@thorprovider/medusa-extended 1.11.6 → 1.11.8

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse } from '@thorprovider/types';
+import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse, TokenVerifyResult, RecoveryConfirmResult } from '@thorprovider/types';
 
 /**
  * @fileoverview Medusa Multi-Tenant Admin Client
@@ -228,6 +228,28 @@ declare class DropshipperClient {
     private logger;
     constructor(config: DropshipperClientConfig);
     private request;
+    /**
+     * Resolve multiple entities in a single request.
+     *
+     * `POST /admin/thor/dropshipper/query`
+     *
+     * Entities are resolved in parallel (per layer) and errors are isolated per
+     * entity: `response.errors[key]` holds the per-entity error while the rest
+     * of `data` still resolves. `data[key]` is an array (list entities) or a
+     * single object (singular entities such as account, balance, me).
+     *
+     * @example
+     * ```typescript
+     * const { data } = await client.query({
+     *   entities: [
+     *     { entity: 'capabilities' },
+     *     { entity: 'me' },
+     *     { entity: 'account' },
+     *   ],
+     * });
+     * ```
+     */
+    query(input: QueryEntitiesInput): Promise<QueryResponse>;
     /**
      * Fetch dashboard capabilities from the backend.
      *
@@ -808,4 +830,100 @@ declare class DropshipperClient {
     getGeoCities(code: string): Promise<GetGeoCitiesResponse>;
 }
 
-export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig };
+/**
+ * @fileoverview Recovery Client — Thor Commerce Extended
+ * @module @thorprovider/medusa-extended/recovery
+ *
+ * Public HTTP client for account-recovery flows (password reset + activation).
+ *
+ * Unlike `DropshipperClient`, this client does NOT require a JWT: it talks to
+ * public storefront endpoints so a user can recover access without being
+ * logged in. Backend URLs are owned here; the dashboard never builds them.
+ *
+ * Endpoints:
+ *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
+ *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
+ *
+ * Confirm methods follow the two-phase contract: verify (no consume) first,
+ * then confirm (atomic consume). A re-verify after a failed confirm maps the
+ * TOCTOU state (used/expired/revoked) into `RecoveryConfirmResult.status`.
+ */
+
+/**
+ * Configuration required to instantiate the recovery client.
+ */
+interface RecoveryClientConfig {
+    /** Medusa backend base URL */
+    baseUrl: string;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * HTTP client for account-recovery endpoints (public, no auth required).
+ *
+ * All methods throw `ProviderAPIError` on non-2xx responses except the
+ * confirm methods, which normalize failures into `RecoveryConfirmResult`.
+ *
+ * @example
+ * ```typescript
+ * const client = new RecoveryClient({
+ *   baseUrl: process.env.MEDUSA_BACKEND_URL!,
+ * });
+ *
+ * await client.requestUserPasswordReset('juan@ejemplo.com');
+ * const result = await client.verifyUserPasswordResetToken(token);
+ * const confirm = await client.confirmUserPasswordReset(token, 'NuevaClave1');
+ * ```
+ */
+declare class RecoveryClient {
+    private baseUrl;
+    private logger;
+    constructor(config: RecoveryClientConfig);
+    private request;
+    /**
+     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+     *
+     * The JWT is unsigned-trust for this claim: the email is later sent to
+     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+     * token signature and payload before applying the change.
+     */
+    private decodeResetTokenEmail;
+    /**
+     * Solicita un email de reset de contraseña para el actor `user`
+     * (dropshippers). El backend responde de forma uniforme exista o no la
+     * cuenta (anti enumeración).
+     *
+     * `POST /auth/user/emailpass/reset-password`
+     */
+    requestUserPasswordReset(email: string): Promise<void>;
+    /**
+     * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+     * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+     *
+     * `GET /store/dropshipper/auth/reset-password/verify`
+     */
+    verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     */
+    confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+     *
+     * `GET /store/dropshipper/applications/activate/verify`
+     */
+    verifyActivationToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /store/dropshipper/applications/activate` y establece la
+     * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+     */
+    activateAccount(token: string, password: string): Promise<RecoveryConfirmResult>;
+}
+
+export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig, RecoveryClient, type RecoveryClientConfig };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse } from '@thorprovider/types';
+import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse, TokenVerifyResult, RecoveryConfirmResult } from '@thorprovider/types';
 
 /**
  * @fileoverview Medusa Multi-Tenant Admin Client
@@ -228,6 +228,28 @@ declare class DropshipperClient {
     private logger;
     constructor(config: DropshipperClientConfig);
     private request;
+    /**
+     * Resolve multiple entities in a single request.
+     *
+     * `POST /admin/thor/dropshipper/query`
+     *
+     * Entities are resolved in parallel (per layer) and errors are isolated per
+     * entity: `response.errors[key]` holds the per-entity error while the rest
+     * of `data` still resolves. `data[key]` is an array (list entities) or a
+     * single object (singular entities such as account, balance, me).
+     *
+     * @example
+     * ```typescript
+     * const { data } = await client.query({
+     *   entities: [
+     *     { entity: 'capabilities' },
+     *     { entity: 'me' },
+     *     { entity: 'account' },
+     *   ],
+     * });
+     * ```
+     */
+    query(input: QueryEntitiesInput): Promise<QueryResponse>;
     /**
      * Fetch dashboard capabilities from the backend.
      *
@@ -808,4 +830,100 @@ declare class DropshipperClient {
     getGeoCities(code: string): Promise<GetGeoCitiesResponse>;
 }
 
-export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig };
+/**
+ * @fileoverview Recovery Client — Thor Commerce Extended
+ * @module @thorprovider/medusa-extended/recovery
+ *
+ * Public HTTP client for account-recovery flows (password reset + activation).
+ *
+ * Unlike `DropshipperClient`, this client does NOT require a JWT: it talks to
+ * public storefront endpoints so a user can recover access without being
+ * logged in. Backend URLs are owned here; the dashboard never builds them.
+ *
+ * Endpoints:
+ *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
+ *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
+ *
+ * Confirm methods follow the two-phase contract: verify (no consume) first,
+ * then confirm (atomic consume). A re-verify after a failed confirm maps the
+ * TOCTOU state (used/expired/revoked) into `RecoveryConfirmResult.status`.
+ */
+
+/**
+ * Configuration required to instantiate the recovery client.
+ */
+interface RecoveryClientConfig {
+    /** Medusa backend base URL */
+    baseUrl: string;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * HTTP client for account-recovery endpoints (public, no auth required).
+ *
+ * All methods throw `ProviderAPIError` on non-2xx responses except the
+ * confirm methods, which normalize failures into `RecoveryConfirmResult`.
+ *
+ * @example
+ * ```typescript
+ * const client = new RecoveryClient({
+ *   baseUrl: process.env.MEDUSA_BACKEND_URL!,
+ * });
+ *
+ * await client.requestUserPasswordReset('juan@ejemplo.com');
+ * const result = await client.verifyUserPasswordResetToken(token);
+ * const confirm = await client.confirmUserPasswordReset(token, 'NuevaClave1');
+ * ```
+ */
+declare class RecoveryClient {
+    private baseUrl;
+    private logger;
+    constructor(config: RecoveryClientConfig);
+    private request;
+    /**
+     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+     *
+     * The JWT is unsigned-trust for this claim: the email is later sent to
+     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+     * token signature and payload before applying the change.
+     */
+    private decodeResetTokenEmail;
+    /**
+     * Solicita un email de reset de contraseña para el actor `user`
+     * (dropshippers). El backend responde de forma uniforme exista o no la
+     * cuenta (anti enumeración).
+     *
+     * `POST /auth/user/emailpass/reset-password`
+     */
+    requestUserPasswordReset(email: string): Promise<void>;
+    /**
+     * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+     * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+     *
+     * `GET /store/dropshipper/auth/reset-password/verify`
+     */
+    verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     */
+    confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+     *
+     * `GET /store/dropshipper/applications/activate/verify`
+     */
+    verifyActivationToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /store/dropshipper/applications/activate` y establece la
+     * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+     */
+    activateAccount(token: string, password: string): Promise<RecoveryConfirmResult>;
+}
+
+export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig, RecoveryClient, type RecoveryClientConfig };

package/dist/index.js

@@ -21,7 +21,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   DropshipperClient: () => DropshipperClient,
-  MedusaAdminClient: () => MedusaAdminClient
+  MedusaAdminClient: () => MedusaAdminClient,
+  RecoveryClient: () => RecoveryClient
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -430,6 +431,37 @@ var DropshipperClient = class {
     return response.json();
   }
   // -------------------------------------------------------------------------
+  // Unified Query
+  // -------------------------------------------------------------------------
+  /**
+   * Resolve multiple entities in a single request.
+   *
+   * `POST /admin/thor/dropshipper/query`
+   *
+   * Entities are resolved in parallel (per layer) and errors are isolated per
+   * entity: `response.errors[key]` holds the per-entity error while the rest
+   * of `data` still resolves. `data[key]` is an array (list entities) or a
+   * single object (singular entities such as account, balance, me).
+   *
+   * @example
+   * ```typescript
+   * const { data } = await client.query({
+   *   entities: [
+   *     { entity: 'capabilities' },
+   *     { entity: 'me' },
+   *     { entity: 'account' },
+   *   ],
+   * });
+   * ```
+   */
+  async query(input) {
+    return this.request(
+      "POST",
+      "/admin/thor/dropshipper/query",
+      input
+    );
+  }
+  // -------------------------------------------------------------------------
   // Capabilities
   // -------------------------------------------------------------------------
   /**
@@ -1869,9 +1901,180 @@ function mapUiMessageStreamToEvents(stream, logger) {
     }
   });
 }
+
+// src/recovery.ts
+var import_adapters4 = require("@thorprovider/adapters");
+var RecoveryClient = class {
+  baseUrl;
+  logger;
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.logger = (0, import_adapters4.createLogger)("RecoveryClient", config.debug);
+  }
+  // -------------------------------------------------------------------------
+  // Private — HTTP helper
+  // -------------------------------------------------------------------------
+  async request(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    this.logger.debug(`[recovery] ${method} ${path}`);
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const init = {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    };
+    let response;
+    try {
+      response = await fetchBackendWithResilience(url, init);
+    } catch (networkError) {
+      throw new import_adapters4.ProviderAPIError(
+        `[recovery] Network error on ${method} ${path}: ${networkError.message}`,
+        "NETWORK_ERROR",
+        networkError
+      );
+    }
+    if (!response.ok) {
+      let message = `HTTP ${response.status}`;
+      try {
+        const json = await response.json();
+        message = json?.message ?? message;
+      } catch {
+      }
+      throw new import_adapters4.ProviderAPIError(
+        `[recovery] ${method} ${path} failed: ${message}`,
+        `RECOVERY_API_${response.status}`,
+        response.status
+      );
+    }
+    return response.json();
+  }
+  // -------------------------------------------------------------------------
+  // Private — reset token helpers
+  // -------------------------------------------------------------------------
+  /**
+   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+   *
+   * The JWT is unsigned-trust for this claim: the email is later sent to
+   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+   * token signature and payload before applying the change.
+   */
+  decodeResetTokenEmail(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+      return typeof payload.entity_id === "string" && payload.entity_id.length > 0 ? payload.entity_id : null;
+    } catch {
+      return null;
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Password reset
+  // -------------------------------------------------------------------------
+  /**
+   * Solicita un email de reset de contraseña para el actor `user`
+   * (dropshippers). El backend responde de forma uniforme exista o no la
+   * cuenta (anti enumeración).
+   *
+   * `POST /auth/user/emailpass/reset-password`
+   */
+  async requestUserPasswordReset(email) {
+    await this.request("POST", "/auth/user/emailpass/reset-password", {
+      identifier: email
+    });
+  }
+  /**
+   * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+   * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+   *
+   * `GET /store/dropshipper/auth/reset-password/verify`
+   */
+  async verifyUserPasswordResetToken(token) {
+    return this.request("GET", `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+  }
+  /**
+   * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   */
+  async confirmUserPasswordReset(token, password) {
+    const verify = await this.verifyUserPasswordResetToken(token);
+    if (verify.status !== "valid") {
+      return { ok: false, status: verify.status };
+    }
+    const email = this.decodeResetTokenEmail(token);
+    if (!email) {
+      return { ok: false, status: "invalid" };
+    }
+    try {
+      const headers = {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      };
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ email, password })
+      });
+      if (!response.ok) {
+        throw new import_adapters4.ProviderAPIError(
+          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          "RECOVERY_API_" + response.status,
+          response.status
+        );
+      }
+      return { ok: true };
+    } catch (error) {
+      this.logger.warn("[recovery] confirmUserPasswordReset failed, re-verifying", error);
+      try {
+        const recheck = await this.verifyUserPasswordResetToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: "invalid" };
+      }
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Account activation
+  // -------------------------------------------------------------------------
+  /**
+   * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+   *
+   * `GET /store/dropshipper/applications/activate/verify`
+   */
+  async verifyActivationToken(token) {
+    return this.request("GET", `/store/dropshipper/applications/activate/verify?token=${encodeURIComponent(token)}`);
+  }
+  /**
+   * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /store/dropshipper/applications/activate` y establece la
+   * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+   */
+  async activateAccount(token, password) {
+    const verify = await this.verifyActivationToken(token);
+    if (verify.status !== "valid") {
+      return { ok: false, status: verify.status };
+    }
+    try {
+      await this.request("POST", "/store/dropshipper/applications/activate", { token, password });
+      return { ok: true };
+    } catch (error) {
+      this.logger.warn("[recovery] activateAccount failed, re-verifying", error);
+      try {
+        const recheck = await this.verifyActivationToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: "invalid" };
+      }
+    }
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DropshipperClient,
-  MedusaAdminClient
+  MedusaAdminClient,
+  RecoveryClient
 });
 //# sourceMappingURL=index.js.map