@thorprovider/medusa-extended 1.11.7 → 1.11.9

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse } from '@thorprovider/types';
+import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse, TokenVerifyResult, RecoveryConfirmResult, SubmitApplicationBody, SubmitApplicationResult } from '@thorprovider/types';
 
 /**
  * @fileoverview Medusa Multi-Tenant Admin Client
@@ -830,4 +830,125 @@ declare class DropshipperClient {
     getGeoCities(code: string): Promise<GetGeoCitiesResponse>;
 }
 
-export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig };
+/**
+ * @fileoverview Recovery Client — Thor Commerce Extended
+ * @module @thorprovider/medusa-extended/recovery
+ *
+ * Public HTTP client for account-recovery flows (password reset + activation).
+ *
+ * Unlike `DropshipperClient`, this client does NOT require a JWT: it talks to
+ * public storefront endpoints so a user can recover access without being
+ * logged in. Backend URLs are owned here; the dashboard never builds them.
+ *
+ * Endpoints:
+ *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
+ *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *
+ * Confirm methods follow the two-phase contract: verify (no consume) first,
+ * then confirm (atomic consume). A re-verify after a failed confirm maps the
+ * TOCTOU state (used/expired/revoked) into `RecoveryConfirmResult.status`.
+ *
+ * `submitApplication` returns a discriminated `SubmitApplicationResult` instead
+ * of throwing on 400/409/429 so the caller can surface the backend's structured
+ * payload (existing application on 409, retry window on 429). Network/5xx
+ * errors are re-thrown as `ProviderAPIError`.
+ */
+
+/**
+ * Configuration required to instantiate the recovery client.
+ */
+interface RecoveryClientConfig {
+    /** Medusa backend base URL */
+    baseUrl: string;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * HTTP client for account-recovery endpoints (public, no auth required).
+ *
+ * All methods throw `ProviderAPIError` on non-2xx responses except the
+ * confirm methods, which normalize failures into `RecoveryConfirmResult`.
+ *
+ * @example
+ * ```typescript
+ * const client = new RecoveryClient({
+ *   baseUrl: process.env.MEDUSA_BACKEND_URL!,
+ * });
+ *
+ * await client.requestUserPasswordReset('juan@ejemplo.com');
+ * const result = await client.verifyUserPasswordResetToken(token);
+ * const confirm = await client.confirmUserPasswordReset(token, 'NuevaClave1');
+ * ```
+ */
+declare class RecoveryClient {
+    private baseUrl;
+    private logger;
+    constructor(config: RecoveryClientConfig);
+    private request;
+    /**
+     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+     *
+     * The JWT is unsigned-trust for this claim: the email is later sent to
+     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+     * token signature and payload before applying the change.
+     */
+    private decodeResetTokenEmail;
+    /**
+     * Solicita un email de reset de contraseña para el actor `user`
+     * (dropshippers). El backend responde de forma uniforme exista o no la
+     * cuenta (anti enumeración).
+     *
+     * `POST /auth/user/emailpass/reset-password`
+     */
+    requestUserPasswordReset(email: string): Promise<void>;
+    /**
+     * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+     * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+     *
+     * `GET /store/dropshipper/auth/reset-password/verify`
+     */
+    verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     */
+    confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+     *
+     * `GET /store/dropshipper/applications/activate/verify`
+     */
+    verifyActivationToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /store/dropshipper/applications/activate` y establece la
+     * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+     */
+    activateAccount(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Envía una solicitud de acceso dropshipper al endpoint público.
+     *
+     * `POST /public/dropshipper/applications`
+     *
+     * No requiere autenticación. Devuelve un resultado discriminado:
+     * - `{ ok: true }` → 201, solicitud creada (`application.number`).
+     * - `{ ok: false, reason: 'conflict' }` → 409, email ya registrado; la
+     *   solicitud existente incluye `status_label`/`reason` para la UI.
+     * - `{ ok: false, reason: 'rate_limited' }` → 429, se respetó el límite del
+     *   backend; `retryAfterSeconds` indica cuándo reintentar.
+     * - `{ ok: false, reason: 'invalid_data' }` → 400, validación del backend.
+     *
+     * Los errores de red/5xx se re-lanzan como `ProviderAPIError` para que el
+     * llamador los categorice (p. ej. con `parseError`). El 429 no se reintenta
+     * (`retryableStatusCodes` sin 429) para que el caller reciba de inmediato el
+     * `retry_after_seconds` del backend y pueda bloquear el envío.
+     */
+    submitApplication(body: SubmitApplicationBody): Promise<SubmitApplicationResult>;
+}
+
+export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig, RecoveryClient, type RecoveryClientConfig };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse } from '@thorprovider/types';
+import { GetChannelCustomersOptions, GetChannelCustomersResponse, GetChannelApiKeysResponse, GetChannelCategoriesOptions, GetChannelCategoriesResponse, GetCategorySalesChannelsResponse, AssignCategoriesToChannelsBody, AssignCategoriesToChannelsResponse, UnassignCategoriesFromChannelsBody, UnassignCategoriesFromChannelsResponse, GetCollectionSalesChannelsResponse, AssignCollectionsToChannelsBody, AssignCollectionsToChannelsResponse, UnassignCollectionsFromChannelsBody, UnassignCollectionsFromChannelsResponse, GetAdminStorefrontConfigResponse, UpdateStorefrontConfigBody, UpdateStorefrontConfigResponse, GetAdminSiteConfigResponse, UpdateSiteConfigBody, UpdateSiteConfigResponse, GetAdminSiteConfigHistoryOptions, GetAdminSiteConfigHistoryResponse, RestoreSiteConfigResponse, ChatIntent, ChatSource, QueryEntitiesInput, QueryResponse, DropshipperDashboardCapabilities, GetMyProfileResponse, ChatRequest, ChatResponse, ChatAssistantHealthResponse, GetNotificationsOptions, GetNotificationsResponse, OnboardDropshipperBody, OnboardDropshipperResponse, GetDropshipperProductsOptions, GetDropshipperProductsResponse, ValidateCheckoutItemsRequest, ValidateCheckoutItemsResponse, CostPriceChangesCheckResponse, CostPriceChangesResponse, AcknowledgeCostPriceChangesResponse, UpdateDropshipperProductStatusBody, UpdateDropshipperProductStatusResponse, GetProductAttributesResponse, GetDropshipperAttributesResponse, UpdateDropshipperPricesBody, UpdateDropshipperPricesResponse, GetDropshipperOrdersOptions, GetDropshipperOrdersResponse, GetDropshipperOrderDetailResponse, GetDropshipperShippingOptionsParams, GetDropshipperShippingOptionsResponse, ExtendedCreateDropshipperOrderBody, ExtendedCreateDropshipperOrderResponse, SetPaymentCollectorBody, SetPaymentCollectorResponse, SetPaymentMethodBody, SetPaymentMethodResponse, CancelDropshipperOrderResponse, CreateOrderEditBody, CreateOrderEditResponse, AddOrderEditItemBody, AddOrderEditItemResponse, ConfirmOrderEditResponse, GetOrderNotesResponse, CreateOrderNoteBody, CreateOrderNoteResponse, DeleteOrderNoteResponse, GetProviderCategoriesResponse, GetDropshipperCategoriesOptions, GetDropshipperCategoriesResponse, CreateDropshipperCategoryBody, DropshipperCategory, UpdateDropshipperCategoryBody, DeleteDropshipperCategoryResponse, GetCategoryMappingsOptions, GetCategoryMappingsResponse, CreateCategoryMappingBody, CreateCategoryMappingResponse, DeleteCategoryMappingResponse, GetDropshipperCustomersOptions, GetDropshipperCustomersResponse, GetDropshipperCustomerDetailResponse, CreateDropshipperCustomerBody, CreateDropshipperCustomerResponse, UpdateDropshipperCustomerBody, UpdateDropshipperCustomerResponse, GetDropshipperAddressesResponse, DropshipperAddressBody, DropshipperAddressResponse, GetDropshipperAccountResponse, GetDropshipperPayableResponse, GetDropshipperReceivableResponse, GetSettlementsOptions, GetSettlementsResponse, GetSettlementDetailResponse, GetDropshipperAccountBalanceResponse, GetDropshipperAccountOrdersOptions, GetDropshipperAccountOrdersResponse, CreateSettlementBody, CreateSettlementResponse, ConfirmSettlementBody, UpdateSettlementStatusResponse, CancelSettlementBody, GetAdminDropshipperAccountsResponse, GetAdminAccountBalanceResponse, GetAdminPriceListsResponse, GetUserChannelResponse, GetAdminDropshipperAccountOrdersResponse, GetAdminDropshipperAccountSettlementsOptions, GetAdminDropshipperAccountSettlementsResponse, ResolveGuaranteeBody, ResolveGuaranteeResponse, CreateCompensacionBody, CreateCompensacionResponse, CreateAjusteBody, CreateAjusteResponse, CreateCobroBody, CreateCobroResponse, CreatePagoBody, CreatePagoResponse, CreateReversoBody, CreateReversoResponse, ConfirmMovementBody, ConfirmMovementResponse, CancelMovementBody, CancelMovementResponse, GetFinancialAnalysisResponse, RegisterPaymentBody, RegisterPaymentResponse, GetDropshipperPromotionsOptions, GetDropshipperPromotionsResponse, CreateDropshipperPromotionBody, DropshipperPromotion, UpdateDropshipperPromotionBody, DeleteDropshipperPromotionResponse, GetDashboardStatsOptions, GetDashboardStatsResponse, GetStorefrontDropshipperCategoriesResponse, GetDropshipperDraftOrdersOptions, GetDropshipperDraftOrdersResponse, GetDropshipperDraftOrderDetailResponse, CreateDropshipperDraftOrderBody, CreateDropshipperDraftOrderResponse, UpdateDropshipperDraftOrderBody, UpdateDropshipperDraftOrderResponse, ConvertDropshipperDraftOrderBody, ConvertDropshipperDraftOrderResponse, DeleteDropshipperDraftOrderResponse, GetGeoCountriesResponse, GetGeoProvincesResponse, GetGeoCitiesResponse, TokenVerifyResult, RecoveryConfirmResult, SubmitApplicationBody, SubmitApplicationResult } from '@thorprovider/types';
 
 /**
  * @fileoverview Medusa Multi-Tenant Admin Client
@@ -830,4 +830,125 @@ declare class DropshipperClient {
     getGeoCities(code: string): Promise<GetGeoCitiesResponse>;
 }
 
-export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig };
+/**
+ * @fileoverview Recovery Client — Thor Commerce Extended
+ * @module @thorprovider/medusa-extended/recovery
+ *
+ * Public HTTP client for account-recovery flows (password reset + activation).
+ *
+ * Unlike `DropshipperClient`, this client does NOT require a JWT: it talks to
+ * public storefront endpoints so a user can recover access without being
+ * logged in. Backend URLs are owned here; the dashboard never builds them.
+ *
+ * Endpoints:
+ *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
+ *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *
+ * Confirm methods follow the two-phase contract: verify (no consume) first,
+ * then confirm (atomic consume). A re-verify after a failed confirm maps the
+ * TOCTOU state (used/expired/revoked) into `RecoveryConfirmResult.status`.
+ *
+ * `submitApplication` returns a discriminated `SubmitApplicationResult` instead
+ * of throwing on 400/409/429 so the caller can surface the backend's structured
+ * payload (existing application on 409, retry window on 429). Network/5xx
+ * errors are re-thrown as `ProviderAPIError`.
+ */
+
+/**
+ * Configuration required to instantiate the recovery client.
+ */
+interface RecoveryClientConfig {
+    /** Medusa backend base URL */
+    baseUrl: string;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * HTTP client for account-recovery endpoints (public, no auth required).
+ *
+ * All methods throw `ProviderAPIError` on non-2xx responses except the
+ * confirm methods, which normalize failures into `RecoveryConfirmResult`.
+ *
+ * @example
+ * ```typescript
+ * const client = new RecoveryClient({
+ *   baseUrl: process.env.MEDUSA_BACKEND_URL!,
+ * });
+ *
+ * await client.requestUserPasswordReset('juan@ejemplo.com');
+ * const result = await client.verifyUserPasswordResetToken(token);
+ * const confirm = await client.confirmUserPasswordReset(token, 'NuevaClave1');
+ * ```
+ */
+declare class RecoveryClient {
+    private baseUrl;
+    private logger;
+    constructor(config: RecoveryClientConfig);
+    private request;
+    /**
+     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+     *
+     * The JWT is unsigned-trust for this claim: the email is later sent to
+     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+     * token signature and payload before applying the change.
+     */
+    private decodeResetTokenEmail;
+    /**
+     * Solicita un email de reset de contraseña para el actor `user`
+     * (dropshippers). El backend responde de forma uniforme exista o no la
+     * cuenta (anti enumeración).
+     *
+     * `POST /auth/user/emailpass/reset-password`
+     */
+    requestUserPasswordReset(email: string): Promise<void>;
+    /**
+     * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+     * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+     *
+     * `GET /store/dropshipper/auth/reset-password/verify`
+     */
+    verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     */
+    confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+     *
+     * `GET /store/dropshipper/applications/activate/verify`
+     */
+    verifyActivationToken(token: string): Promise<TokenVerifyResult>;
+    /**
+     * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+     * token vía `POST /store/dropshipper/applications/activate` y establece la
+     * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+     */
+    activateAccount(token: string, password: string): Promise<RecoveryConfirmResult>;
+    /**
+     * Envía una solicitud de acceso dropshipper al endpoint público.
+     *
+     * `POST /public/dropshipper/applications`
+     *
+     * No requiere autenticación. Devuelve un resultado discriminado:
+     * - `{ ok: true }` → 201, solicitud creada (`application.number`).
+     * - `{ ok: false, reason: 'conflict' }` → 409, email ya registrado; la
+     *   solicitud existente incluye `status_label`/`reason` para la UI.
+     * - `{ ok: false, reason: 'rate_limited' }` → 429, se respetó el límite del
+     *   backend; `retryAfterSeconds` indica cuándo reintentar.
+     * - `{ ok: false, reason: 'invalid_data' }` → 400, validación del backend.
+     *
+     * Los errores de red/5xx se re-lanzan como `ProviderAPIError` para que el
+     * llamador los categorice (p. ej. con `parseError`). El 429 no se reintenta
+     * (`retryableStatusCodes` sin 429) para que el caller reciba de inmediato el
+     * `retry_after_seconds` del backend y pueda bloquear el envío.
+     */
+    submitApplication(body: SubmitApplicationBody): Promise<SubmitApplicationResult>;
+}
+
+export { type ChatStreamEvent, DropshipperClient, type DropshipperClientConfig, MedusaAdminClient, type MedusaAdminClientConfig, RecoveryClient, type RecoveryClientConfig };

package/dist/index.js

@@ -21,7 +21,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   DropshipperClient: () => DropshipperClient,
-  MedusaAdminClient: () => MedusaAdminClient
+  MedusaAdminClient: () => MedusaAdminClient,
+  RecoveryClient: () => RecoveryClient
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -1900,9 +1901,241 @@ function mapUiMessageStreamToEvents(stream, logger) {
     }
   });
 }
+
+// src/recovery.ts
+var import_adapters4 = require("@thorprovider/adapters");
+var RecoveryClient = class {
+  baseUrl;
+  logger;
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.logger = (0, import_adapters4.createLogger)("RecoveryClient", config.debug);
+  }
+  // -------------------------------------------------------------------------
+  // Private — HTTP helper
+  // -------------------------------------------------------------------------
+  async request(method, path, body, retryConfig) {
+    const url = `${this.baseUrl}${path}`;
+    this.logger.debug(`[recovery] ${method} ${path}`);
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const init = {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    };
+    let response;
+    try {
+      response = await fetchBackendWithResilience(url, init, retryConfig);
+    } catch (networkError) {
+      throw new import_adapters4.ProviderAPIError(
+        `[recovery] Network error on ${method} ${path}: ${networkError.message}`,
+        "NETWORK_ERROR",
+        networkError
+      );
+    }
+    if (!response.ok) {
+      let message = `HTTP ${response.status}`;
+      let details;
+      try {
+        const json = await response.json();
+        message = json?.message ?? message;
+        details = json && typeof json === "object" ? json : void 0;
+      } catch {
+      }
+      throw new import_adapters4.ProviderAPIError(
+        `[recovery] ${method} ${path} failed: ${message}`,
+        `RECOVERY_API_${response.status}`,
+        response.status,
+        details
+      );
+    }
+    return response.json();
+  }
+  // -------------------------------------------------------------------------
+  // Private — reset token helpers
+  // -------------------------------------------------------------------------
+  /**
+   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+   *
+   * The JWT is unsigned-trust for this claim: the email is later sent to
+   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+   * token signature and payload before applying the change.
+   */
+  decodeResetTokenEmail(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+      return typeof payload.entity_id === "string" && payload.entity_id.length > 0 ? payload.entity_id : null;
+    } catch {
+      return null;
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Password reset
+  // -------------------------------------------------------------------------
+  /**
+   * Solicita un email de reset de contraseña para el actor `user`
+   * (dropshippers). El backend responde de forma uniforme exista o no la
+   * cuenta (anti enumeración).
+   *
+   * `POST /auth/user/emailpass/reset-password`
+   */
+  async requestUserPasswordReset(email) {
+    await this.request("POST", "/auth/user/emailpass/reset-password", {
+      identifier: email
+    });
+  }
+  /**
+   * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+   * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+   *
+   * `GET /store/dropshipper/auth/reset-password/verify`
+   */
+  async verifyUserPasswordResetToken(token) {
+    return this.request("GET", `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+  }
+  /**
+   * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   */
+  async confirmUserPasswordReset(token, password) {
+    const verify = await this.verifyUserPasswordResetToken(token);
+    if (verify.status !== "valid") {
+      return { ok: false, status: verify.status };
+    }
+    const email = this.decodeResetTokenEmail(token);
+    if (!email) {
+      return { ok: false, status: "invalid" };
+    }
+    try {
+      const headers = {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      };
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ email, password })
+      });
+      if (!response.ok) {
+        throw new import_adapters4.ProviderAPIError(
+          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          "RECOVERY_API_" + response.status,
+          response.status
+        );
+      }
+      return { ok: true };
+    } catch (error) {
+      this.logger.warn("[recovery] confirmUserPasswordReset failed, re-verifying", error);
+      try {
+        const recheck = await this.verifyUserPasswordResetToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: "invalid" };
+      }
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Account activation
+  // -------------------------------------------------------------------------
+  /**
+   * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+   *
+   * `GET /store/dropshipper/applications/activate/verify`
+   */
+  async verifyActivationToken(token) {
+    return this.request("GET", `/store/dropshipper/applications/activate/verify?token=${encodeURIComponent(token)}`);
+  }
+  /**
+   * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /store/dropshipper/applications/activate` y establece la
+   * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+   */
+  async activateAccount(token, password) {
+    const verify = await this.verifyActivationToken(token);
+    if (verify.status !== "valid") {
+      return { ok: false, status: verify.status };
+    }
+    try {
+      await this.request("POST", "/store/dropshipper/applications/activate", { token, password });
+      return { ok: true };
+    } catch (error) {
+      this.logger.warn("[recovery] activateAccount failed, re-verifying", error);
+      try {
+        const recheck = await this.verifyActivationToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: "invalid" };
+      }
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Dropshipper application submission
+  // -------------------------------------------------------------------------
+  /**
+   * Envía una solicitud de acceso dropshipper al endpoint público.
+   *
+   * `POST /public/dropshipper/applications`
+   *
+   * No requiere autenticación. Devuelve un resultado discriminado:
+   * - `{ ok: true }` → 201, solicitud creada (`application.number`).
+   * - `{ ok: false, reason: 'conflict' }` → 409, email ya registrado; la
+   *   solicitud existente incluye `status_label`/`reason` para la UI.
+   * - `{ ok: false, reason: 'rate_limited' }` → 429, se respetó el límite del
+   *   backend; `retryAfterSeconds` indica cuándo reintentar.
+   * - `{ ok: false, reason: 'invalid_data' }` → 400, validación del backend.
+   *
+   * Los errores de red/5xx se re-lanzan como `ProviderAPIError` para que el
+   * llamador los categorice (p. ej. con `parseError`). El 429 no se reintenta
+   * (`retryableStatusCodes` sin 429) para que el caller reciba de inmediato el
+   * `retry_after_seconds` del backend y pueda bloquear el envío.
+   */
+  async submitApplication(body) {
+    try {
+      const response = await this.request(
+        "POST",
+        "/public/dropshipper/applications",
+        body,
+        { retryableStatusCodes: [408, 500, 502, 503, 504] }
+      );
+      return { ok: true, application: response.application };
+    } catch (error) {
+      if (error instanceof import_adapters4.ProviderAPIError) {
+        const details = error.details ?? {};
+        if (error.status === 409 && details.application) {
+          return {
+            ok: false,
+            reason: "conflict",
+            application: details.application
+          };
+        }
+        if (error.status === 429 && typeof details.retry_after_seconds === "number") {
+          return {
+            ok: false,
+            reason: "rate_limited",
+            retryAfterSeconds: details.retry_after_seconds
+          };
+        }
+        if (error.status === 400) {
+          return {
+            ok: false,
+            reason: "invalid_data",
+            fields: details.fields
+          };
+        }
+      }
+      throw error;
+    }
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DropshipperClient,
-  MedusaAdminClient
+  MedusaAdminClient,
+  RecoveryClient
 });
 //# sourceMappingURL=index.js.map