@viu/emporix-sdk 1.0.0

package/dist/index.cjs

@@ -0,0 +1,2075 @@
+'use strict';
+
+// src/core/errors.ts
+var REDACTED_BODY_KEYS = /* @__PURE__ */ new Set([
+  "access_token",
+  "refresh_token",
+  "token",
+  "customertoken",
+  "saastoken",
+  "secret",
+  "client_secret",
+  "authorization",
+  "password"
+]);
+function scrub(body) {
+  if (Array.isArray(body)) return body.map(scrub);
+  if (body && typeof body === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(body)) {
+      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? "***redacted***" : scrub(v);
+    }
+    return out;
+  }
+  return body;
+}
+var EmporixError = class extends Error {
+  status;
+  body;
+  constructor(message, status, body) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.body = body;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+  /** Safe serialisation — token-like body fields are redacted. */
+  toJSON() {
+    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };
+  }
+};
+var EmporixAuthError = class extends EmporixError {
+};
+var EmporixForbiddenError = class extends EmporixError {
+};
+var EmporixNotFoundError = class extends EmporixError {
+};
+var EmporixValidationError = class extends EmporixError {
+};
+var EmporixServerError = class extends EmporixError {
+};
+var EmporixInsufficientScopeError = class extends EmporixForbiddenError {
+  requiredScope;
+  constructor(message, status, body, requiredScope) {
+    super(message, status, body);
+    this.requiredScope = requiredScope;
+  }
+};
+var SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;
+function extractRequiredScope(body) {
+  if (body && typeof body === "object" && "details" in body) {
+    const details = body.details;
+    if (Array.isArray(details)) {
+      for (const d of details) {
+        if (typeof d === "string") {
+          const m = d.match(SCOPE_HINT_RE);
+          if (m) return m[1];
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function errorFromResponse(status, message, body) {
+  if (status === 401) return new EmporixAuthError(message, status, body);
+  if (status === 403) {
+    const scope = extractRequiredScope(body);
+    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);
+    return new EmporixForbiddenError(message, status, body);
+  }
+  if (status === 404) return new EmporixNotFoundError(message, status, body);
+  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);
+  if (status >= 500) return new EmporixServerError(message, status, body);
+  return new EmporixError(message, status, body);
+}
+
+// src/core/config.ts
+var DEFAULT_HOST = "https://api.emporix.io";
+var TENANT_RE = /^[a-z][a-z0-9]{2,15}$/;
+function validateConfig(input) {
+  if (!TENANT_RE.test(input.tenant)) {
+    throw new Error(
+      `Invalid tenant "${input.tenant}": must be lowercase, 3\u201316 chars, match ^[a-z][a-z0-9]+$`
+    );
+  }
+  if (!input.credentials) {
+    throw new Error("credentials is required (provide at least one of backend/storefront/custom)");
+  }
+  return {
+    tenant: input.tenant,
+    host: input.host ?? DEFAULT_HOST,
+    credentials: input.credentials,
+    tokenProvider: input.tokenProvider,
+    timeouts: {
+      connectMs: input.timeouts?.connectMs ?? 1e4,
+      readMs: input.timeouts?.readMs ?? 6e4
+    },
+    retry: { maxAttempts: input.retry?.maxAttempts ?? 3 },
+    cache: {
+      expirationBufferSeconds: input.cache?.expirationBufferSeconds ?? 60,
+      maxLifetimeSeconds: input.cache?.maxLifetimeSeconds ?? 3600
+    },
+    logger: input.logger
+  };
+}
+
+// src/core/logger.ts
+var LEVEL = {
+  trace: 10,
+  debug: 20,
+  info: 30,
+  warn: 40,
+  error: 50,
+  silent: 60
+};
+function isValidLevel(v) {
+  return v !== void 0 && v in LEVEL;
+}
+function readEnv(name) {
+  try {
+    return typeof process !== "undefined" && process.env ? process.env[name] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var LevelResolver = class {
+  constructor(cfg, warn = () => {
+  }) {
+    this.warn = warn;
+    this.cfgLevel = cfg.level ?? "warn";
+    this.cfgServices = { ...cfg.services };
+  }
+  warn;
+  cfgLevel;
+  cfgServices;
+  forcedServices = {};
+  forcedGlobal;
+  warned = false;
+  envFor(svc) {
+    const raw = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`);
+    if (raw === void 0) return void 0;
+    if (isValidLevel(raw)) return raw;
+    if (!this.warned) {
+      this.warned = true;
+      this.warn(`Invalid EMPORIX_LOG_LEVEL_${svc.toUpperCase()}="${raw}" ignored`);
+    }
+    return void 0;
+  }
+  envGlobal() {
+    const raw = readEnv("EMPORIX_LOG_LEVEL");
+    if (raw === void 0) return void 0;
+    if (isValidLevel(raw)) return raw;
+    if (!this.warned) {
+      this.warned = true;
+      this.warn(`Invalid EMPORIX_LOG_LEVEL="${raw}" ignored`);
+    }
+    return void 0;
+  }
+  /**
+   * Effective level for a service. Forced overrides (from `set(..., force)`)
+   * take precedence over env vars; otherwise env > programmatic config.
+   */
+  get(svc) {
+    return this.forcedServices[svc] ?? this.envFor(svc) ?? this.forcedGlobal ?? this.envGlobal() ?? this.cfgServices[svc] ?? this.cfgLevel ?? "warn";
+  }
+  /** Numeric effective level for a service. */
+  numericLevel(svc) {
+    return LEVEL[this.get(svc)];
+  }
+  /** True if `svc`'s effective level allows emitting at `at`. */
+  isAtLeast(svc, at) {
+    return this.numericLevel(svc) <= LEVEL[at];
+  }
+  /** Mutates programmatic level (global or one service). Env-set levels are sticky unless `force`. */
+  set(level, svc, force = false) {
+    if (svc) {
+      const envBound = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`) !== void 0;
+      if (envBound && !force) {
+        this.warn(`Level for "${svc}" is env-controlled; pass force to override`);
+        return;
+      }
+      if (force) this.forcedServices[svc] = level;
+      else this.cfgServices[svc] = level;
+    } else {
+      const envBound = readEnv("EMPORIX_LOG_LEVEL") !== void 0;
+      if (envBound && !force) {
+        this.warn("Global level is env-controlled; pass force to override");
+        return;
+      }
+      if (force) this.forcedGlobal = level;
+      else this.cfgLevel = level;
+    }
+  }
+};
+var DEFAULT_REDACT = /* @__PURE__ */ new Set([
+  "authorization",
+  "password",
+  "oldpassword",
+  "newpassword",
+  "clientsecret",
+  "secret",
+  "access_token",
+  "refresh_token",
+  "customertoken",
+  "saastoken",
+  "saas-token",
+  "bearertoken",
+  "apikey",
+  "token"
+]);
+function redact(value, extra = []) {
+  const keys = new Set(DEFAULT_REDACT);
+  for (const k of extra) keys.add(k.toLowerCase());
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const src = v;
+      if (typeof src.kind === "string" && "token" in src) return { kind: src.kind };
+      const out = {};
+      for (const [k, val] of Object.entries(src)) {
+        if (keys.has(k.toLowerCase())) {
+          out[k] = k.toLowerCase() === "authorization" && typeof val === "string" ? "Bearer ***redacted***" : "***redacted***";
+        } else {
+          out[k] = walk(val);
+        }
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+var EMIT = {
+  trace: LEVEL.trace,
+  debug: LEVEL.debug,
+  info: LEVEL.info,
+  warn: LEVEL.warn,
+  error: LEVEL.error
+};
+var BaseLogger = class {
+  constructor(resolver, bindings, extraRedact) {
+    this.resolver = resolver;
+    this.bindings = bindings;
+    this.extraRedact = extraRedact;
+  }
+  resolver;
+  bindings;
+  extraRedact;
+  svc() {
+    return this.bindings.service ?? "http";
+  }
+  get level() {
+    return this.resolver.get(this.svc());
+  }
+  isLevelEnabled(level) {
+    return this.resolver.isAtLeast(this.svc(), level);
+  }
+  at(level, msg, fields) {
+    if (this.resolver.numericLevel(this.svc()) > EMIT[level]) return;
+    const merged = { ...this.bindings, ...fields ?? {} };
+    this.emit(level, msg, redact(merged, this.extraRedact));
+  }
+  trace(m, f) {
+    this.at("trace", m, f);
+  }
+  debug(m, f) {
+    this.at("debug", m, f);
+  }
+  info(m, f) {
+    this.at("info", m, f);
+  }
+  warn(m, f) {
+    this.at("warn", m, f);
+  }
+  error(m, f) {
+    this.at("error", m, f);
+  }
+};
+var ConsoleLogger = class _ConsoleLogger extends BaseLogger {
+  constructor(resolver, bindings, extra, sink, pretty) {
+    super(resolver, bindings, extra);
+    this.sink = sink;
+    this.pretty = pretty;
+  }
+  sink;
+  pretty;
+  emit(level, msg, fields) {
+    if (this.pretty) {
+      const fn = level === "error" ? this.sink.error : level === "warn" ? this.sink.warn : level === "info" ? this.sink.info : this.sink.log;
+      fn(`[${level}] ${msg}`, fields);
+    } else {
+      this.sink.log(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg, ...fields }));
+    }
+  }
+  child(bindings) {
+    return new _ConsoleLogger(
+      this.resolver,
+      { ...this.bindings, ...bindings },
+      this.extraRedact,
+      this.sink,
+      this.pretty
+    );
+  }
+};
+var NoopLogger = class {
+  level = "silent";
+  isLevelEnabled() {
+    return false;
+  }
+  trace() {
+  }
+  debug() {
+  }
+  info() {
+  }
+  warn() {
+  }
+  error() {
+  }
+  child() {
+    return this;
+  }
+};
+function createConsoleLogger(resolver, bindings = {}, opts = {}) {
+  const pretty = opts.pretty ?? readEnv("NODE_ENV") !== "production";
+  const sink = opts.sink ?? {
+    log: console.log,
+    info: console.info,
+    warn: console.warn,
+    error: console.error
+  };
+  return new ConsoleLogger(resolver, bindings, opts.redact ?? [], sink, pretty);
+}
+function createNoopLogger() {
+  return new NoopLogger();
+}
+
+// src/core/auth.ts
+var auth = {
+  /** Service/custom credential set (default `backend`). */
+  service: (credentials) => credentials === void 0 ? { kind: "service" } : { kind: "service", credentials },
+  /** Cached anonymous storefront token. */
+  anonymous: () => ({ kind: "anonymous" }),
+  /** Caller-owned customer bearer token. */
+  customer: (token) => ({ kind: "customer", token }),
+  /** Exact token, no transformation (SSO / token-exchange). */
+  raw: (token) => ({ kind: "raw", token })
+};
+async function resolveToken(ctx, provider) {
+  switch (ctx.kind) {
+    case "service":
+      return provider.getToken(ctx.credentials ?? "backend");
+    case "anonymous":
+      return (await provider.getAnonymousToken()).accessToken;
+    case "customer":
+    case "raw":
+      return ctx.token;
+  }
+}
+var DefaultTokenProvider = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  cfg;
+  serviceCache = /* @__PURE__ */ new Map();
+  serviceLocks = /* @__PURE__ */ new Map();
+  anon;
+  anonLock;
+  anonStore;
+  refreshListeners = /* @__PURE__ */ new Set();
+  onRefresh(listener) {
+    this.refreshListeners.add(listener);
+    return () => {
+      this.refreshListeners.delete(listener);
+    };
+  }
+  notifyRefresh(kind, success) {
+    for (const l of this.refreshListeners) {
+      try {
+        l({ kind, success });
+      } catch {
+      }
+    }
+  }
+  attachAnonymousStore(store) {
+    this.anonStore = store;
+    if (!this.anon) {
+      const persisted = store.read();
+      if (persisted) {
+        this.anon = {
+          accessToken: "",
+          refreshToken: persisted.refreshToken,
+          sessionId: persisted.sessionId,
+          expiresIn: 0,
+          expiresAt: 0
+        };
+      }
+    }
+  }
+  creds(set) {
+    if (set === "backend") {
+      const b = this.cfg.credentials.backend;
+      if (!b?.clientId || !b.secret) {
+        throw new EmporixAuthError(
+          "A 'service' AuthContext was used but credentials.backend is not configured"
+        );
+      }
+      return b;
+    }
+    const c = this.cfg.credentials.custom?.[set];
+    if (!c) throw new Error(`Unknown credential set "${set}"`);
+    return c;
+  }
+  fresh(e) {
+    if (!e) return false;
+    const now = Date.now();
+    if (now - e.obtainedAt >= this.cfg.cache.maxLifetimeSeconds * 1e3) return false;
+    return now < e.expiresAt;
+  }
+  async getToken(set) {
+    this.creds(set);
+    const cached = this.serviceCache.get(set);
+    if (this.fresh(cached)) return cached.token;
+    const inflight = this.serviceLocks.get(set);
+    if (inflight) return inflight;
+    const p = this.requestServiceToken(set).finally(() => this.serviceLocks.delete(set));
+    this.serviceLocks.set(set, p);
+    return p;
+  }
+  async requestServiceToken(set) {
+    const c = this.creds(set);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: c.clientId,
+      client_secret: c.secret
+    });
+    if (c.scope) body.set("scope", c.scope);
+    const res = await fetch(`${this.cfg.host}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    });
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new EmporixAuthError(`Token request failed for "${set}"`, res.status, json);
+    }
+    const obtainedAt = Date.now();
+    const ttl = Number(json.expires_in ?? 3600);
+    this.serviceCache.set(set, {
+      token: json.access_token,
+      obtainedAt,
+      expiresAt: obtainedAt + (ttl - this.cfg.cache.expirationBufferSeconds) * 1e3
+    });
+    return this.serviceCache.get(set).token;
+  }
+  invalidate(set) {
+    this.serviceCache.delete(set);
+  }
+  anonFresh() {
+    return !!this.anon && Date.now() < this.anon.expiresAt;
+  }
+  async getAnonymousToken() {
+    if (this.anonFresh()) return this.stripExpiry(this.anon);
+    if (this.anonLock) return this.anonLock;
+    const canRefresh = !!this.anon?.refreshToken;
+    const obtain = canRefresh ? this.fetchAnonymous("refresh").catch(() => this.fetchAnonymous("login")) : this.fetchAnonymous("login");
+    const p = obtain.finally(() => {
+      this.anonLock = void 0;
+    });
+    this.anonLock = p;
+    return p;
+  }
+  /** Refreshes the anonymous session, preserving its sessionId. */
+  async refreshAnonymous() {
+    if (!this.anon) return this.getAnonymousToken();
+    return this.fetchAnonymous("refresh");
+  }
+  invalidateAnonymous() {
+    this.anon = void 0;
+    this.anonStore?.write(null);
+  }
+  /** Force a stale access token while keeping the refresh token + sessionId. */
+  expireAnonymous() {
+    if (this.anon) this.anon = { ...this.anon, expiresAt: 0 };
+  }
+  stripExpiry(s) {
+    const { expiresAt: _expiresAt, ...rest } = s;
+    return rest;
+  }
+  async fetchAnonymous(mode) {
+    const sf = this.cfg.credentials.storefront;
+    if (!sf?.clientId) {
+      throw new Error("credentials.storefront.clientId is required for anonymous tokens");
+    }
+    const url = new URL(`${this.cfg.host}/customerlogin/auth/anonymous/${mode}`);
+    url.searchParams.set("tenant", this.cfg.tenant);
+    url.searchParams.set("client_id", sf.clientId);
+    const c = sf.context;
+    if (c?.currency) url.searchParams.set("currency", c.currency);
+    if (c?.siteCode) url.searchParams.set("siteCode", c.siteCode);
+    if (c?.targetLocation) url.searchParams.set("targetLocation", c.targetLocation);
+    if (mode === "refresh" && this.anon) {
+      url.searchParams.set("refresh_token", this.anon.refreshToken);
+    }
+    try {
+      const res = await fetch(url, { method: "GET" });
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        this.notifyRefresh("anonymous", false);
+        throw new EmporixAuthError(`Anonymous token ${mode} failed`, res.status, json);
+      }
+      const obtainedAt = Date.now();
+      this.anon = {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        sessionId: json.sessionId,
+        expiresIn: json.expires_in,
+        expiresAt: obtainedAt + (json.expires_in - this.cfg.cache.expirationBufferSeconds) * 1e3
+      };
+      this.anonStore?.write({
+        refreshToken: this.anon.refreshToken,
+        sessionId: this.anon.sessionId
+      });
+      this.notifyRefresh("anonymous", true);
+      return this.stripExpiry(this.anon);
+    } catch (err) {
+      if (!(err instanceof EmporixAuthError)) {
+        this.notifyRefresh("anonymous", false);
+      }
+      throw err;
+    }
+  }
+};
+
+// src/core/http.ts
+var requestSeq = 0;
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var HttpClient = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  }
+  opts;
+  sleep;
+  async request(o) {
+    const requestId = `req-${++requestSeq}`;
+    const log = this.opts.logger.child({ requestId });
+    const url = new URL(this.opts.host + o.path);
+    for (const [k, v] of Object.entries(o.query ?? {})) {
+      if (v !== void 0) url.searchParams.set(k, String(v));
+    }
+    const sdkManaged = o.auth.kind === "service" || o.auth.kind === "anonymous";
+    const maxAttempts = this.opts.retry.maxAttempts;
+    let reauthed = false;
+    for (let attempt = 1; ; attempt++) {
+      const token = await resolveToken(o.auth, this.opts.provider);
+      log.debug("http request", {
+        authKind: o.auth.kind,
+        method: o.method,
+        url: url.pathname,
+        attempt
+      });
+      const controller = new AbortController();
+      const timer = setTimeout(
+        () => controller.abort(),
+        o.timeoutMs ?? this.opts.timeouts.readMs
+      );
+      const isFormData = typeof FormData !== "undefined" && o.body instanceof FormData;
+      const init = {
+        method: o.method,
+        headers: {
+          ...o.headers ?? {},
+          Authorization: `Bearer ${token}`,
+          // JSON bodies: set Content-Type. FormData bodies: let `fetch`
+          // emit `multipart/form-data; boundary=...` itself.
+          ...o.body !== void 0 && !isFormData ? { "Content-Type": "application/json" } : {}
+        },
+        signal: controller.signal
+      };
+      if (o.body !== void 0) {
+        init.body = isFormData ? o.body : JSON.stringify(o.body);
+      }
+      let res;
+      try {
+        res = await fetch(url, init);
+      } finally {
+        clearTimeout(timer);
+      }
+      const text = await res.text();
+      const parsed = text ? safeJson(text) : void 0;
+      if (res.ok) {
+        log.debug("http ok", { status: res.status });
+        return parsed;
+      }
+      if (res.status === 401) {
+        if (sdkManaged && !reauthed) {
+          reauthed = true;
+          if (o.auth.kind === "service") {
+            this.opts.provider.invalidate?.(o.auth.credentials ?? "backend");
+          } else if (this.opts.provider.expireAnonymous) {
+            this.opts.provider.expireAnonymous();
+          } else {
+            this.opts.provider.invalidateAnonymous?.();
+          }
+          log.warn("sdk-managed 401, re-authing once", { authKind: o.auth.kind });
+          continue;
+        }
+        throw errorFromResponse(res.status, `${o.method} ${o.path} \u2192 401`, parsed);
+      }
+      const retryable = res.status >= 500 || res.status === 429;
+      if (retryable && attempt < maxAttempts) {
+        const retryAfter = Number(res.headers.get("Retry-After"));
+        const backoff = Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter * 1e3 : Math.min(1e3 * 2 ** (attempt - 1), 8e3) + Math.random() * 100;
+        log.warn("retryable failure", { status: res.status, attempt, backoffMs: backoff });
+        await this.sleep(backoff);
+        continue;
+      }
+      log.error("http error (final)", { status: res.status, attempt });
+      throw errorFromResponse(res.status, `${o.method} ${o.path} \u2192 ${res.status}`, parsed);
+    }
+  }
+};
+
+// src/core/require-customer.ts
+function requireCustomer(auth2) {
+  if (auth2 && (auth2.kind === "customer" || auth2.kind === "raw")) return auth2;
+  throw new EmporixAuthError("This operation requires a customer or raw AuthContext");
+}
+
+// src/services/customer.ts
+var CustomerService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** Obtains an anonymous storefront session (accessToken + sessionId + refreshToken). */
+  async anonymous() {
+    return this.ctx.tokenProvider.getAnonymousToken();
+  }
+  /** Registers a customer. Default auth: anonymous. */
+  async signup(input, auth2 = { kind: "anonymous" }) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/signup`,
+      auth: auth2,
+      body: input
+    });
+  }
+  /**
+   * Logs a customer in. Threads the anonymous token so the session (and its
+   * cart) survives — losing it silently creates a new session per Emporix docs.
+   * Wire `accessToken` is mapped to `customerToken`.
+   */
+  async login(creds, opts = {}, auth2 = { kind: "anonymous" }) {
+    const effective = opts.anonymousToken ? { kind: "raw", token: opts.anonymousToken } : auth2;
+    const wire = await this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/login`,
+      auth: effective,
+      body: creds
+    });
+    return {
+      customerToken: wire.access_token ?? wire.accessToken ?? "",
+      saasToken: wire.saas_token ?? wire.saasToken ?? "",
+      refreshToken: wire.refresh_token ?? wire.refreshToken ?? "",
+      sessionId: wire.session_id,
+      expiresIn: wire.expires_in
+    };
+  }
+  /**
+   * Refreshes an authenticated customer session via its refresh token,
+   * preserving the same `sessionId`. Calls
+   * `GET /customer/{tenant}/refreshauthtoken?refreshToken=…`, which **must be
+   * authorized with an anonymous token** (default auth: anonymous) — not the
+   * expired customer token. The refresh response does **not** include a
+   * `saas_token`; pass the original `saasToken` to carry it forward (it has
+   * its own, independent lifetime).
+   */
+  async refresh(input, auth2 = { kind: "anonymous" }) {
+    const query = { refreshToken: input.refreshToken };
+    if (input.legalEntityId) query.legalEntityId = input.legalEntityId;
+    const wire = await this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/refreshauthtoken`,
+      query,
+      auth: auth2
+    });
+    return {
+      customerToken: wire.access_token ?? wire.accessToken ?? "",
+      // Refresh does not return a saas_token — carry the original forward.
+      saasToken: input.saasToken ?? "",
+      refreshToken: wire.refresh_token ?? wire.refreshToken ?? "",
+      sessionId: wire.session_id,
+      expiresIn: wire.expires_in
+    };
+  }
+  /**
+   * Logs the customer out server-side: `GET /customer/{tenant}/logout?
+   * accessToken=…` authorized with the customer token. Invalidates the
+   * access token (204 No Content). Requires customer/raw auth — the token is
+   * sent both as the bearer and the `accessToken` query param (per Emporix).
+   */
+  async logout(auth2) {
+    const ctx = requireCustomer(auth2);
+    const token = ctx.token;
+    await this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/logout`,
+      query: { accessToken: token },
+      auth: ctx
+    });
+  }
+  /**
+   * Authorization-Code SSO: exchanges the IdP `code` for an Emporix customer
+   * session via `POST /customer/{tenant}/socialLogin`. The browser performs
+   * the IdP redirect itself; the SDK only does this Emporix exchange.
+   * Default auth: anonymous (Emporix requires an anonymous Bearer). The
+   * response has no `session_id` and returns `expires_in` as a string —
+   * normalized to a number here.
+   */
+  async socialLogin(input, auth2 = { kind: "anonymous" }) {
+    const query = {
+      code: input.code,
+      redirect_uri: input.redirectUri
+    };
+    if (input.codeVerifier) query.code_verifier = input.codeVerifier;
+    const wire = await this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/socialLogin`,
+      query,
+      auth: auth2,
+      ...input.sessionId ? { headers: { "session-id": input.sessionId } } : {}
+    });
+    return {
+      customerToken: wire.access_token ?? wire.accessToken ?? "",
+      saasToken: wire.saas_token ?? wire.saasToken ?? "",
+      refreshToken: wire.refresh_token ?? wire.refreshToken ?? "",
+      sessionId: wire.session_id,
+      expiresIn: wire.expires_in != null ? Number(wire.expires_in) : void 0,
+      ...wire.social_access_token ? { socialAccessToken: wire.social_access_token } : {},
+      ...wire.social_id_token ? { socialIdToken: wire.social_id_token } : {}
+    };
+  }
+  /**
+   * RFC 8693 token exchange: exchanges an external IdP JWT for an Emporix
+   * customer session via `POST /customer/{tenant}/exchangeauthtoken`.
+   * Emporix uses a proprietary query-param wire (not the RFC form body).
+   * Default auth: anonymous. `config` selects a site-specific IdP config
+   * (multi-site); omit for the tenant default. Returns `session_id` and a
+   * fresh `saas_token`; `expires_in` is an integer (normalized anyway).
+   */
+  async exchangeToken(input, auth2 = { kind: "anonymous" }) {
+    const query = { subjectAccessToken: input.subjectToken };
+    if (input.config) query.config = input.config;
+    const wire = await this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/exchangeauthtoken`,
+      query,
+      auth: auth2
+    });
+    return {
+      customerToken: wire.access_token ?? wire.accessToken ?? "",
+      saasToken: wire.saas_token ?? wire.saasToken ?? "",
+      refreshToken: wire.refresh_token ?? wire.refreshToken ?? "",
+      sessionId: wire.session_id,
+      expiresIn: wire.expires_in != null ? Number(wire.expires_in) : void 0
+    };
+  }
+  /** Returns the authenticated customer. Requires customer/raw auth. */
+  async me(auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/me`,
+      auth: requireCustomer(auth2)
+    });
+  }
+  /** Updates the authenticated customer. Requires customer/raw auth. */
+  async update(patch, auth2) {
+    return this.ctx.http.request({
+      method: "PUT",
+      path: `/customer/${this.ctx.tenant}/me`,
+      auth: requireCustomer(auth2),
+      body: patch
+    });
+  }
+  /** Changes the password. Requires customer/raw auth. */
+  async changePassword(input, auth2) {
+    await this.ctx.http.request({
+      method: "PUT",
+      path: `/customer/${this.ctx.tenant}/password`,
+      auth: requireCustomer(auth2),
+      body: input
+    });
+  }
+  /** Requests a password reset email. Default auth: anonymous. */
+  async requestPasswordReset(input, auth2 = { kind: "anonymous" }) {
+    await this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/password/reset`,
+      auth: auth2,
+      body: input
+    });
+  }
+  /** Confirms a password reset. Default auth: anonymous. */
+  async confirmPasswordReset(input, auth2 = { kind: "anonymous" }) {
+    await this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/password/reset/confirm`,
+      auth: auth2,
+      body: input
+    });
+  }
+  /** Address sub-resource. All operations require customer/raw auth. */
+  addresses = {
+    list: async (auth2) => this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/me/addresses`,
+      auth: requireCustomer(auth2)
+    }),
+    add: async (address, auth2) => this.ctx.http.request({
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/me/addresses`,
+      auth: requireCustomer(auth2),
+      body: address
+    }),
+    update: async (id, patch, auth2) => this.ctx.http.request({
+      method: "PUT",
+      path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,
+      auth: requireCustomer(auth2),
+      body: patch
+    }),
+    remove: async (id, auth2) => this.ctx.http.request({
+      method: "DELETE",
+      path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,
+      auth: requireCustomer(auth2)
+    })
+  };
+};
+
+// src/core/context.ts
+async function* iterateAll(fetchPage, start = 1) {
+  let p = start;
+  for (; ; ) {
+    const page = await fetchPage(p);
+    for (const it of page.items) yield it;
+    if (!page.hasNextPage) return;
+    p += 1;
+  }
+}
+
+// src/services/product.ts
+var ANON = { kind: "anonymous" };
+var ProductService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** Fetches one product by id. */
+  async get(productId, _opts, auth2 = ANON) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/product/${this.ctx.tenant}/products/${productId}`,
+      auth: auth2
+    });
+  }
+  /** Fetches one product by its code. */
+  async getByCode(code, auth2 = ANON) {
+    const rows = await this.ctx.http.request({
+      method: "GET",
+      path: `/product/${this.ctx.tenant}/products`,
+      query: { q: `code:${code}` },
+      auth: auth2
+    });
+    const first = rows[0];
+    if (!first) throw new Error(`No product with code "${code}"`);
+    return first;
+  }
+  /** One page of products. */
+  async list(params = {}, auth2 = ANON) {
+    const pageNumber = params.pageNumber ?? 1;
+    const pageSize = params.pageSize ?? 50;
+    const items = await this.ctx.http.request({
+      method: "GET",
+      path: `/product/${this.ctx.tenant}/products`,
+      query: { pageNumber, pageSize },
+      auth: auth2
+    });
+    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };
+  }
+  /** Async-iterates every product across pages. */
+  listAll(params = {}, auth2 = ANON) {
+    const pageSize = params.pageSize ?? 50;
+    return iterateAll((pageNumber) => this.list({ pageNumber, pageSize }, auth2));
+  }
+  /** Searches products by free-text query. */
+  async search(query, params = {}, auth2 = ANON) {
+    const pageNumber = params.pageNumber ?? 1;
+    const pageSize = params.pageSize ?? 50;
+    const items = await this.ctx.http.request({
+      method: "GET",
+      path: `/product/${this.ctx.tenant}/products`,
+      query: { q: query, pageNumber, pageSize },
+      auth: auth2
+    });
+    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };
+  }
+  /**
+   * Bulk fetch by id. POSTs `/products/search` with `q="id:(id1,id2,…)"`,
+   * chunking when the list is larger than `options.chunkSize` (default
+   * 100). An empty list short-circuits with no HTTP call. **Order is not
+   * guaranteed** across chunks — re-index by `id` if order matters.
+   */
+  async searchByIds(ids, options = {}, auth2 = ANON) {
+    if (ids.length === 0) return [];
+    const chunkSize = options.chunkSize ?? 100;
+    const chunks = [];
+    for (let i = 0; i < ids.length; i += chunkSize) {
+      chunks.push(ids.slice(i, i + chunkSize));
+    }
+    const pages = await Promise.all(
+      chunks.map(
+        (chunk) => this.ctx.http.request({
+          method: "POST",
+          path: `/product/${this.ctx.tenant}/products/search`,
+          query: { pageSize: chunk.length },
+          auth: auth2,
+          body: { q: `id:(${chunk.join(",")})` }
+        })
+      )
+    );
+    return pages.flat();
+  }
+};
+
+// src/services/category.ts
+var ANON2 = { kind: "anonymous" };
+var CategoryService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** Fetches one category by id. */
+  async get(categoryId, auth2 = ANON2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/category/${this.ctx.tenant}/categories/${categoryId}`,
+      auth: auth2
+    });
+  }
+  /** One page of categories. */
+  async list(params = {}, auth2 = ANON2) {
+    const pageNumber = params.pageNumber ?? 1;
+    const pageSize = params.pageSize ?? 50;
+    const items = await this.ctx.http.request({
+      method: "GET",
+      path: `/category/${this.ctx.tenant}/categories`,
+      query: { pageNumber, pageSize },
+      auth: auth2
+    });
+    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };
+  }
+  /** Async-iterates every category across pages. */
+  listAll(params = {}, auth2 = ANON2) {
+    const pageSize = params.pageSize ?? 50;
+    return iterateAll((pageNumber) => this.list({ pageNumber, pageSize }, auth2));
+  }
+  /** Fetches the category tree, optionally rooted at `rootId`. */
+  async tree(rootId, auth2 = ANON2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/category/${this.ctx.tenant}/categories/tree`,
+      query: rootId ? { rootId } : {},
+      auth: auth2
+    });
+  }
+  /** One page of products in a category. */
+  async productsIn(categoryId, params = {}, auth2 = ANON2) {
+    const pageNumber = params.pageNumber ?? 1;
+    const pageSize = params.pageSize ?? 50;
+    const items = await this.ctx.http.request({
+      method: "GET",
+      path: `/category/${this.ctx.tenant}/categories/${categoryId}/products`,
+      query: { pageNumber, pageSize },
+      auth: auth2
+    });
+    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };
+  }
+  /**
+   * Bulk fetch by id. POSTs `/categories/search` with `q="id:(id1,id2,…)"`,
+   * chunking when the list is larger than `options.chunkSize` (default
+   * 100). An empty list short-circuits with no HTTP call. **Order is not
+   * guaranteed** across chunks — re-index by `id` if order matters.
+   */
+  async searchByIds(ids, options = {}, auth2 = ANON2) {
+    if (ids.length === 0) return [];
+    const chunkSize = options.chunkSize ?? 100;
+    const chunks = [];
+    for (let i = 0; i < ids.length; i += chunkSize) {
+      chunks.push(ids.slice(i, i + chunkSize));
+    }
+    const pages = await Promise.all(
+      chunks.map(
+        (chunk) => this.ctx.http.request({
+          method: "POST",
+          path: `/category/${this.ctx.tenant}/categories/search`,
+          query: { pageSize: chunk.length },
+          auth: auth2,
+          body: { q: `id:(${chunk.join(",")})` }
+        })
+      )
+    );
+    return pages.flat();
+  }
+};
+
+// src/services/cart.ts
+function requireCartAuth(auth2) {
+  if (auth2 && (auth2.kind === "customer" || auth2.kind === "anonymous")) return auth2;
+  throw new EmporixValidationError(
+    "CartService requires an explicit { kind: 'customer' } or { kind: 'anonymous' } AuthContext"
+  );
+}
+function requireCustomerAuth(auth2) {
+  if (auth2 && auth2.kind === "customer") return auth2;
+  throw new EmporixValidationError("cart.merge requires a { kind: 'customer' } AuthContext");
+}
+var CartService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/cart/${this.ctx.tenant}/carts`;
+  }
+  /** Creates a cart. */
+  async create(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.base(),
+      auth: requireCartAuth(auth2),
+      body: input ?? {}
+    });
+  }
+  /** Fetches a cart by id. */
+  async get(cartId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${cartId}`,
+      auth: requireCartAuth(auth2)
+    });
+  }
+  /** Returns the current cart for the session, or null if none. */
+  /**
+   * Get the customer / anonymous cart matching the given criteria. Per Emporix:
+   * uniqueness is defined by `siteCode` + `type` + `legalEntityId` +
+   * (`customerId` derived from a customer token, or `sessionId` derived from an
+   * anonymous token). With `create: true`, Emporix creates a new cart if none
+   * matches.
+   *
+   * Returns `null` on 404 (no cart found and `create` was not set). All other
+   * errors are propagated.
+   */
+  async getCurrent(auth2, opts) {
+    const query = { siteCode: opts.siteCode };
+    if (opts.type !== void 0) query.type = opts.type;
+    if (opts.legalEntityId !== void 0) query.legalEntityId = opts.legalEntityId;
+    if (opts.create) query.create = "true";
+    try {
+      return await this.ctx.http.request({
+        method: "GET",
+        path: this.base(),
+        query,
+        auth: requireCartAuth(auth2)
+      });
+    } catch (e) {
+      if (e instanceof EmporixNotFoundError) return null;
+      throw e;
+    }
+  }
+  /** Adds an item. */
+  async addItem(cartId, item, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/${cartId}/items`,
+      auth: requireCartAuth(auth2),
+      body: item
+    });
+  }
+  /**
+   * Adds multiple items in a single request via `POST /carts/{id}/itemsBatch`.
+   * Server-side limit is 200 entries per call — callers handling larger sets
+   * must chunk. The response carries a per-entry `status` (HTTP-style: 201
+   * for added, 4xx/5xx for failed) and `index` matching the input position;
+   * partial failures do **not** throw — inspect `status` per entry.
+   */
+  async addItemsBatch(cartId, items, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/${cartId}/itemsBatch`,
+      auth: requireCartAuth(auth2),
+      body: items
+    });
+  }
+  /** Updates an item. */
+  async updateItem(cartId, itemId, patch, auth2) {
+    return this.ctx.http.request({
+      method: "PUT",
+      path: `${this.base()}/${cartId}/items/${itemId}`,
+      auth: requireCartAuth(auth2),
+      body: patch
+    });
+  }
+  /** Removes an item. */
+  async removeItem(cartId, itemId, auth2) {
+    return this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${cartId}/items/${itemId}`,
+      auth: requireCartAuth(auth2)
+    });
+  }
+  /** Empties the cart. */
+  async clear(cartId, auth2) {
+    return this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${cartId}/items`,
+      auth: requireCartAuth(auth2)
+    });
+  }
+  /** Applies a coupon. */
+  async applyCoupon(cartId, code, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/${cartId}/coupons`,
+      auth: requireCartAuth(auth2),
+      body: { code }
+    });
+  }
+  /** Removes a coupon. */
+  async removeCoupon(cartId, code, auth2) {
+    return this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${cartId}/coupons/${code}`,
+      auth: requireCartAuth(auth2)
+    });
+  }
+  /** Sets the shipping address. */
+  async setShippingAddress(cartId, address, auth2) {
+    return this.ctx.http.request({
+      method: "PUT",
+      path: `${this.base()}/${cartId}/shipping-address`,
+      auth: requireCartAuth(auth2),
+      body: address
+    });
+  }
+  /** Sets the billing address. */
+  async setBillingAddress(cartId, address, auth2) {
+    return this.ctx.http.request({
+      method: "PUT",
+      path: `${this.base()}/${cartId}/billing-address`,
+      auth: requireCartAuth(auth2),
+      body: address
+    });
+  }
+  /**
+   * Merges one or more anonymous carts into the specified customer cart.
+   * Per Emporix: the target cart in the path **must belong to the logged-in
+   * customer**, and each id in `anonymousCartIds` must belong to an anonymous
+   * customer. Anonymous carts go `CLOSED` on success.
+   *
+   * Requires a customer `AuthContext`.
+   */
+  async merge(customerCartId, anonymousCartIds, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/${customerCartId}/merge`,
+      auth: requireCustomerAuth(auth2),
+      body: { carts: anonymousCartIds }
+    });
+  }
+};
+
+// src/services/checkout.ts
+function isGuest(customer) {
+  return customer?.guest === true;
+}
+function resolveAuth(auth2, guest) {
+  if (auth2 && (auth2.kind === "customer" || auth2.kind === "raw")) return auth2;
+  if (guest && auth2 && auth2.kind === "anonymous") return auth2;
+  throw new EmporixAuthError(
+    "checkout requires a customer/raw AuthContext (or anonymous for a guest checkout)"
+  );
+}
+var CheckoutService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  headers(opts, guest) {
+    if (guest || !opts.saasToken) return void 0;
+    return { "saas-token": opts.saasToken };
+  }
+  query(opts) {
+    return opts.siteCode ? { siteCode: opts.siteCode } : void 0;
+  }
+  /** Checkout from a cart. Requires customer/raw auth (or anonymous for guest). */
+  async placeOrder(input, auth2, opts = {}) {
+    const guest = isGuest(input.customer);
+    const headers = this.headers(opts, guest);
+    const query = this.query(opts);
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/checkout/${this.ctx.tenant}/checkouts/order`,
+      auth: resolveAuth(auth2, guest),
+      ...query ? { query } : {},
+      ...headers ? { headers } : {},
+      body: input
+    });
+  }
+  /** Checkout from a quote. */
+  async placeOrderFromQuote(input, auth2, opts = {}) {
+    const headers = this.headers(opts, false);
+    const query = this.query(opts);
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/checkout/${this.ctx.tenant}/checkouts/order`,
+      auth: resolveAuth(auth2, false),
+      ...query ? { query } : {},
+      ...headers ? { headers } : {},
+      body: input
+    });
+  }
+};
+
+// src/services/payment.ts
+var PaymentGatewayService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** Lists configured frontend payment modes. */
+  async listPaymentModes(auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/payment-gateway/${this.ctx.tenant}/paymentmodes/frontend`,
+      auth: requireCustomer(auth2)
+    });
+  }
+  /** Authorizes a post-checkout (deferred) payment for an existing order. */
+  async authorize(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/payment-gateway/${this.ctx.tenant}/payment/frontend/authorize`,
+      auth: requireCustomer(auth2),
+      body: input
+    });
+  }
+};
+
+// src/services/price.ts
+var ANON3 = { kind: "anonymous" };
+var SERVICE = { kind: "service" };
+function requireContextAuth(auth2) {
+  const a = auth2 ?? ANON3;
+  if (a.kind === "anonymous" || a.kind === "customer" || a.kind === "raw") return a;
+  throw new EmporixAuthError(
+    "match-prices-by-context requires an anonymous, customer, or raw AuthContext"
+  );
+}
+var PriceService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /**
+   * Resolves prices using the session context bound to the bearer token
+   * (currency/site/country were set at anonymous-login time). Default auth:
+   * anonymous; pass a customer/raw context for personalized pricing.
+   */
+  async matchByContext(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/price/${this.ctx.tenant}/match-prices-by-context`,
+      auth: requireContextAuth(auth2),
+      body: input
+    });
+  }
+  /**
+   * Resolves prices from an explicit context. Default auth: service
+   * (requires `price.price_read` / `price.price_manage`).
+   */
+  async match(input, auth2 = SERVICE) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `/price/${this.ctx.tenant}/match-prices`,
+      auth: auth2,
+      body: input
+    });
+  }
+};
+
+// src/services/media.ts
+var SERVICE2 = { kind: "service" };
+function isProductRef(r, productId) {
+  return r.type === "PRODUCT" && r.id === productId;
+}
+var MediaService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/media/${this.ctx.tenant}/assets`;
+  }
+  /** Create an asset. BLOB uploads via multipart; LINK via JSON. */
+  async create(input, auth2 = SERVICE2) {
+    if (input.kind === "blob") {
+      const fd = new FormData();
+      fd.set("file", input.file);
+      fd.set("body", JSON.stringify(input.body));
+      return this.ctx.http.request({
+        method: "POST",
+        path: this.base(),
+        auth: auth2,
+        body: fd
+      });
+    }
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.base(),
+      auth: auth2,
+      body: input.body
+    });
+  }
+  /** List assets. Optional `query` is passed through to Emporix verbatim. */
+  async list(query, auth2 = SERVICE2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      auth: auth2,
+      ...query ? { query } : {}
+    });
+  }
+  /** Fetch an asset by id. */
+  async get(assetId, auth2 = SERVICE2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${assetId}`,
+      auth: auth2
+    });
+  }
+  /** Update an asset (e.g. swap `refIds` or `access`). */
+  async update(assetId, patch, auth2 = SERVICE2) {
+    return this.ctx.http.request({
+      method: "PUT",
+      path: `${this.base()}/${assetId}`,
+      auth: auth2,
+      body: patch
+    });
+  }
+  /** Remove an asset. */
+  async remove(assetId, auth2 = SERVICE2) {
+    await this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${assetId}`,
+      auth: auth2
+    });
+  }
+  /** Multipart upload sugar: builds `AssetCreateBlob` from input. */
+  async uploadFile(input, auth2 = SERVICE2) {
+    const body = {
+      type: "BLOB",
+      access: input.access ?? "PUBLIC",
+      ...input.productId ? { refIds: [{ type: "PRODUCT", id: input.productId }] } : {},
+      ...input.filename || input.mimeType ? {
+        details: {
+          ...input.filename ? { filename: input.filename } : {},
+          ...input.mimeType ? { mimeType: input.mimeType } : {}
+        }
+      } : {}
+    };
+    return this.create({ kind: "blob", file: input.file, body }, auth2);
+  }
+  /** External-URL sugar: builds `AssetCreateLink`. */
+  async link(input, auth2 = SERVICE2) {
+    const body = {
+      type: "LINK",
+      access: input.access ?? "PUBLIC",
+      url: input.url,
+      ...input.productId ? { refIds: [{ type: "PRODUCT", id: input.productId }] } : {}
+    };
+    return this.create({ kind: "link", body }, auth2);
+  }
+  /** Idempotently add a PRODUCT refId to an asset. */
+  async attachToProduct(assetId, productId, auth2 = SERVICE2) {
+    const a = await this.get(assetId, auth2);
+    const refIds = a.refIds ?? [];
+    if (refIds.some((r) => isProductRef(r, productId))) return a;
+    const next = [...refIds, { type: "PRODUCT", id: productId }];
+    const patch = { type: a.type, refIds: next };
+    return this.update(assetId, patch, auth2);
+  }
+  /** Remove a PRODUCT refId from an asset (no-op if absent). */
+  async detachFromProduct(assetId, productId, auth2 = SERVICE2) {
+    const a = await this.get(assetId, auth2);
+    const refIds = a.refIds ?? [];
+    const next = refIds.filter((r) => !isProductRef(r, productId));
+    if (next.length === refIds.length) return a;
+    const patch = { type: a.type, refIds: next };
+    return this.update(assetId, patch, auth2);
+  }
+  /** Convenience: list assets attached to a product (server-side filter). */
+  async listForProduct(productId, auth2 = SERVICE2) {
+    return this.list({ "refIds.id": productId }, auth2);
+  }
+};
+
+// src/services/segment.ts
+function setIfDefined(q, key, value) {
+  if (value !== void 0 && value !== "") {
+    q[key] = value;
+  }
+}
+var SegmentService = class {
+  constructor(ctx, deps) {
+    this.ctx = ctx;
+    this.deps = deps;
+  }
+  ctx;
+  deps;
+  base() {
+    return `/customer-segment/${this.ctx.tenant}/segments`;
+  }
+  /** Lists segments the caller belongs to (with `segment_read_own`). */
+  async list(query = {}, auth2) {
+    const q = {};
+    setIfDefined(q, "q", query.q);
+    setIfDefined(q, "pageNumber", query.pageNumber);
+    setIfDefined(q, "pageSize", query.pageSize);
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      auth: requireCustomer(auth2),
+      ...Object.keys(q).length ? { query: q } : {}
+    });
+  }
+  /** Fetches a single segment by id. */
+  async get(segmentId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${segmentId}`,
+      auth: requireCustomer(auth2)
+    });
+  }
+  /** Item assignments (PRODUCT + CATEGORY) across all the caller's active segments. */
+  async listItems(query = {}, auth2) {
+    const q = {};
+    setIfDefined(q, "q", query.q);
+    setIfDefined(q, "siteCode", query.siteCode);
+    setIfDefined(q, "legalEntityId", query.legalEntityId);
+    setIfDefined(q, "pageNumber", query.pageNumber);
+    setIfDefined(q, "pageSize", query.pageSize);
+    if (query.onlyActive !== void 0) q.onlyActive = String(query.onlyActive);
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/items`,
+      auth: requireCustomer(auth2),
+      ...Object.keys(q).length ? { query: q } : {}
+    });
+  }
+  /** Item assignments of one specific segment. */
+  async listSegmentItems(segmentId, query = {}, auth2) {
+    const q = {};
+    setIfDefined(q, "q", query.q);
+    setIfDefined(q, "legalEntityId", query.legalEntityId);
+    setIfDefined(q, "pageNumber", query.pageNumber);
+    setIfDefined(q, "pageSize", query.pageSize);
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${segmentId}/items`,
+      auth: requireCustomer(auth2),
+      ...Object.keys(q).length ? { query: q } : {}
+    });
+  }
+  /** Category tree built only from the caller's active segments. */
+  async getCategoryTree(query = {}, auth2) {
+    const q = {};
+    setIfDefined(q, "siteCode", query.siteCode);
+    setIfDefined(q, "legalEntityId", query.legalEntityId);
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/items/category-trees`,
+      auth: requireCustomer(auth2),
+      ...Object.keys(q).length ? { query: q } : {}
+    });
+  }
+  async pickItemIds(kind, query, auth2) {
+    const rows = await this.listItems(query, auth2);
+    const ids = [];
+    for (const r of rows) {
+      const id = r.item?.id;
+      if (r.type === kind && typeof id === "string") ids.push(id);
+    }
+    return ids;
+  }
+  /** Product ids assigned to the caller's active segments. */
+  async listMyProductIds(query, auth2) {
+    return this.pickItemIds("PRODUCT", query ?? {}, auth2);
+  }
+  /** Category ids assigned to the caller's active segments. */
+  async listMyCategoryIds(query, auth2) {
+    return this.pickItemIds("CATEGORY", query ?? {}, auth2);
+  }
+  /**
+   * Hydrates `listMyProductIds` via `ProductService.get` in parallel.
+   * Resolves in the same order as the id list. Any single failure rejects
+   * the whole batch (`Promise.all`); use the id-list method + your own
+   * tolerance strategy if partial success matters.
+   */
+  async listMyProducts(query, auth2) {
+    const pageNumber = query?.pageNumber ?? 1;
+    const pageSize = query?.pageSize ?? 20;
+    const sourceItems = await this.listItems(
+      { ...query ?? {}, pageNumber, pageSize },
+      auth2
+    );
+    const ids = [];
+    for (const r of sourceItems) {
+      if (r.type === "PRODUCT" && typeof r.item?.id === "string") ids.push(r.item.id);
+    }
+    const items = await this.deps.products.searchByIds(ids, void 0, auth2);
+    return { items, pageNumber, pageSize, hasNextPage: sourceItems.length === pageSize };
+  }
+  /**
+   * Hydrates a page of the caller's segment CATEGORY assignments into
+   * real categories via one bulk `categories.searchByIds` call. Same
+   * `hasNextPage` semantic as `listMyProducts`.
+   */
+  async listMyCategories(query, auth2) {
+    const pageNumber = query?.pageNumber ?? 1;
+    const pageSize = query?.pageSize ?? 20;
+    const sourceItems = await this.listItems(
+      { ...query ?? {}, pageNumber, pageSize },
+      auth2
+    );
+    const ids = [];
+    for (const r of sourceItems) {
+      if (r.type === "CATEGORY" && typeof r.item?.id === "string") ids.push(r.item.id);
+    }
+    const items = await this.deps.categories.searchByIds(ids, void 0, auth2);
+    return { items, pageNumber, pageSize, hasNextPage: sourceItems.length === pageSize };
+  }
+};
+
+// src/services/site.ts
+var ANON4 = auth.anonymous();
+var SiteService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** Lists active sites. */
+  async list(authCtx = ANON4) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/site/${this.ctx.tenant}/sites`,
+      auth: authCtx
+    });
+  }
+  /** Retrieves one site by code. */
+  async get(code, authCtx = ANON4) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/site/${this.ctx.tenant}/sites/${code}`,
+      auth: authCtx
+    });
+  }
+  /**
+   * Returns the tenant's default site (the one with `default: true`).
+   * Throws if no default is configured — a tenant should always have one.
+   */
+  async current(authCtx = ANON4) {
+    const sites = await this.list(authCtx);
+    const def = sites.find((s) => s.default);
+    if (!def) {
+      throw new Error(
+        `SiteService.current: no default site for tenant "${this.ctx.tenant}"`
+      );
+    }
+    return def;
+  }
+};
+
+// src/services/session-context.ts
+var ANON5 = auth.anonymous();
+var SessionContextService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /**
+   * Retrieves the current session context, or `null` when the server returns
+   * 404 (no session exists yet — the session-context is created server-side
+   * only after the user creates a cart).
+   */
+  async get(authCtx = ANON5) {
+    try {
+      return await this.ctx.http.request({
+        method: "GET",
+        path: `/session-context/${this.ctx.tenant}/me/context`,
+        auth: authCtx
+      });
+    } catch (err) {
+      if (isNotFound(err)) return null;
+      throw err;
+    }
+  }
+  /**
+   * Partially updates the current session context. Returns `true` when the
+   * PATCH was applied, `false` when there is no session context yet (the
+   * server returned 404 on the version-lookup GET, so there is nothing to
+   * update). Non-404 errors propagate.
+   */
+  async patch(input, authCtx = ANON5) {
+    let version = input.version;
+    if (version === void 0) {
+      const current = await this.get(authCtx);
+      if (current === null) return false;
+      version = current.metadata?.version;
+      if (version === void 0) {
+        throw new Error(
+          "SessionContextService.patch: no metadata.version in server response"
+        );
+      }
+    }
+    const { version: _v, ...fields } = input;
+    await this.ctx.http.request({
+      method: "PATCH",
+      path: `/session-context/${this.ctx.tenant}/me/context`,
+      body: {
+        ...fields,
+        metadata: { version }
+      },
+      auth: authCtx
+    });
+    return true;
+  }
+};
+function isNotFound(err) {
+  if (err && typeof err === "object") {
+    const status = err.status;
+    if (typeof status === "number" && status === 404) return true;
+  }
+  return false;
+}
+
+// src/services/companies.ts
+var CompaniesService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/customer-management/${this.ctx.tenant}/legal-entities`;
+  }
+  /** Lists the legal entities the calling customer is assigned to. */
+  async listMine(auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      auth: auth2
+    });
+  }
+  /** Fetches a single legal entity by id. */
+  async get(legalEntityId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${legalEntityId}`,
+      auth: auth2
+    });
+  }
+  /** Creates a legal entity. Requires `customermanagement.legalentity_manage`. */
+  async create(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.base(),
+      auth: auth2,
+      body: input
+    });
+  }
+  /** Patches a legal entity. */
+  async update(legalEntityId, patch, auth2) {
+    return this.ctx.http.request({
+      method: "PATCH",
+      path: `${this.base()}/${legalEntityId}`,
+      auth: auth2,
+      body: patch
+    });
+  }
+  /** Deletes a legal entity (async cascade on the server). */
+  async delete(legalEntityId, auth2) {
+    await this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${legalEntityId}`,
+      auth: auth2
+    });
+  }
+};
+
+// src/services/contacts.ts
+var ContactsService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/customer-management/${this.ctx.tenant}/contact-assignments`;
+  }
+  /** Lists contact assignments for one legal entity. */
+  async listForCompany(legalEntityId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      query: { legalEntityId },
+      auth: auth2
+    });
+  }
+  /** Creates a contact assignment. */
+  async assign(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.base(),
+      auth: auth2,
+      body: input
+    });
+  }
+  /** Patches a contact assignment. */
+  async update(contactAssignmentId, patch, auth2) {
+    return this.ctx.http.request({
+      method: "PATCH",
+      path: `${this.base()}/${contactAssignmentId}`,
+      auth: auth2,
+      body: patch
+    });
+  }
+  /** Deletes a contact assignment. */
+  async unassign(contactAssignmentId, auth2) {
+    await this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${contactAssignmentId}`,
+      auth: auth2
+    });
+  }
+};
+
+// src/services/locations.ts
+var LocationsService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/customer-management/${this.ctx.tenant}/locations`;
+  }
+  /** Lists locations owned by one legal entity. */
+  async listForCompany(legalEntityId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      query: { legalEntityId },
+      auth: auth2
+    });
+  }
+  /** Fetches one location by id. */
+  async get(locationId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${locationId}`,
+      auth: auth2
+    });
+  }
+  /** Creates a location for a legal entity. */
+  async create(input, auth2) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.base(),
+      auth: auth2,
+      body: input
+    });
+  }
+  /** Patches a location. */
+  async update(locationId, patch, auth2) {
+    return this.ctx.http.request({
+      method: "PATCH",
+      path: `${this.base()}/${locationId}`,
+      auth: auth2,
+      body: patch
+    });
+  }
+  /** Deletes a location. */
+  async delete(locationId, auth2) {
+    await this.ctx.http.request({
+      method: "DELETE",
+      path: `${this.base()}/${locationId}`,
+      auth: auth2
+    });
+  }
+};
+
+// src/services/customer-groups.ts
+var CustomerGroupsService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/iam/${this.ctx.tenant}/groups`;
+  }
+  /** Lists customer groups belonging to one legal entity. */
+  async listForCompany(legalEntityId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      query: { "b2b.legalEntityId": legalEntityId },
+      auth: auth2
+    });
+  }
+};
+
+// src/services/orders.ts
+function setIfDefined2(q, key, value) {
+  if (value !== void 0 && value !== "") {
+    q[key] = value;
+  }
+}
+var OrdersService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/order-v2/${this.ctx.tenant}/orders`;
+  }
+  saasHeader(saasToken) {
+    return saasToken ? { "saas-token": saasToken } : void 0;
+  }
+  /** Lists the calling customer's orders. */
+  async listMine(auth2, opts = {}) {
+    const query = {};
+    setIfDefined2(query, "pageNumber", opts.pageNumber);
+    setIfDefined2(query, "pageSize", opts.pageSize);
+    setIfDefined2(query, "status", opts.status);
+    setIfDefined2(query, "legalEntityId", opts.legalEntityId);
+    setIfDefined2(query, "siteCode", opts.siteCode);
+    const headers = this.saasHeader(opts.saasToken);
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.base(),
+      query,
+      auth: auth2,
+      ...headers ? { headers } : {}
+    });
+  }
+  /** Fetches one of the calling customer's orders by id. */
+  async get(orderId, auth2, opts = {}) {
+    const headers = this.saasHeader(opts.saasToken);
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${orderId}`,
+      auth: auth2,
+      ...headers ? { headers } : {}
+    });
+  }
+  /** Transitions an order to a new status. Server enforces legal transitions. */
+  async transition(orderId, status, auth2, opts = {}) {
+    const body = { status };
+    if (opts.comment !== void 0) body.comment = opts.comment;
+    const headers = this.saasHeader(opts.saasToken);
+    await this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/${orderId}/transitions`,
+      auth: auth2,
+      body,
+      ...headers ? { headers } : {}
+    });
+  }
+  /** Convenience: transitions to `DECLINED` (customer cancel). */
+  async cancel(orderId, auth2, opts = {}) {
+    await this.transition(orderId, "DECLINED", auth2, opts);
+  }
+};
+var SalesOrdersService = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  base() {
+    return `/order-v2/${this.ctx.tenant}/salesorders`;
+  }
+  /** Fetches a single sales-order by id. */
+  async get(orderId, auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${orderId}`,
+      auth: auth2
+    });
+  }
+  /** Patches an existing order (status, mixins, customAttributes, metadata). */
+  async update(orderId, patch, auth2, opts = {}) {
+    const query = {};
+    if (opts.recalculate === false) query.recalculate = "false";
+    return this.ctx.http.request({
+      method: "PATCH",
+      path: `${this.base()}/${orderId}`,
+      auth: auth2,
+      ...Object.keys(query).length > 0 ? { query } : {},
+      body: patch
+    });
+  }
+};
+
+// src/client.ts
+var SDK_VERSION = "0.0.0";
+var EmporixClient = class {
+  customers;
+  products;
+  categories;
+  carts;
+  checkout;
+  payments;
+  prices;
+  media;
+  segments;
+  sites;
+  sessionContext;
+  companies;
+  contacts;
+  locations;
+  customerGroups;
+  orders;
+  salesOrders;
+  /** The validated tenant this client is bound to. */
+  tenant;
+  /**
+   * The token provider in use by this client. Exposed so React/Next hosts can
+   * call `attachAnonymousStore` to wire session persistence. Treat as
+   * read-only — replacing it after construction is not supported.
+   */
+  tokenProvider;
+  /**
+   * The validated config used to construct this client. Exposed so React /
+   * Next hosts can read static settings such as `credentials.storefront.context`
+   * (siteCode, currency, targetLocation) without re-plumbing them through the
+   * Provider tree. Treat as read-only.
+   */
+  config;
+  resolver;
+  constructor(config) {
+    const cfg = validateConfig(config);
+    this.tenant = cfg.tenant;
+    this.config = cfg;
+    let loggerObj = {};
+    let baseLogger;
+    if (cfg.logger === false) {
+      baseLogger = createNoopLogger();
+    } else if (cfg.logger && typeof cfg.logger.child === "function") {
+      baseLogger = cfg.logger;
+    } else if (cfg.logger) {
+      loggerObj = cfg.logger;
+    }
+    this.resolver = new LevelResolver(loggerObj);
+    const root = baseLogger ?? createConsoleLogger(this.resolver, {
+      sdk: "emporix",
+      sdkVersion: SDK_VERSION,
+      tenant: cfg.tenant
+    });
+    const tokenProvider = cfg.tokenProvider ?? new DefaultTokenProvider(cfg);
+    this.tokenProvider = tokenProvider;
+    const mk = (service) => ({
+      tenant: cfg.tenant,
+      tokenProvider,
+      logger: root.child({ service }),
+      http: new HttpClient({
+        host: cfg.host,
+        provider: tokenProvider,
+        logger: root.child({ service: "http" }),
+        retry: cfg.retry,
+        timeouts: cfg.timeouts
+      })
+    });
+    this.customers = new CustomerService(mk("customer"));
+    this.products = new ProductService(mk("product"));
+    this.categories = new CategoryService(mk("category"));
+    this.carts = new CartService(mk("cart"));
+    this.checkout = new CheckoutService(mk("checkout"));
+    this.payments = new PaymentGatewayService(mk("payment"));
+    this.prices = new PriceService(mk("price"));
+    this.media = new MediaService(mk("media"));
+    this.segments = new SegmentService(mk("segment"), {
+      products: this.products,
+      categories: this.categories
+    });
+    this.sites = new SiteService(mk("site"));
+    this.sessionContext = new SessionContextService(mk("session-context"));
+    this.companies = new CompaniesService(mk("customer-management"));
+    this.contacts = new ContactsService(mk("customer-management"));
+    this.locations = new LocationsService(mk("customer-management"));
+    this.customerGroups = new CustomerGroupsService(mk("iam"));
+    this.orders = new OrdersService(mk("orders"));
+    this.salesOrders = new SalesOrdersService(mk("sales-orders"));
+  }
+  /** Sets the runtime log level globally or for one service. */
+  setLogLevel(level, opts = {}) {
+    this.resolver.set(level, opts.service, opts.force ?? false);
+  }
+  /** Returns the effective log level for a service. */
+  getLogLevel(service) {
+    return this.resolver.get(service);
+  }
+};
+
+exports.CartService = CartService;
+exports.CategoryService = CategoryService;
+exports.CheckoutService = CheckoutService;
+exports.CompaniesService = CompaniesService;
+exports.ContactsService = ContactsService;
+exports.CustomerGroupsService = CustomerGroupsService;
+exports.CustomerService = CustomerService;
+exports.DEFAULT_HOST = DEFAULT_HOST;
+exports.DefaultTokenProvider = DefaultTokenProvider;
+exports.EmporixAuthError = EmporixAuthError;
+exports.EmporixClient = EmporixClient;
+exports.EmporixError = EmporixError;
+exports.EmporixForbiddenError = EmporixForbiddenError;
+exports.EmporixInsufficientScopeError = EmporixInsufficientScopeError;
+exports.EmporixNotFoundError = EmporixNotFoundError;
+exports.EmporixServerError = EmporixServerError;
+exports.EmporixValidationError = EmporixValidationError;
+exports.HttpClient = HttpClient;
+exports.LEVEL = LEVEL;
+exports.LevelResolver = LevelResolver;
+exports.LocationsService = LocationsService;
+exports.MediaService = MediaService;
+exports.OrdersService = OrdersService;
+exports.PaymentGatewayService = PaymentGatewayService;
+exports.PriceService = PriceService;
+exports.ProductService = ProductService;
+exports.SalesOrdersService = SalesOrdersService;
+exports.SegmentService = SegmentService;
+exports.SessionContextService = SessionContextService;
+exports.SiteService = SiteService;
+exports.auth = auth;
+exports.createConsoleLogger = createConsoleLogger;
+exports.createNoopLogger = createNoopLogger;
+exports.errorFromResponse = errorFromResponse;
+exports.iterateAll = iterateAll;
+exports.redact = redact;
+exports.resolveToken = resolveToken;
+exports.validateConfig = validateConfig;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map