base error class for all LedeWire SDK errors.\n * All errors thrown by the SDK are instances of this class,\n * making it safe to use `err instanceof LedewireError` as a type guard.\n *\n * @example\n * ```ts\n * try {\n * await client.purchases.create({ contentId: '...' })\n * } catch (err) {\n * if (err instanceof LedewireError) {\n * console.error(err.statusCode, err.message)\n * }\n * }\n * ```\n */\nexport class LedewireError extends Error {\n /** HTTP status code returned by the API (e.g. 400, 401, 404, 422). */\n public readonly statusCode: number\n\n /** Machine-readable error code from the API error body, if present. */\n public readonly code: number | undefined\n\n constructor(message: string, statusCode: number, code?: number) {\n super(message)\n this.name = 'LedewireError'\n this.statusCode = statusCode\n this.code = code\n // Restore prototype chain (required for extending built-in Error in TS)\n Object.setPrototypeOf(this, new.target.prototype)\n }\n}\n\n/**\n * Thrown when the request lacks valid authentication credentials,\n * or when a token refresh fails and re-authentication is required.\n */\nexport class AuthError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 401, code)\n this.name = 'AuthError'\n }\n}\n\n/**\n * Thrown when the authenticated user does not have permission\n * to perform the requested operation.\n *\n * **Common cause — merchant login with the wrong account role:**\n * `POST /v1/auth/merchant/login/email` and `POST /v1/auth/merchant/login/google`\n * return `403 Forbidden` (not `401`) when the credentials are valid but the\n * account has no merchant store associations (e.g. a buyer account used on the\n * merchant endpoint). The `err.message` will be:\n * `\"This account does not have merchant access. Use a merchant or owner account.\"`\n *\n * Use a different account or ask a store owner to add your account as a member.\n *\n * @example\n * ```ts\n * // Browser\n * import { ForbiddenError, AuthError } from '@ledewire/browser'\n *\n * try {\n * await lw.auth.loginWithGoogle({ id_token })\n * } catch (err) {\n * if (err instanceof ForbiddenError) {\n * // Credentials were valid but account lacks the required role.\n * console.error('Access denied:', err.message)\n * } else if (err instanceof AuthError) {\n * // Bad credentials or expired token — re-authenticate.\n * console.error('Authentication failed:', err.message)\n * }\n * }\n * ```\n *\n * @example\n * ```ts\n * // Node\n * import { ForbiddenError, AuthError } from '@ledewire/node'\n *\n * try {\n * await client.merchant.auth.loginWithGoogle({ id_token })\n * } catch (err) {\n * if (err instanceof ForbiddenError) {\n * // Credentials were valid but account has no merchant store access.\n * // err.message → \"This account does not have merchant access. Use a merchant or owner account.\"\n * console.error('Wrong account role:', err.message)\n * } else if (err instanceof AuthError) {\n * // Bad credentials or expired token — re-authenticate.\n * console.error('Authentication failed:', err.message)\n * }\n * }\n * ```\n */\nexport class ForbiddenError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 403, code)\n this.name = 'ForbiddenError'\n }\n}\n\n/**\n * Thrown when the requested resource does not exist.\n */\nexport class NotFoundError extends LedewireError {\n constructor(message: string, code?: number) {\n super(message, 404, code)\n this.name = 'NotFoundError'\n }\n}\n\n/**\n * Thrown when the purchase cannot be completed due to a validation\n * failure, such as a price mismatch or a duplicate purchase.\n */\nexport class PurchaseError extends LedewireError {\n constructor(message: string, statusCode: number, code?: number) {\n super(message, statusCode, code)\n this.name = 'PurchaseError'\n }\n}\n","import type { components } from './api.gen.js'\nimport { AuthError, ForbiddenError, LedewireError, NotFoundError } from './errors.js'\n\n/** @internal */\ntype ApiErrorBody = components['schemas']['ErrorResponse']\n\n/**\n * Configuration options for `HttpClient`.\n */\nexport interface HttpClientConfig {\n /** API base URL. Defaults to the production API. */\n baseUrl?: string\n /**\n * Returns the current access token (or null) before each request.\n * If null, requests are sent without an Authorization header.\n */\n getAccessToken?: () => string | null | Promise<string | null>\n /**\n * Called when a 401 is received on the first attempt.\n * Should refresh and return the new access token, or null to propagate\n * an `AuthError` to the caller.\n */\n onUnauthorized?: () => string | null | Promise<string | null>\n}\n\n/** The default LedeWire API base URL used by all SDK packages. */\nexport const DEFAULT_BASE_URL = 'https://api.ledewire.com'\n\n/**\n * Core HTTP client used by all SDK packages.\n *\n * Features:\n * - Injects `Authorization: Bearer <token>` headers automatically\n * - Maps HTTP error responses to typed `LedewireError` subclasses\n * - On receiving a 401, calls `onUnauthorized` once and retries the request\n *\n * This is an internal class - consumers should use the\n * package-level client factories (`init` / `createClient`) instead.\n */\nexport class HttpClient {\n private readonly baseUrl: string\n private readonly getAccessToken: NonNullable<HttpClientConfig['getAccessToken']>\n private readonly onUnauthorized: NonNullable<HttpClientConfig['onUnauthorized']>\n\n constructor(config: HttpClientConfig = {}) {\n this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n this.getAccessToken = config.getAccessToken ?? (() => null)\n this.onUnauthorized = config.onUnauthorized ?? (() => null)\n }\n\n /**\n * GET request with optional query parameters.\n * @param path - API path (e.g. `/v1/wallet/balance`)\n * @param params - Query string parameters. `undefined` values are omitted; numbers are coerced to strings.\n */\n async get<T>(path: string, params?: Record<string, string | number | undefined>): Promise<T> {\n return this.request<T>('GET', this.buildUrl(path, params))\n }\n\n /**\n * POST request.\n * @param path - API path\n * @param body - Request body (JSON-serialized)\n * @param params - Optional query string parameters. `undefined` values are omitted; numbers are coerced to strings.\n */\n async post<T>(\n path: string,\n body?: unknown,\n params?: Record<string, string | number | undefined>,\n ): Promise<T> {\n return this.request<T>('POST', this.buildUrl(path, params), body)\n }\n\n /**\n * PUT request.\n * @param path - API path\n * @param body - Request body (JSON-serialized)\n */\n async put<T>(path: string, body?: unknown): Promise<T> {\n return this.request<T>('PUT', this.buildUrl(path), body)\n }\n\n /**\n * PATCH request.\n * @param path - API path\n * @param body - Partial update body (JSON-serialized)\n */\n async patch<T>(path: string, body?: unknown): Promise<T> {\n return this.request<T>('PATCH', this.buildUrl(path), body)\n }\n\n /**\n * DELETE request.\n * @param path - API path\n */\n async delete<T = void>(path: string): Promise<T> {\n return this.request<T>('DELETE', this.buildUrl(path))\n }\n\n // ---------------------------------------------------------------------------\n // Private helpers\n // ---------------------------------------------------------------------------\n\n private buildUrl(path: string, params?: Record<string, string | number | undefined>): string {\n const url = `${this.baseUrl}${path}`\n if (!params) return url\n const filtered = Object.entries(params).filter(\n (entry): entry is [string, string | number] => entry[1] !== undefined,\n )\n if (filtered.length === 0) return url\n const qs = new URLSearchParams(filtered.map(([k, v]) => [k, String(v)]))\n return `${url}?${qs.toString()}`\n }\n\n private async request<T>(\n method: string,\n url: string,\n body?: unknown,\n isRetry = false,\n ): Promise<T> {\n const token = await this.getAccessToken()\n const headers: Record<string, string> = {\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n }\n if (token) headers['Authorization'] = `Bearer ${token}`\n\n const response = await fetch(url, {\n method,\n headers,\n ...(body !== undefined && { body: JSON.stringify(body) }),\n })\n\n if (response.status === 401 && !isRetry) {\n const newToken = await this.onUnauthorized()\n if (newToken) {\n return this.request<T>(method, url, body, true)\n }\n throw new AuthError('Session expired. Please re-authenticate.')\n }\n\n if (!response.ok) {\n await this.throwApiError(response)\n }\n\n if (response.status === 204) {\n return undefined as T\n }\n\n return response.json() as Promise<T>\n }\n\n private async throwApiError(response: Response): Promise<never> {\n let body: ApiErrorBody | undefined\n try {\n body = (await response.json()) as ApiErrorBody\n } catch {\n // Non-JSON body - fall through to use statusText\n }\n\n const message = body?.error.message ?? response.statusText\n const code = body?.error.code\n\n switch (response.status) {\n case 401:\n throw new AuthError(message, code)\n case 403:\n throw new ForbiddenError(message, code)\n case 404:\n throw new NotFoundError(message, code)\n default:\n throw new LedewireError(message, response.status, code)\n }\n }\n}\n","import type { StoredTokens, TokenStorage } from './types.js'\nimport { AuthError } from './errors.js'\n\n/** How many milliseconds before expiry to proactively refresh the token. */\nconst REFRESH_THRESHOLD_MS = 60_000 // 60 seconds\n\n/**\n * Options for constructing a `TokenManager`.\n */\nexport interface TokenManagerOptions {\n storage: TokenStorage\n /**\n * Exchanges a refresh token for a new token pair.\n * Implemented by each package's client factory using the\n * `/v1/auth/token/refresh` endpoint.\n */\n refreshFn: (refreshToken: string) => Promise<StoredTokens>\n /**\n * Called after a successful background token refresh (not on initial login).\n * Use for side-effects only — e.g. audit logging, cache invalidation, or\n * notifying a secondary system when tokens rotate.\n *\n * **Do not use this for token persistence.** The `storage` adapter's\n * `setTokens` is the canonical persistence hook and is already called on\n * every refresh. Providing both will result in double-writes.\n *\n * @example\n * ```ts\n * onTokenRefreshed: async (tokens) => {\n * await auditLog.record('token_refreshed', { expiresAt: tokens.expiresAt })\n * }\n * ```\n */\n onTokenRefreshed?: (tokens: StoredTokens) => void | Promise<void>\n /**\n * Called when a refresh attempt fails and the user must re-authenticate.\n * Typically used to redirect to login or emit a UI event.\n *\n * @example\n * ```ts\n * onAuthExpired: () => { window.location.href = '/login' }\n * ```\n */\n onAuthExpired?: () => void | Promise<void>\n}\n\n/**\n * Manages the JWT token lifecycle transparently.\n *\n * - Proactively refreshes the access token when it expires within 60 seconds\n * - Handles reactive refresh on 401 responses from the HTTP client\n * - Deduplicates concurrent refresh calls (only one in-flight refresh at a time)\n * - Fires `onAuthExpired` when refresh fails so the UI can prompt re-login\n *\n * This is an internal class - use the package-level client factories instead.\n */\nexport class TokenManager {\n private readonly storage: TokenStorage\n private readonly refreshFn: TokenManagerOptions['refreshFn']\n private readonly onTokenRefreshed: TokenManagerOptions['onTokenRefreshed']\n private readonly onAuthExpired: TokenManagerOptions['onAuthExpired']\n private refreshPromise: Promise<StoredTokens | null> | null = null\n\n constructor(options: TokenManagerOptions) {\n this.storage = options.storage\n this.refreshFn = options.refreshFn\n this.onTokenRefreshed = options.onTokenRefreshed\n this.onAuthExpired = options.onAuthExpired\n }\n\n /**\n * Returns a valid access token, refreshing proactively if needed.\n * Returns `null` if no tokens are stored (user not authenticated).\n */\n async getAccessToken(): Promise<string | null> {\n const stored = await this.storage.getTokens()\n if (!stored) return null\n\n const expiresInMs = stored.expiresAt - Date.now()\n if (expiresInMs < REFRESH_THRESHOLD_MS) {\n const refreshed = await this.performRefresh(stored.refreshToken)\n return refreshed?.accessToken ?? null\n }\n\n return stored.accessToken\n }\n\n /**\n * Called by `HttpClient` when a 401 is received.\n * Attempts one refresh; returns the new access token or null.\n */\n async handleUnauthorized(): Promise<string | null> {\n const stored = await this.storage.getTokens()\n if (!stored) {\n await this.onAuthExpired?.()\n return null\n }\n const refreshed = await this.performRefresh(stored.refreshToken)\n if (!refreshed) await this.onAuthExpired?.()\n return refreshed?.accessToken ?? null\n }\n\n /** Store new tokens after a successful login or signup. */\n async setTokens(tokens: StoredTokens): Promise<void> {\n await this.storage.setTokens(tokens)\n }\n\n /** Clear all stored tokens (call on logout). */\n async clearTokens(): Promise<void> {\n await this.storage.clearTokens()\n }\n\n // ---------------------------------------------------------------------------\n // Private\n // ---------------------------------------------------------------------------\n\n private performRefresh(refreshToken: string): Promise<StoredTokens | null> {\n if (this.refreshPromise) return this.refreshPromise\n\n this.refreshPromise = this.refreshFn(refreshToken)\n .then(async (tokens) => {\n await this.storage.setTokens(tokens)\n await this.onTokenRefreshed?.(tokens)\n return tokens\n })\n .catch((_err: unknown) => {\n void this.storage.clearTokens()\n throw new AuthError('Token refresh failed. Please re-authenticate.')\n })\n .finally(() => {\n this.refreshPromise = null\n })\n\n return this.refreshPromise\n }\n}\n\n// ---------------------------------------------------------------------------\n// Built-in storage adapters\n// ---------------------------------------------------------------------------\n\n/**\n * In-memory token storage (default for both packages).\n * Tokens are cleared when the page unloads or the process exits.\n * This is the most secure default for browser environments.\n */\nexport class MemoryTokenStorage implements TokenStorage {\n private tokens: StoredTokens | null = null\n\n getTokens(): StoredTokens | null {\n return this.tokens\n }\n\n setTokens(tokens: StoredTokens): void {\n this.tokens = tokens\n }\n\n clearTokens(): void {\n this.tokens = null\n }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Converts an `expires_at` ISO 8601 string from an API auth response\n * into a Unix timestamp (milliseconds) for use in `StoredTokens.expiresAt`.\n *\n * @param expiresAt - ISO 8601 datetime string, e.g. `\"2026-01-01T12:00:00Z\"`\n * @returns Unix timestamp in milliseconds\n */\nexport function parseExpiresAt(expiresAt: string): number {\n return new Date(expiresAt).getTime()\n}\n\n/**\n * Creates the standard LedeWire token refresh function for use with `TokenManager`.\n *\n * Encapsulates the `/v1/auth/token/refresh` fetch call, response mapping, and\n * error handling so both `createClient` (node) and `init` (browser) share a\n * single implementation.\n *\n * @param baseUrl - The resolved API base URL (e.g. `'https://api.ledewire.com'`)\n * @returns A `refreshFn` compatible with `TokenManagerOptions['refreshFn']`\n */\nexport function createRefreshFn(baseUrl: string): TokenManagerOptions['refreshFn'] {\n return async (refreshToken: string): Promise<StoredTokens> => {\n const res = await fetch(`${baseUrl}/v1/auth/token/refresh`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ refresh_token: refreshToken }),\n })\n if (!res.ok) throw new Error('Token refresh failed')\n const data = (await res.json()) as {\n access_token: string\n refresh_token: string\n expires_at: string\n }\n return {\n accessToken: data.access_token,\n refreshToken: data.refresh_token,\n expiresAt: parseExpiresAt(data.expires_at),\n }\n }\n}\n","/**\n * Buyer authentication namespace for browser environments.\n *\n * Handles buyer signup, email/password login, Google OAuth, and password reset.\n * Tokens are stored automatically in the `TokenManager` after every\n * successful call — callers never need to manage tokens directly.\n *\n * For seller/API key authentication, use {@link BrowserSellerNamespace.loginWithApiKey}\n * via `lw.seller.loginWithApiKey()`.\n *\n * @module\n */\nimport { parseExpiresAt } from '@ledewire/core'\nimport type { HttpClient, TokenManager } from '@ledewire/core'\nimport type {\n AuthLoginEmailRequest,\n AuthLoginBuyerApiKeyRequest,\n AuthLoginOAuthRequest,\n AuthPasswordResetBody,\n AuthPasswordResetRequestBody,\n AuthPasswordResetResponse,\n AuthSignupRequest,\n AuthenticationResponse,\n} from '@ledewire/core'\n\n/**\n * Buyer authentication: signup, email/password login, Google OAuth, password reset.\n *\n * Obtain via `lw.auth` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * await lw.auth.loginWithEmail({ email: 'u@example.com', password: 'pw' })\n * ```\n */\nexport class BrowserAuthNamespace {\n /** @internal */\n constructor(\n private readonly http: HttpClient,\n private readonly tokenManager: TokenManager,\n ) {}\n\n /**\n * Register a new buyer account with email and password.\n * Tokens are stored automatically after successful signup.\n *\n * @param body - Signup credentials and display name.\n * @returns The authentication token response.\n */\n async signup(body: AuthSignupRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/signup', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Log in with email and password.\n * Tokens are stored automatically after successful login.\n *\n * @param body - Email and password credentials.\n * @returns The authentication token response.\n */\n async loginWithEmail(body: AuthLoginEmailRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/email', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Log in with a Google ID token obtained from the Google OAuth flow.\n * Tokens are stored automatically after successful login.\n *\n * @param body - The Google ID token.\n * @returns The authentication token response.\n */\n async loginWithGoogle(body: AuthLoginOAuthRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/google', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Log in using a buyer API key and secret.\n * Returns a buyer-scoped JWT, stored automatically after successful authentication.\n *\n * Primarily useful when building buyer-facing dashboards where the user\n * has created a named API key and wishes to authenticate with it programmatically,\n * or for agent workflows running inside a browser context.\n *\n * @param body - The buyer API key and secret.\n * @returns The authentication token response.\n *\n * @example\n * ```ts\n * await lw.auth.loginWithBuyerApiKey({\n * key: 'bktst_abc123',\n * secret: 'deadbeef...',\n * })\n * ```\n */\n async loginWithBuyerApiKey(body: AuthLoginBuyerApiKeyRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/buyer-api-key', body)\n await this.storeTokens(res)\n return res\n }\n\n /**\n * Request a password reset code to be sent to the buyer's email address.\n *\n * The response is intentionally ambiguous — if the email does not exist,\n * the API returns the same success message to prevent account enumeration.\n *\n * @param body - The buyer's email address.\n * @returns A response with a confirmation message.\n *\n * @example\n * ```ts\n * await lw.auth.requestPasswordReset({ email: 'buyer@example.com' })\n * // → { data: { message: 'If an account with this email exists, a reset code has been sent.' } }\n * ```\n */\n async requestPasswordReset(\n body: AuthPasswordResetRequestBody,\n ): Promise<AuthPasswordResetResponse> {\n return this.http.post<AuthPasswordResetResponse>('/v1/auth/password/reset-request', body)\n }\n\n /**\n * Reset a buyer's password using the code delivered to their email.\n *\n * Obtain the reset code first by calling `requestPasswordReset()`.\n *\n * @param body - Email address, 6-digit reset code, and the new password.\n * @returns A response with a confirmation message.\n *\n * @example\n * ```ts\n * await lw.auth.resetPassword({\n * email: 'buyer@example.com',\n * reset_code: '123456',\n * password: 'new-secure-password',\n * })\n * ```\n */\n async resetPassword(body: AuthPasswordResetBody): Promise<AuthPasswordResetResponse> {\n return this.http.post<AuthPasswordResetResponse>('/v1/auth/password/reset', body)\n }\n\n private async storeTokens(res: AuthenticationResponse): Promise<void> {\n await this.tokenManager.setTokens({\n accessToken: res.access_token,\n refreshToken: res.refresh_token,\n expiresAt: parseExpiresAt(res.expires_at),\n })\n }\n}\n","/**\n * Platform configuration namespace (browser).\n *\n * Provides access to public (unauthenticated) platform-level configuration.\n *\n * @module\n */\nimport type { HttpClient } from '@ledewire/core'\nimport type { PublicConfigResponse } from '@ledewire/core'\n\n/**\n * Platform-level configuration for browser clients.\n *\n * Obtain via `client.config` — do not construct directly.\n */\nexport class BrowserConfigNamespace {\n /** @internal */\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns platform-level public configuration.\n * No authentication required — safe to call before the user has signed in.\n *\n * Use `google_client_id` to initialise the Google Identity Services library\n * on the storefront login page without requiring a prior authenticated call.\n *\n * @example\n * ```ts\n * const lw = init({ apiKey: 'your_api_key' })\n * const { google_client_id } = await lw.config.getPublic()\n * google.accounts.id.initialize({ client_id: google_client_id, callback })\n * ```\n */\n async getPublic(): Promise<PublicConfigResponse> {\n return this.http.get<PublicConfigResponse>('/v1/config/public')\n }\n}\n","import { decodeContentFields } from '@ledewire/core'\nimport type { HttpClient } from '@ledewire/core'\nimport type { ContentWithAccessResponse } from '@ledewire/core'\n\n/**\n * Buyer content namespace — fetch content with real-time access information.\n *\n * Obtain via `lw.content` — do not construct directly.\n *\n * @example\n * ```ts\n * const result = await lw.content.getWithAccess('content-id')\n * if (result.access_info.next_required_action === 'view_content') {\n * renderMarkdown(result.content_body ?? '')\n * }\n * ```\n */\nexport class BrowserContentNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns a content item together with access information for the\n * authenticated buyer (or a generic access response when unauthenticated).\n *\n * @param id - The content ID.\n * @returns The content item with access information. `content_body` and\n * `teaser` are returned as plain UTF-8 text — the SDK decodes base64\n * transparently so you can render them directly.\n *\n * @example\n * ```ts\n * const result = await lw.content.getWithAccess('article-123')\n * if (result.access_info.next_required_action === 'view_content') {\n * renderMarkdown(result.content_body ?? '')\n * }\n * ```\n */\n async getWithAccess(id: string): Promise<ContentWithAccessResponse> {\n const res = await this.http.get<ContentWithAccessResponse>(\n `/v1/content/${encodeURIComponent(id)}/with-access`,\n )\n return decodeContentFields(res)\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type { PurchaseCreateRequest, PurchaseResponse } from '@ledewire/core'\n\n/**\n * Buyer purchases namespace — create and retrieve content purchases.\n *\n * Obtain via `lw.purchases` — do not construct directly.\n *\n * @example\n * ```ts\n * await lw.purchases.create({ content_id: 'content-id' })\n * const all = await lw.purchases.list()\n * ```\n */\nexport class BrowserPurchasesNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Completes a content purchase using the buyer's wallet balance.\n *\n * @param body - The content ID and expected price in cents.\n * @returns The completed purchase record.\n */\n async create(body: PurchaseCreateRequest): Promise<PurchaseResponse> {\n return this.http.post<PurchaseResponse>('/v1/purchases', body)\n }\n\n /**\n * Returns all purchases made by the authenticated buyer.\n *\n * @returns A list of purchase records, newest first.\n */\n async list(): Promise<PurchaseResponse[]> {\n return this.http.get<PurchaseResponse[]>('/v1/purchases')\n }\n\n /**\n * Returns a single purchase by ID.\n *\n * @param id - The purchase ID.\n * @returns The purchase record.\n */\n async get(id: string): Promise<PurchaseResponse> {\n return this.http.get<PurchaseResponse>(`/v1/purchases/${encodeURIComponent(id)}`)\n }\n}\n","/**\n * Seller content namespace for browser environments.\n *\n * Read-only operations using a view-permission API key token.\n * Hits the `/v1/seller/content` family of endpoints — store identity is\n * derived server-side from the token, so no `store_id` is required.\n *\n * @module\n */\nimport { decodeContentFields } from '@ledewire/core'\nimport type { HttpClient } from '@ledewire/core'\nimport type { ContentResponse } from '@ledewire/core'\n\n/**\n * Search criteria for seller content search.\n * At least one field must be supplied. All supplied fields must match (AND logic).\n */\nexport interface SellerContentSearchRequest {\n /** Case-insensitive partial match against the content title. */\n title?: string\n /** Case-insensitive partial match against the content URI (`external_ref` content only). */\n uri?: string\n /**\n * Exact match against the content's external identifier.\n * Use the full formatted value as it appears in `ContentResponse.external_identifier`,\n * e.g. `'vimeo:123456789'`.\n */\n external_identifier?: string\n /** Exact key/value pairs to AND-match against content metadata. */\n metadata?: Record<string, unknown>\n}\n\n/**\n * Seller content namespace — list, search, and fetch store content by API key.\n *\n * Obtain via `lw.seller.content` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n *\n * const items = await lw.seller.content.list()\n * const results = await lw.seller.content.search({ title: 'intro' })\n * const item = await lw.seller.content.get('content-id')\n * ```\n */\nexport class BrowserSellerContentNamespace {\n /** @internal */\n constructor(private readonly http: HttpClient) {}\n\n /**\n * List all content for the authenticated seller's store.\n * Requires a token with at least `view` permission.\n *\n * @returns Array of content items. `teaser` is returned as plain text —\n * the SDK decodes base64 automatically.\n *\n * @example\n * ```ts\n * const items = await lw.seller.content.list()\n * ```\n */\n async list(): Promise<ContentResponse[]> {\n const res = await this.http.get<ContentResponse[]>('/v1/seller/content')\n return res.map(decodeContentFields)\n }\n\n /**\n * Search content by title, URI, and/or metadata (AND logic).\n * At least one criterion must be supplied.\n * Requires a token with at least `view` permission.\n *\n * @param body - Search criteria (title, uri, and/or metadata).\n * @returns Array of matching content items. `teaser` is returned as plain\n * text — the SDK decodes base64 automatically.\n *\n * @example\n * ```ts\n * const results = await lw.seller.content.search({ title: 'intro' })\n * const byUri = await lw.seller.content.search({ uri: 'vimeo.com' })\n * const byId = await lw.seller.content.search({ external_identifier: 'vimeo:123456789' })\n * const byMeta = await lw.seller.content.search({ metadata: { author: 'Alice' } })\n * ```\n */\n async search(body: SellerContentSearchRequest): Promise<ContentResponse[]> {\n const res = await this.http.post<ContentResponse[]>('/v1/seller/content/search', body)\n return res.map(decodeContentFields)\n }\n\n /**\n * Get a single content item by ID.\n * Requires a token with at least `view` permission.\n *\n * @param id - The content ID.\n * @returns The content item. `content_body` and `teaser` are returned as\n * plain UTF-8 text — the SDK decodes base64 automatically so you can render\n * them directly without calling `atob()`.\n *\n * @example\n * ```ts\n * const item = await lw.seller.content.get('content-id')\n * // item.content_body is plain markdown — no atob() needed\n * ```\n */\n async get(id: string): Promise<ContentResponse> {\n const res = await this.http.get<ContentResponse>(`/v1/seller/content/${encodeURIComponent(id)}`)\n return decodeContentFields(res)\n }\n}\n","/**\n * Browser seller namespace — API-key-authenticated read operations.\n *\n * @module\n */\nimport { parseExpiresAt } from '@ledewire/core'\nimport type { HttpClient, TokenManager } from '@ledewire/core'\nimport type { AuthLoginApiKeyRequest, AuthenticationResponse } from '@ledewire/core'\nimport { BrowserSellerContentNamespace } from './content.js'\n\n/**\n * Seller operations accessible with a view-permission API key token.\n *\n * Obtain via `lw.seller` — do not construct directly.\n *\n * @example\n * ```ts\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n *\n * // Authenticate as a seller (key-only = view; key+secret = full)\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n * const items = await lw.seller.content.list()\n * ```\n */\nexport class BrowserSellerNamespace {\n /** Seller content: list, search, and get by API key. */\n readonly content: BrowserSellerContentNamespace\n\n /** @internal */\n constructor(\n private readonly http: HttpClient,\n private readonly tokenManager: TokenManager,\n ) {\n this.content = new BrowserSellerContentNamespace(http)\n }\n\n /**\n * Log in using an API key to obtain a seller token.\n * Provide only `key` for read-only (`view`) access.\n * Provide both `key` and `secret` for read/write (`full`) access.\n * Tokens are stored automatically after successful authentication.\n *\n * Use this before calling `lw.seller.content.*` methods.\n *\n * @param body - API key credentials.\n * @returns The authentication token response.\n *\n * @example\n * ```ts\n * // View access (read-only) — sufficient for seller.content.list/search/get\n * await lw.seller.loginWithApiKey({ key: 'your_api_key' })\n *\n * // Full access (read/write)\n * await lw.seller.loginWithApiKey({ key: 'your_api_key', secret: 'your_secret' })\n * ```\n */\n async loginWithApiKey(body: AuthLoginApiKeyRequest): Promise<AuthenticationResponse> {\n const res = await this.http.post<AuthenticationResponse>('/v1/auth/login/api-key', body)\n await this.tokenManager.setTokens({\n accessToken: res.access_token,\n refreshToken: res.refresh_token,\n expiresAt: parseExpiresAt(res.expires_at),\n })\n return res\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type {\n WalletBalanceResponse,\n WalletPaymentSessionRequest,\n WalletPaymentSessionResponse,\n WalletPaymentStatusResponse,\n WalletTransactionItem,\n} from '@ledewire/core'\n\n/**\n * Buyer wallet namespace — balance, transactions, and payment session management.\n *\n * Obtain via `lw.wallet` — do not construct directly.\n *\n * @example\n * ```ts\n * const { balance_cents } = await lw.wallet.balance()\n * const session = await lw.wallet.createPaymentSession({ amount_cents: 500 })\n * ```\n */\nexport class BrowserWalletNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns the authenticated buyer's current wallet balance.\n *\n * @returns The current wallet balance in cents.\n */\n async balance(): Promise<WalletBalanceResponse> {\n return this.http.get<WalletBalanceResponse>('/v1/wallet/balance')\n }\n\n /**\n * Returns the authenticated buyer's wallet transaction history, newest first.\n *\n * @returns A list of completed wallet transaction entries.\n */\n async transactions(): Promise<WalletTransactionItem[]> {\n return this.http.get<WalletTransactionItem[]>('/v1/wallet/transactions')\n }\n\n /**\n * Creates a payment session for funding the buyer's wallet.\n *\n * @param body - The amount and currency to fund.\n * @returns Payment session details for use with the payment provider widget.\n */\n async createPaymentSession(\n body: WalletPaymentSessionRequest,\n ): Promise<WalletPaymentSessionResponse> {\n return this.http.post<WalletPaymentSessionResponse>('/v1/wallet/payment-session', body)\n }\n\n /**\n * Polls the status of a wallet funding payment session.\n *\n * @param sessionId - The session ID returned by `createPaymentSession`.\n * @returns The current payment status.\n */\n async getPaymentStatus(sessionId: string): Promise<WalletPaymentStatusResponse> {\n return this.http.get<WalletPaymentStatusResponse>(\n `/v1/wallet/payment-status/${encodeURIComponent(sessionId)}`,\n )\n }\n}\n","import type { HttpClient } from '@ledewire/core'\nimport type { CheckoutStateResponse } from '@ledewire/core'\n\n/**\n * Checkout namespace — buyer checkout state for a specific content item.\n *\n * Obtain via `lw.checkout` — do not construct directly.\n *\n * @example\n * ```ts\n * const state = await lw.checkout.state('content-id')\n * // state.checkout_state.next_required_action:\n * // 'authenticate' | 'fund_wallet' | 'purchase' | 'view_content'\n * ```\n */\nexport class CheckoutNamespace {\n constructor(protected readonly http: HttpClient) {}\n\n /**\n * Returns the authenticated buyer's checkout readiness for a given piece of\n * content. Indicates whether the buyer needs to authenticate, fund their\n * wallet, or purchase before accessing the content.\n *\n * Works without authentication — returns anonymous checkout state when the\n * buyer is not logged in.\n *\n * @param contentId - The content item ID.\n * @returns The checkout state, including what action is required next.\n */\n async state(contentId: string): Promise<CheckoutStateResponse> {\n return this.http.get<CheckoutStateResponse>(\n `/v1/checkout/state/${encodeURIComponent(contentId)}`,\n )\n }\n}\n","/**\n * Buyer API key management namespace.\n *\n * @module\n */\nimport type { HttpClient } from '@ledewire/core'\nimport type { UserApiKey, UserApiKeyCreateRequest, UserApiKeyCreateResponse } from '@ledewire/core'\n\n/**\n * Manage buyer API keys for the authenticated user.\n *\n * Buyer API keys are the authentication credential for autonomous agents — they\n * allow an agent to obtain a buyer JWT via `auth.loginWithBuyerApiKey()` without\n * requiring a username and password. Each key is named, independently revocable,\n * and can carry an optional `spending_limit_cents` ceiling.\n *\n * **Secret handling:** `create()` returns the `secret` exactly once. It is never\n * retrievable again after the response is received — store it immediately in a\n * secrets manager (e.g. environment variable, Vault, AWS Secrets Manager).\n *\n * Obtain via `client.user.apiKeys` — do not construct directly.\n *\n * @example\n * ```ts\n * // Create a key for an agent, with a $10 spend ceiling\n * const { key, secret } = await client.user.apiKeys.create({\n * name: 'my-rag-agent',\n * spending_limit_cents: 1000,\n * })\n * // Store secret immediately — it cannot be retrieved again\n * await secretsManager.put('LEDEWIRE_BUYER_SECRET', secret)\n *\n * // List all keys (secrets never included)\n * const keys = await client.user.apiKeys.list()\n *\n * // Revoke a compromised key\n * await client.user.apiKeys.revoke(keys[0].id)\n * ```\n */\nexport class UserApiKeysNamespace {\n /** @internal */\n constructor(private readonly http: HttpClient) {}\n\n /**\n * Returns all buyer API keys for the authenticated user.\n * The `secret` is never included in list responses.\n *\n * @returns Array of API key records.\n */\n async list(): Promise<UserApiKey[]> {\n return this.http.get<UserApiKey[]>('/v1/user/api-keys')\n }\n\n /**\n * Creates a new buyer API key.\n *\n * The `secret` in the response is shown exactly once and cannot be retrieved\n * again. Store it immediately in a secrets manager before discarding the\n * response object.\n *\n * @param body - Name and optional spend ceiling for the new key.\n * @returns The new key's public identifier and one-time secret.\n *\n * @example\n * ```ts\n * const { key, secret } = await client.user.apiKeys.create({\n * name: 'production-agent',\n * spending_limit_cents: 5000, // $50 cap\n * })\n * // ⚠️ Store secret NOW — it is shown once only\n * process.env.LEDEWIRE_BUYER_SECRET = secret\n * ```\n */\n async create(body: UserApiKeyCreateRequest): Promise<UserApiKeyCreateResponse> {\n return this.http.post<UserApiKeyCreateResponse>('/v1/user/api-keys', body)\n }\n\n /**\n * Revokes (permanently deletes) a buyer API key by ID.\n *\n * Any agent currently using this key will receive `401` on its next\n * token refresh. Revocation takes effect immediately.\n *\n * @param id - UUID of the API key to revoke.\n */\n async revoke(id: string): Promise<void> {\n return this.http.delete(`/v1/user/api-keys/${encodeURIComponent(id)}`)\n }\n}\n","/**\n * User namespace — authenticated buyer account operations.\n *\n * @module\n */\nimport type { HttpClient } from '@ledewire/core'\nimport { UserApiKeysNamespace } from './api-keys.js'\n\n/**\n * Authenticated buyer account operations.\n *\n * Obtain via `client.user` — do not construct directly.\n */\nexport class UserNamespace {\n /**\n * Buyer API key management: create, list, and revoke named API keys.\n * Keys are used by autonomous agents to authenticate without a username/password.\n */\n readonly apiKeys: UserApiKeysNamespace\n\n /** @internal */\n constructor(http: HttpClient) {\n this.apiKeys = new UserApiKeysNamespace(http)\n }\n}\n","import {\n DEFAULT_BASE_URL,\n HttpClient,\n MemoryTokenStorage,\n TokenManager,\n createRefreshFn,\n} from '@ledewire/core'\nimport type { TokenStorage } from '@ledewire/core'\nimport { BrowserAuthNamespace } from './resources/auth.js'\nimport { BrowserConfigNamespace } from './resources/config.js'\nimport { BrowserContentNamespace } from './resources/content.js'\nimport { BrowserPurchasesNamespace } from './resources/purchases.js'\nimport { BrowserSellerNamespace } from './resources/seller/index.js'\nimport { BrowserWalletNamespace } from './resources/wallet.js'\nimport { CheckoutNamespace } from './resources/checkout.js'\nimport { UserNamespace } from './resources/user/index.js'\n\n/**\n * Configuration options for the LedeWire browser client.\n */\nexport interface BrowserClientConfig {\n /**\n * LedeWire API key that identifies the store.\n * Obtained from the LedeWire merchant dashboard.\n */\n apiKey: string\n /**\n * Override the API base URL.\n * Defaults to `https://api.ledewire.com`.\n */\n baseUrl?: string\n /**\n * Token storage adapter.\n * Defaults to {@link MemoryTokenStorage} (in-memory, most secure).\n *\n * To persist sessions across page reloads, use the built-in\n * `localStorageAdapter`:\n * ```ts\n * import { init, localStorageAdapter } from '@ledewire/browser'\n * const lw = init({ apiKey: '...', storage: localStorageAdapter() })\n * ```\n */\n storage?: TokenStorage\n /**\n * Called when the user's session expires and cannot be refreshed.\n * Use this to show a re-authentication prompt.\n *\n * @example\n * ```ts\n * onAuthExpired: () => showLoginModal()\n * ```\n */\n onAuthExpired?: () => void\n}\n\n/**\n * Initialises a LedeWire browser client.\n * This is the primary entry point for the browser SDK.\n *\n * @example CDN usage:\n * ```html\n * <script src=\"https://cdn.jsdelivr.net/npm/@ledewire/browser@1/dist/ledewire.min.js\"></script>\n * <script>\n * const lw = Ledewire.init({ apiKey: 'your_api_key' })\n * const state = await lw.checkout.state('content-id')\n * </script>\n * ```\n *\n * @example npm usage:\n * ```ts\n * import { init } from '@ledewire/browser'\n * const lw = init({ apiKey: 'your_api_key' })\n * ```\n */\nexport function init(config: BrowserClientConfig): BrowserClient {\n const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL\n const storage = config.storage ?? new MemoryTokenStorage()\n\n const tokenManager = new TokenManager({\n storage,\n refreshFn: createRefreshFn(baseUrl),\n ...(config.onAuthExpired !== undefined && { onAuthExpired: config.onAuthExpired }),\n })\n\n const http = new HttpClient({\n baseUrl,\n getAccessToken: () => tokenManager.getAccessToken(),\n onUnauthorized: () => tokenManager.handleUnauthorized(),\n })\n\n return new BrowserClient(http, tokenManager, config)\n}\n\n/**\n * The LedeWire browser client.\n * Access buyer flows through the namespaced properties.\n *\n * @remarks\n * Instantiate with {@link init} rather than constructing directly.\n */\nexport class BrowserClient {\n /** Platform-level public configuration (no auth required) */\n readonly config: BrowserConfigNamespace\n\n /** Buyer authentication: email/password signup/login, Google OAuth, password reset */\n readonly auth: BrowserAuthNamespace\n\n /** Checkout state machine: determines next action for a piece of content */\n readonly checkout: CheckoutNamespace\n\n /** Wallet: balance, fund via payment session, transaction history */\n readonly wallet: BrowserWalletNamespace\n\n /** Content purchases for the authenticated buyer */\n readonly purchases: BrowserPurchasesNamespace\n\n /** Public content with per-user access information */\n readonly content: BrowserContentNamespace\n\n /** Seller operations: API key login, content list/search/get */\n readonly seller: BrowserSellerNamespace\n\n /** Authenticated buyer account: API key management */\n readonly user: UserNamespace\n\n /** @internal */\n constructor(\n private readonly _http: HttpClient,\n private readonly _tokenManager: TokenManager,\n private readonly _config: BrowserClientConfig,\n ) {\n this.config = new BrowserConfigNamespace(_http)\n this.auth = new BrowserAuthNamespace(_http, _tokenManager)\n this.checkout = new CheckoutNamespace(_http)\n this.wallet = new BrowserWalletNamespace(_http)\n this.purchases = new BrowserPurchasesNamespace(_http)\n this.content = new BrowserContentNamespace(_http)\n this.seller = new BrowserSellerNamespace(_http, _tokenManager)\n this.user = new UserNamespace(_http)\n }\n}\n","import type { TokenStorage, StoredTokens } from '@ledewire/core'\n\nconst DEFAULT_STORAGE_KEY = 'lw:tokens'\n\n/**\n * Shared implementation for `localStorage` and `sessionStorage` adapters.\n * Not exported from the public API — use {@link localStorageAdapter} or\n * {@link sessionStorageAdapter} instead.\n *\n * @internal\n */\nexport function webStorageAdapter(backend: Storage, key = DEFAULT_STORAGE_KEY): TokenStorage {\n return {\n getTokens(): StoredTokens | null {\n const raw = backend.getItem(key)\n if (!raw) return null\n try {\n return JSON.parse(raw) as StoredTokens\n } catch {\n // Corrupted value — treat as empty\n return null\n }\n },\n setTokens(tokens: StoredTokens): void {\n backend.setItem(key, JSON.stringify(tokens))\n },\n clearTokens(): void {\n backend.removeItem(key)\n },\n }\n}\n","import type { TokenStorage } from '@ledewire/core'\nimport { webStorageAdapter } from './web-storage-adapter.js'\n\n/**\n * A {@link TokenStorage} adapter that persists tokens in `localStorage`.\n *\n * Tokens survive page reloads and browser restarts, which is convenient\n * for sites where users expect persistent sessions.\n *\n * **Security note:** `localStorage` is accessible to any JavaScript on the\n * same origin. Only use this adapter on sites you fully control and trust.\n * The default in-memory storage is safer for high-security use cases.\n *\n * @param key - The `localStorage` key used to store tokens.\n * Defaults to `'lw:tokens'`. Override this if you have multiple\n * LedeWire integrations on the same origin.\n *\n * @example\n * ```ts\n * import { init, localStorageAdapter } from '@ledewire/browser'\n *\n * const lw = init({\n * apiKey: 'your_api_key',\n * storage: localStorageAdapter(),\n * })\n * ```\n */\nexport function localStorageAdapter(key?: string): TokenStorage {\n return webStorageAdapter(localStorage, key)\n}\n","import type { TokenStorage } from '@ledewire/core'\nimport { webStorageAdapter } from './web-storage-adapter.js'\n\n/**\n * A {@link TokenStorage} adapter that persists tokens in `sessionStorage`.\n *\n * Tokens survive page reloads within the same tab but are cleared when the\n * tab is closed or the session ends. This prevents token leakage across\n * tabs and is a good default for sites where users do not expect persistent\n * sessions (e.g. embedded checkout widgets, kiosk-mode UIs).\n *\n * **Security note:** `sessionStorage` is accessible to any JavaScript on the\n * same origin and tab. It is more isolated than `localStorage` (no\n * cross-tab sharing), but the default in-memory storage is still safer for\n * high-security use cases.\n *\n * @param key - The `sessionStorage` key used to store tokens.\n * Defaults to `'lw:tokens'`. Override this if you have multiple\n * LedeWire integrations on the same origin.\n *\n * @example\n * ```ts\n * import { init, sessionStorageAdapter } from '@ledewire/browser'\n *\n * const lw = init({\n * apiKey: 'your_api_key',\n * storage: sessionStorageAdapter(),\n * })\n * ```\n */\nexport function sessionStorageAdapter(key?: string): TokenStorage {\n return webStorageAdapter(sessionStorage, key)\n}\n"],"names":["decodeBase64","value","decodeContentFields","item","LedewireError","message","statusCode","code","__publicField","AuthError","ForbiddenError","NotFoundError","PurchaseError","DEFAULT_BASE_URL","HttpClient","config","path","params","body","url","filtered","entry","qs","k","v","method","isRetry","token","headers","response","REFRESH_THRESHOLD_MS","TokenManager","options","stored","refreshed","tokens","refreshToken","_err","MemoryTokenStorage","parseExpiresAt","expiresAt","createRefreshFn","baseUrl","res","data","BrowserAuthNamespace","http","tokenManager","BrowserConfigNamespace","BrowserContentNamespace","id","BrowserPurchasesNamespace","BrowserSellerContentNamespace","BrowserSellerNamespace","BrowserWalletNamespace","sessionId","CheckoutNamespace","contentId","UserApiKeysNamespace","UserNamespace","init","storage","BrowserClient","_http","_tokenManager","_config","DEFAULT_STORAGE_KEY","webStorageAdapter","backend","key","raw","localStorageAdapter","sessionStorageAdapter"],"mappings":"2MAQO,SAASA,EAAaC,EAAuB,CAClD,OAAO,KAAKA,CAAK,CACnB,CAsBO,SAASC,EAEdC,EAAY,CACZ,MAAO,CACL,GAAGA,EACH,GAAI,OAAOA,EAAK,cAAiB,UAAY,CAC3C,aAAcH,EAAaG,EAAK,YAAY,CAAA,EAE9C,GAAI,OAAOA,EAAK,QAAW,UAAY,CAAE,OAAQH,EAAaG,EAAK,MAAM,CAAA,CAAE,CAE/E,CC1BO,MAAMC,UAAsB,KAAM,CAOvC,YAAYC,EAAiBC,EAAoBC,EAAe,CAC9D,MAAMF,CAAO,EANCG,EAAA,mBAGAA,EAAA,aAId,KAAK,KAAO,gBACZ,KAAK,WAAaF,EAClB,KAAK,KAAOC,EAEZ,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,CAMO,MAAME,UAAkBL,CAAc,CAC3C,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,WACd,CACF,CAoDO,MAAMG,UAAuBN,CAAc,CAChD,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,gBACd,CACF,CAKO,MAAMI,UAAsBP,CAAc,CAC/C,YAAYC,EAAiBE,EAAe,CAC1C,MAAMF,EAAS,IAAKE,CAAI,EACxB,KAAK,KAAO,eACd,CACF,CAMO,MAAMK,UAAsBR,CAAc,CAC/C,YAAYC,EAAiBC,EAAoBC,EAAe,CAC9D,MAAMF,EAASC,EAAYC,CAAI,EAC/B,KAAK,KAAO,eACd,CACF,CC9FO,MAAMM,EAAmB,2BAazB,MAAMC,CAAW,CAKtB,YAAYC,EAA2B,GAAI,CAJ1BP,EAAA,gBACAA,EAAA,uBACAA,EAAA,uBAGf,KAAK,SAAWO,EAAO,SAAWF,GAAkB,QAAQ,MAAO,EAAE,EACrE,KAAK,eAAiBE,EAAO,iBAAmB,IAAM,MACtD,KAAK,eAAiBA,EAAO,iBAAmB,IAAM,KACxD,CAOA,MAAM,IAAOC,EAAcC,EAAkE,CAC3F,OAAO,KAAK,QAAW,MAAO,KAAK,SAASD,EAAMC,CAAM,CAAC,CAC3D,CAQA,MAAM,KACJD,EACAE,EACAD,EACY,CACZ,OAAO,KAAK,QAAW,OAAQ,KAAK,SAASD,EAAMC,CAAM,EAAGC,CAAI,CAClE,CAOA,MAAM,IAAOF,EAAcE,EAA4B,CACrD,OAAO,KAAK,QAAW,MAAO,KAAK,SAASF,CAAI,EAAGE,CAAI,CACzD,CAOA,MAAM,MAASF,EAAcE,EAA4B,CACvD,OAAO,KAAK,QAAW,QAAS,KAAK,SAASF,CAAI,EAAGE,CAAI,CAC3D,CAMA,MAAM,OAAiBF,EAA0B,CAC/C,OAAO,KAAK,QAAW,SAAU,KAAK,SAASA,CAAI,CAAC,CACtD,CAMQ,SAASA,EAAcC,EAA8D,CAC3F,MAAME,EAAM,GAAG,KAAK,OAAO,GAAGH,CAAI,GAClC,GAAI,CAACC,EAAQ,OAAOE,EACpB,MAAMC,EAAW,OAAO,QAAQH,CAAM,EAAE,OACrCI,GAA8CA,EAAM,CAAC,IAAM,MAAA,EAE9D,GAAID,EAAS,SAAW,EAAG,OAAOD,EAClC,MAAMG,EAAK,IAAI,gBAAgBF,EAAS,IAAI,CAAC,CAACG,EAAGC,CAAC,IAAM,CAACD,EAAG,OAAOC,CAAC,CAAC,CAAC,CAAC,EACvE,MAAO,GAAGL,CAAG,IAAIG,EAAG,UAAU,EAChC,CAEA,MAAc,QACZG,EACAN,EACAD,EACAQ,EAAU,GACE,CACZ,MAAMC,EAAQ,MAAM,KAAK,eAAA,EACnBC,EAAkC,CACtC,eAAgB,mBAChB,OAAQ,kBAAA,EAEND,IAAOC,EAAQ,cAAmB,UAAUD,CAAK,IAErD,MAAME,EAAW,MAAM,MAAMV,EAAK,CAChC,OAAAM,EACA,QAAAG,EACA,GAAIV,IAAS,QAAa,CAAE,KAAM,KAAK,UAAUA,CAAI,CAAA,CAAE,CACxD,EAED,GAAIW,EAAS,SAAW,KAAO,CAACH,EAAS,CAEvC,GADiB,MAAM,KAAK,eAAA,EAE1B,OAAO,KAAK,QAAWD,EAAQN,EAAKD,EAAM,EAAI,EAEhD,MAAM,IAAIT,EAAU,0CAA0C,CAChE,CAMA,GAJKoB,EAAS,IACZ,MAAM,KAAK,cAAcA,CAAQ,EAG/BA,EAAS,SAAW,IAIxB,OAAOA,EAAS,KAAA,CAClB,CAEA,MAAc,cAAcA,EAAoC,CAC9D,IAAIX,EACJ,GAAI,CACFA,EAAQ,MAAMW,EAAS,KAAA,CACzB,MAAQ,CAER,CAEA,MAAMxB,EAAUa,GAAM,MAAM,SAAWW,EAAS,WAC1CtB,EAAOW,GAAM,MAAM,KAEzB,OAAQW,EAAS,OAAA,CACf,IAAK,KACH,MAAM,IAAIpB,EAAUJ,EAASE,CAAI,EACnC,IAAK,KACH,MAAM,IAAIG,EAAeL,EAASE,CAAI,EACxC,IAAK,KACH,MAAM,IAAII,EAAcN,EAASE,CAAI,EACvC,QACE,MAAM,IAAIH,EAAcC,EAASwB,EAAS,OAAQtB,CAAI,CAAA,CAE5D,CACF,CC1KA,MAAMuB,EAAuB,IAoDtB,MAAMC,CAAa,CAOxB,YAAYC,EAA8B,CANzBxB,EAAA,gBACAA,EAAA,kBACAA,EAAA,yBACAA,EAAA,sBACTA,EAAA,sBAAsD,MAG5D,KAAK,QAAUwB,EAAQ,QACvB,KAAK,UAAYA,EAAQ,UACzB,KAAK,iBAAmBA,EAAQ,iBAChC,KAAK,cAAgBA,EAAQ,aAC/B,CAMA,MAAM,gBAAyC,CAC7C,MAAMC,EAAS,MAAM,KAAK,QAAQ,UAAA,EAClC,OAAKA,EAEeA,EAAO,UAAY,KAAK,IAAA,EAC1BH,GACE,MAAM,KAAK,eAAeG,EAAO,YAAY,IAC7C,aAAe,KAG5BA,EAAO,YARM,IAStB,CAMA,MAAM,oBAA6C,CACjD,MAAMA,EAAS,MAAM,KAAK,QAAQ,UAAA,EAClC,GAAI,CAACA,EACH,aAAM,KAAK,gBAAA,EACJ,KAET,MAAMC,EAAY,MAAM,KAAK,eAAeD,EAAO,YAAY,EAC/D,OAAKC,GAAW,MAAM,KAAK,gBAAA,EACpBA,GAAW,aAAe,IACnC,CAGA,MAAM,UAAUC,EAAqC,CACnD,MAAM,KAAK,QAAQ,UAAUA,CAAM,CACrC,CAGA,MAAM,aAA6B,CACjC,MAAM,KAAK,QAAQ,YAAA,CACrB,CAMQ,eAAeC,EAAoD,CACzE,OAAI,KAAK,eAAuB,KAAK,gBAErC,KAAK,eAAiB,KAAK,UAAUA,CAAY,EAC9C,KAAK,MAAOD,IACX,MAAM,KAAK,QAAQ,UAAUA,CAAM,EACnC,MAAM,KAAK,mBAAmBA,CAAM,EAC7BA,EACR,EACA,MAAOE,GAAkB,CACxB,MAAK,KAAK,QAAQ,YAAA,EACZ,IAAI5B,EAAU,+CAA+C,CACrE,CAAC,EACA,QAAQ,IAAM,CACb,KAAK,eAAiB,IACxB,CAAC,EAEI,KAAK,eACd,CACF,CAWO,MAAM6B,CAA2C,CAAjD,cACG9B,EAAA,cAA8B,MAEtC,WAAiC,CAC/B,OAAO,KAAK,MACd,CAEA,UAAU2B,EAA4B,CACpC,KAAK,OAASA,CAChB,CAEA,aAAoB,CAClB,KAAK,OAAS,IAChB,CACF,CAaO,SAASI,EAAeC,EAA2B,CACxD,OAAO,IAAI,KAAKA,CAAS,EAAE,QAAA,CAC7B,CAYO,SAASC,EAAgBC,EAAmD,CACjF,MAAO,OAAON,GAAgD,CAC5D,MAAMO,EAAM,MAAM,MAAM,GAAGD,CAAO,yBAA0B,CAC1D,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAA,EAC3B,KAAM,KAAK,UAAU,CAAE,cAAeN,EAAc,CAAA,CACrD,EACD,GAAI,CAACO,EAAI,GAAI,MAAM,IAAI,MAAM,sBAAsB,EACnD,MAAMC,EAAQ,MAAMD,EAAI,KAAA,EAKxB,MAAO,CACL,YAAaC,EAAK,aAClB,aAAcA,EAAK,cACnB,UAAWL,EAAeK,EAAK,UAAU,CAAA,CAE7C,CACF,CC1KO,MAAMC,CAAqB,CAEhC,YACmBC,EACAC,EACjB,CAFiB,KAAA,KAAAD,EACA,KAAA,aAAAC,CAChB,CASH,MAAM,OAAO7B,EAA0D,CACrE,MAAMyB,EAAM,MAAM,KAAK,KAAK,KAA6B,kBAAmBzB,CAAI,EAChF,aAAM,KAAK,YAAYyB,CAAG,EACnBA,CACT,CASA,MAAM,eAAezB,EAA8D,CACjF,MAAMyB,EAAM,MAAM,KAAK,KAAK,KAA6B,uBAAwBzB,CAAI,EACrF,aAAM,KAAK,YAAYyB,CAAG,EACnBA,CACT,CASA,MAAM,gBAAgBzB,EAA8D,CAClF,MAAMyB,EAAM,MAAM,KAAK,KAAK,KAA6B,wBAAyBzB,CAAI,EACtF,aAAM,KAAK,YAAYyB,CAAG,EACnBA,CACT,CAqBA,MAAM,qBAAqBzB,EAAoE,CAC7F,MAAMyB,EAAM,MAAM,KAAK,KAAK,KAA6B,+BAAgCzB,CAAI,EAC7F,aAAM,KAAK,YAAYyB,CAAG,EACnBA,CACT,CAiBA,MAAM,qBACJzB,EACoC,CACpC,OAAO,KAAK,KAAK,KAAgC,kCAAmCA,CAAI,CAC1F,CAmBA,MAAM,cAAcA,EAAiE,CACnF,OAAO,KAAK,KAAK,KAAgC,0BAA2BA,CAAI,CAClF,CAEA,MAAc,YAAYyB,EAA4C,CACpE,MAAM,KAAK,aAAa,UAAU,CAChC,YAAaA,EAAI,aACjB,aAAcA,EAAI,cAClB,UAAWJ,EAAeI,EAAI,UAAU,CAAA,CACzC,CACH,CACF,CC7IO,MAAMK,CAAuB,CAElC,YAA+BF,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAgBlD,MAAM,WAA2C,CAC/C,OAAO,KAAK,KAAK,IAA0B,mBAAmB,CAChE,CACF,CCnBO,MAAMG,CAAwB,CACnC,YAA+BH,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAmBlD,MAAM,cAAcI,EAAgD,CAClE,MAAMP,EAAM,MAAM,KAAK,KAAK,IAC1B,eAAe,mBAAmBO,CAAE,CAAC,cAAA,EAEvC,OAAOhD,EAAoByC,CAAG,CAChC,CACF,CC7BO,MAAMQ,CAA0B,CACrC,YAA+BL,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAQlD,MAAM,OAAO5B,EAAwD,CACnE,OAAO,KAAK,KAAK,KAAuB,gBAAiBA,CAAI,CAC/D,CAOA,MAAM,MAAoC,CACxC,OAAO,KAAK,KAAK,IAAwB,eAAe,CAC1D,CAQA,MAAM,IAAIgC,EAAuC,CAC/C,OAAO,KAAK,KAAK,IAAsB,iBAAiB,mBAAmBA,CAAE,CAAC,EAAE,CAClF,CACF,CCEO,MAAME,CAA8B,CAEzC,YAA6BN,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAchD,MAAM,MAAmC,CAEvC,OADY,MAAM,KAAK,KAAK,IAAuB,oBAAoB,GAC5D,IAAI5C,CAAmB,CACpC,CAmBA,MAAM,OAAOgB,EAA8D,CAEzE,OADY,MAAM,KAAK,KAAK,KAAwB,4BAA6BA,CAAI,GAC1E,IAAIhB,CAAmB,CACpC,CAiBA,MAAM,IAAIgD,EAAsC,CAC9C,MAAMP,EAAM,MAAM,KAAK,KAAK,IAAqB,sBAAsB,mBAAmBO,CAAE,CAAC,EAAE,EAC/F,OAAOhD,EAAoByC,CAAG,CAChC,CACF,CCrFO,MAAMU,CAAuB,CAKlC,YACmBP,EACAC,EACjB,CANOvC,EAAA,gBAIU,KAAA,KAAAsC,EACA,KAAA,aAAAC,EAEjB,KAAK,QAAU,IAAIK,EAA8BN,CAAI,CACvD,CAsBA,MAAM,gBAAgB5B,EAA+D,CACnF,MAAMyB,EAAM,MAAM,KAAK,KAAK,KAA6B,yBAA0BzB,CAAI,EACvF,aAAM,KAAK,aAAa,UAAU,CAChC,YAAayB,EAAI,aACjB,aAAcA,EAAI,cAClB,UAAWJ,EAAeI,EAAI,UAAU,CAAA,CACzC,EACMA,CACT,CACF,CC7CO,MAAMW,CAAuB,CAClC,YAA+BR,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAOlD,MAAM,SAA0C,CAC9C,OAAO,KAAK,KAAK,IAA2B,oBAAoB,CAClE,CAOA,MAAM,cAAiD,CACrD,OAAO,KAAK,KAAK,IAA6B,yBAAyB,CACzE,CAQA,MAAM,qBACJ5B,EACuC,CACvC,OAAO,KAAK,KAAK,KAAmC,6BAA8BA,CAAI,CACxF,CAQA,MAAM,iBAAiBqC,EAAyD,CAC9E,OAAO,KAAK,KAAK,IACf,6BAA6B,mBAAmBA,CAAS,CAAC,EAAA,CAE9D,CACF,CCjDO,MAAMC,CAAkB,CAC7B,YAA+BV,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAalD,MAAM,MAAMW,EAAmD,CAC7D,OAAO,KAAK,KAAK,IACf,sBAAsB,mBAAmBA,CAAS,CAAC,EAAA,CAEvD,CACF,CCKO,MAAMC,CAAqB,CAEhC,YAA6BZ,EAAkB,CAAlB,KAAA,KAAAA,CAAmB,CAQhD,MAAM,MAA8B,CAClC,OAAO,KAAK,KAAK,IAAkB,mBAAmB,CACxD,CAsBA,MAAM,OAAO5B,EAAkE,CAC7E,OAAO,KAAK,KAAK,KAA+B,oBAAqBA,CAAI,CAC3E,CAUA,MAAM,OAAOgC,EAA2B,CACtC,OAAO,KAAK,KAAK,OAAO,qBAAqB,mBAAmBA,CAAE,CAAC,EAAE,CACvE,CACF,CC3EO,MAAMS,CAAc,CAQzB,YAAYb,EAAkB,CAHrBtC,EAAA,gBAIP,KAAK,QAAU,IAAIkD,EAAqBZ,CAAI,CAC9C,CACF,CCkDO,SAASc,EAAK7C,EAA4C,CAC/D,MAAM2B,EAAU3B,EAAO,SAAWF,EAC5BgD,EAAU9C,EAAO,SAAW,IAAIuB,EAEhCS,EAAe,IAAIhB,EAAa,CACpC,QAAA8B,EACA,UAAWpB,EAAgBC,CAAO,EAClC,GAAI3B,EAAO,gBAAkB,QAAa,CAAE,cAAeA,EAAO,aAAA,CAAc,CACjF,EAEK+B,EAAO,IAAIhC,EAAW,CAC1B,QAAA4B,EACA,eAAgB,IAAMK,EAAa,eAAA,EACnC,eAAgB,IAAMA,EAAa,mBAAA,CAAmB,CACvD,EAED,OAAO,IAAIe,EAAchB,EAAMC,EAAchC,CAAM,CACrD,CASO,MAAM+C,CAAc,CA0BzB,YACmBC,EACAC,EACAC,EACjB,CA5BOzD,EAAA,eAGAA,EAAA,aAGAA,EAAA,iBAGAA,EAAA,eAGAA,EAAA,kBAGAA,EAAA,gBAGAA,EAAA,eAGAA,EAAA,aAIU,KAAA,MAAAuD,EACA,KAAA,cAAAC,EACA,KAAA,QAAAC,EAEjB,KAAK,OAAS,IAAIjB,EAAuBe,CAAK,EAC9C,KAAK,KAAO,IAAIlB,EAAqBkB,EAAOC,CAAa,EACzD,KAAK,SAAW,IAAIR,EAAkBO,CAAK,EAC3C,KAAK,OAAS,IAAIT,EAAuBS,CAAK,EAC9C,KAAK,UAAY,IAAIZ,EAA0BY,CAAK,EACpD,KAAK,QAAU,IAAId,EAAwBc,CAAK,EAChD,KAAK,OAAS,IAAIV,EAAuBU,EAAOC,CAAa,EAC7D,KAAK,KAAO,IAAIL,EAAcI,CAAK,CACrC,CACF,CC1IA,MAAMG,EAAsB,YASrB,SAASC,EAAkBC,EAAkBC,EAAMH,EAAmC,CAC3F,MAAO,CACL,WAAiC,CAC/B,MAAMI,EAAMF,EAAQ,QAAQC,CAAG,EAC/B,GAAI,CAACC,EAAK,OAAO,KACjB,GAAI,CACF,OAAO,KAAK,MAAMA,CAAG,CACvB,MAAQ,CAEN,OAAO,IACT,CACF,EACA,UAAUnC,EAA4B,CACpCiC,EAAQ,QAAQC,EAAK,KAAK,UAAUlC,CAAM,CAAC,CAC7C,EACA,aAAoB,CAClBiC,EAAQ,WAAWC,CAAG,CACxB,CAAA,CAEJ,CCHO,SAASE,EAAoBF,EAA4B,CAC9D,OAAOF,EAAkB,aAAcE,CAAG,CAC5C,CCCO,SAASG,EAAsBH,EAA4B,CAChE,OAAOF,EAAkB,eAAgBE,CAAG,CAC9C"}
package/llms.txt CHANGED
@@ -105,15 +105,18 @@ lw.config.getPublic() → Promise<PublicConfigResponse>
105
105
  ### lw.auth (buyer auth)
106
106
 
107
107
  ```ts
108
- lw.auth.signup(body) → Promise<AuthenticationResponse>
109
- lw.auth.loginWithEmail({ email, password }) → Promise<AuthenticationResponse>
110
- lw.auth.loginWithGoogle({ id_token }) → Promise<AuthenticationResponse>
111
- lw.auth.logout() → Promise<void>
112
- lw.auth.requestPasswordReset({ email }) → Promise<AuthPasswordResetResponse>
113
- lw.auth.resetPassword({ email, reset_code, password }) → Promise<AuthPasswordResetResponse>
108
+ lw.auth.signup(body) → Promise<AuthenticationResponse>
109
+ lw.auth.loginWithEmail({ email, password }) → Promise<AuthenticationResponse>
110
+ lw.auth.loginWithGoogle({ id_token }) → Promise<AuthenticationResponse>
111
+ lw.auth.loginWithBuyerApiKey({ key, secret }) → Promise<AuthenticationResponse>
112
+ lw.auth.logout() → Promise<void>
113
+ lw.auth.requestPasswordReset({ email }) → Promise<AuthPasswordResetResponse>
114
+ lw.auth.resetPassword({ email, reset_code, password }) → Promise<AuthPasswordResetResponse>
114
115
  ```
115
116
 
116
117
  Tokens are stored automatically after every successful login.
118
+ `loginWithBuyerApiKey` is useful in buyer dashboards where the user has created a
119
+ named API key and wants to authenticate headlessly (without email/password).
117
120
 
118
121
  ### lw.checkout
119
122
 
@@ -175,6 +178,21 @@ lw.content.getWithAccess(contentId: string) → Promise<ContentWithAccessRespons
175
178
  // content_uri: URL for external_ref content (Vimeo, YouTube, PDF, etc.)
176
179
  ```
177
180
 
181
+ ### lw.user
182
+
183
+ Manage buyer API keys from a buyer-facing dashboard. Keys can be passed to
184
+ `lw.auth.loginWithBuyerApiKey()` for headless authentication.
185
+
186
+ ```ts
187
+ lw.user.apiKeys.list() → Promise<UserApiKey[]>
188
+ lw.user.apiKeys.create(body) → Promise<UserApiKeyCreateResponse>
189
+ lw.user.apiKeys.revoke(keyId) → Promise<void>
190
+ ```
191
+
192
+ The `secret` field in the create response is shown **once** — display it
193
+ immediately in the UI and prompt the user to copy it. There is no way to retrieve
194
+ it again.
195
+
178
196
  ### lw.seller
179
197
 
180
198
  Operations scoped to the authenticated seller's store.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ledewire/browser",
3
- "version": "0.6.0",
3
+ "version": "0.7.0",
4
4
  "description": "LedeWire SDK for browsers — embed a paywall with a single script tag",
5
5
  "type": "module",
6
6
  "exports": {