@viu/emporix-sdk 2.14.0 → 2.16.0

package/dist/locations.cjs

@@ -6,6 +6,7 @@ var LocationsService = class {
     this.ctx = ctx;
   }
   ctx;
+  static channel = "customer-management";
   base() {
     return `/customer-management/${this.ctx.tenant}/locations`;
   }

package/dist/locations.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/services/locations.ts"],"names":[],"mappings":";;;AAeO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAErB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,UAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAwC;AAClF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAoB;AAAA,MACvC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA,EAAO,EAAE,aAAA,EAAc;AAAA,MACvB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,UAAA,EAAoB,IAAA,EAAsC;AAClE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAAuB,IAAA,EAA4C;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,CACJ,UAAA,EACA,KAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,OAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,UAAA,EAAoB,IAAA,EAAkC;AACjE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"locations.cjs","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  Location,\n  LocationCreate,\n  LocationUpdate,\n} from \"../generated/customer-management\";\n\n/**\n * Manages locations owned by a legal entity. Three types are supported:\n * HEADQUARTER, WAREHOUSE, OFFICE.\n *\n * Reads require `customermanagement.location_read`; mutations require\n * `_manage`.\n */\nexport class LocationsService {\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/locations`;\n  }\n\n  /** Lists locations owned by one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<Location[]> {\n    return this.ctx.http.request<Location[]>({\n      method: \"GET\",\n      path: this.base(),\n      query: { legalEntityId },\n      auth,\n    });\n  }\n\n  /** Fetches one location by id. */\n  async get(locationId: string, auth: AuthContext): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"GET\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n\n  /** Creates a location for a legal entity. */\n  async create(input: LocationCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Patches a location. PATCH endpoint, so the body is a partial of the\n   * generated `LocationUpdate` shape.\n   */\n  async update(\n    locationId: string,\n    patch: Partial<LocationUpdate>,\n    auth: AuthContext,\n  ): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"PATCH\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a location. */\n  async delete(locationId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n}\n"]}
+{"version":3,"sources":["../src/services/locations.ts"],"names":[],"mappings":";;;AAeO,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,qBAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,UAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAwC;AAClF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAoB;AAAA,MACvC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA,EAAO,EAAE,aAAA,EAAc;AAAA,MACvB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,UAAA,EAAoB,IAAA,EAAsC;AAClE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAAuB,IAAA,EAA4C;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,CACJ,UAAA,EACA,KAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,OAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,UAAA,EAAoB,IAAA,EAAkC;AACjE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"locations.cjs","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  Location,\n  LocationCreate,\n  LocationUpdate,\n} from \"../generated/customer-management\";\n\n/**\n * Manages locations owned by a legal entity. Three types are supported:\n * HEADQUARTER, WAREHOUSE, OFFICE.\n *\n * Reads require `customermanagement.location_read`; mutations require\n * `_manage`.\n */\nexport class LocationsService {\n  static readonly channel = \"customer-management\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/locations`;\n  }\n\n  /** Lists locations owned by one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<Location[]> {\n    return this.ctx.http.request<Location[]>({\n      method: \"GET\",\n      path: this.base(),\n      query: { legalEntityId },\n      auth,\n    });\n  }\n\n  /** Fetches one location by id. */\n  async get(locationId: string, auth: AuthContext): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"GET\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n\n  /** Creates a location for a legal entity. */\n  async create(input: LocationCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Patches a location. PATCH endpoint, so the body is a partial of the\n   * generated `LocationUpdate` shape.\n   */\n  async update(\n    locationId: string,\n    patch: Partial<LocationUpdate>,\n    auth: AuthContext,\n  ): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"PATCH\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a location. */\n  async delete(locationId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/locations.d.cts

@@ -11,6 +11,7 @@ export { c as ContactDetails } from './types.gen-C_wOXYZB.cjs';
  */
 declare class LocationsService {
     private readonly ctx;
+    static readonly channel: "customer-management";
     constructor(ctx: ClientContext);
     private base;
     /** Lists locations owned by one legal entity. */

package/dist/locations.d.ts

@@ -11,6 +11,7 @@ export { c as ContactDetails } from './types.gen-C_wOXYZB.js';
  */
 declare class LocationsService {
     private readonly ctx;
+    static readonly channel: "customer-management";
     constructor(ctx: ClientContext);
     private base;
     /** Lists locations owned by one legal entity. */

package/dist/locations.js

@@ -1,3 +1,3 @@
-export { LocationsService } from './chunk-LGLFJL3S.js';
+export { LocationsService } from './chunk-DUVIIWFG.js';
 //# sourceMappingURL=locations.js.map
 //# sourceMappingURL=locations.js.map

package/dist/media.cjs

@@ -93,6 +93,7 @@ var MediaService = class {
     this.ctx = ctx;
   }
   ctx;
+  static channel = "media";
   base() {
     return `/media/${this.ctx.tenant}/assets`;
   }

package/dist/media.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/errors.ts","../src/services/media.ts"],"names":["text"],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;AAE7C,IAAM,qBAAA,GAAN,cAAoC,YAAA,CAAa;AAAC,CAAA;AAElD,IAAM,oBAAA,GAAN,cAAmC,YAAA,CAAa;AAAC,CAAA;AAEjD,IAAM,sBAAA,GAAN,cAAqC,YAAA,CAAa;AAAC,CAAA;AAEnD,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAC,CAAA;AAU/C,IAAM,6BAAA,GAAN,cAA4C,qBAAA,CAAsB;AAAA,EAC9D,aAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe,aAAA,EAAwB;AAClF,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,IAAI,CAAA;AAC3B,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF,CAAA;AAEA,IAAM,aAAA,GAAgB,mCAAA;AAEtB,SAAS,qBAAqB,IAAA,EAAmC;AAC/D,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,aAAa,IAAA,EAAM;AACzD,IAAA,MAAM,UAAW,IAAA,CAA+B,OAAA;AAChD,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC1B,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,UAAA,MAAM,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,aAAa,CAAA;AAC/B,UAAA,IAAI,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,iBAAA,CAAkB,MAAA,EAAgB,OAAA,EAAiB,IAAA,EAA6B;AAC9F,EAAA,IAAI,WAAW,GAAA,EAAK,OAAO,IAAI,gBAAA,CAAiB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACrE,EAAA,IAAI,WAAW,GAAA,EAAK;AAClB,IAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAI,CAAA;AACvC,IAAA,IAAI,OAAO,OAAO,IAAI,8BAA8B,OAAA,EAAS,MAAA,EAAQ,MAAM,KAAK,CAAA;AAChF,IAAA,OAAO,IAAI,qBAAA,CAAsB,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EACxD;AACA,EAAA,IAAI,WAAW,GAAA,EAAK,OAAO,IAAI,oBAAA,CAAqB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACzE,EAAA,IAAI,MAAA,KAAW,OAAO,MAAA,KAAW,GAAA,SAAY,IAAI,sBAAA,CAAuB,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAC7F,EAAA,IAAI,UAAU,GAAA,EAAK,OAAO,IAAI,kBAAA,CAAmB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACtE,EAAA,OAAO,IAAI,YAAA,CAAa,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAC/C;;;ACpCA,IAAM,OAAA,GAAuB,EAAE,IAAA,EAAM,SAAA,EAAU;AAE/C,SAAS,YAAA,CAAa,GAAe,SAAA,EAA4B;AAC/D,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,EAAA,KAAO,SAAA;AAC1C;AAMO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAErB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EAGA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAA,CACJ,KAAA,GAAyB,EAAC,EAC1B,OAAoB,OAAA,EACY;AAChC,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,EAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MACjD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,KAAA,EAAO,EAAE,GAAG,KAAA,EAAO,YAAY,QAAA;AAAS,KACzC,CAAA;AACD,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,UAAA;AAAA,MACA,QAAA;AAAA,MACA,WAAA,EAAa,MAAM,MAAA,KAAW;AAAA,KAChC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAyB;AACtE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,MAAA,CACJ,OAAA,EACA,KAAA,EAGA,OAAoB,OAAA,EACJ;AAChB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,QAC/B,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAwB;AACxE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,QAAA,CACJ,OAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,SAAA,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,UAAA;AAAA,MAC9B,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAAA,MAC5B,EAAE,UAAU,QAAA;AAAS,KACvB;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,gBAAA,EAAmB,IAAI,MAAM,CAAA,mCAAA,CAAA;AAAA,UAC7B,GAAA,CAAI;AAAA,SACN;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAA,EAAI;AAAA,IACjC;AAGA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AACxC,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,MAAA;AACvD,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAIzC,QAAA,MAAMA,KAAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,MAAM,GAAA,GAAM,KAAKA,KAAI,CAAA;AACrB,QAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,QAAA,IAAA,GAAO,GAAA,CAAI,MAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,GAAO,MAAM,IAAI,WAAA,EAAY;AAAA,MAC/B;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA;AAAA,QACA,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB;AAAC,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,MAAA,GAAkB,MAAA;AACtB,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC1B,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,GAAS,IAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,MAAM,iBAAA,CAAkB,IAAI,MAAA,EAAQ,CAAA,IAAA,EAAO,IAAI,CAAA,QAAA,EAAM,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,KAAA,EAOA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAA,CACJ,OAAA,EACA,KAAA,EAOA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,OAAA,KAAY,MAAA,GAClB,EAAE,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,EAAE,GACvC;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,IAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD;AAAC,KACP;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,EAAE,MAAM,MAAA,EAAQ,IAAA,IAAQ,IAAI,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,eAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,KAAM,aAAa,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,OAAO,CAAA;AAC3D,IAAA,MAAM,IAAA,GAAqB,CAAC,GAAG,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,SAAA,EAAW,CAAA;AAGzE,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,CAAA,EAAG,SAAS,CAAC,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAC1C,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,GAAoB,OAAA,EACY;AAChC,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,WAAA,EAAa,SAAA,IAAa,IAAI,CAAA;AAAA,EACnD;AACF;AAIO,IAAM,cAAA,GAAiB,EAAE,YAAA","file":"media.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixError, errorFromResponse } from \"../core/errors\";\nimport type {\n  AssetCreateBlob,\n  AssetCreateLink,\n  AssetUpdateBlob,\n  AssetUpdateLink,\n  GetAsset,\n  RefId,\n} from \"../generated/media\";\n\n/** Generated media types (caller sends the exact wire shape). */\nexport type AssetCreateBlobInput = AssetCreateBlob;\nexport type AssetCreateLinkInput = AssetCreateLink;\nexport type AssetUpdateBlobInput = AssetUpdateBlob;\nexport type AssetUpdateLinkInput = AssetUpdateLink;\nexport type AssetUpdateInput = AssetUpdateBlob | AssetUpdateLink;\nexport type Asset = GetAsset;\nexport type AssetRefId = RefId;\n\n/**\n * Filter / pagination options for {@link MediaService.list}. The explicit\n * fields are typed for autocomplete; the index signature stays open so\n * Emporix `q`-syntax filters like `\"refIds.id\"` can be passed verbatim.\n */\nexport interface ListAssetsQuery {\n  pageNumber?: number;\n  pageSize?: number;\n  /** Emporix sort syntax, e.g. `\"name,metadata.createdAt:desc\"`. */\n  sort?: string;\n  /** Emporix `q`-syntax filter, e.g. `\"name:hero\"`. */\n  q?: string;\n  [key: string]: string | number | undefined;\n}\n\n/**\n * Result of {@link MediaService.download}. The endpoint's behaviour depends\n * on the asset's `access`:\n * - `PUBLIC` assets respond with a 30x redirect whose `Location` header\n *   carries the externally-cacheable storage URL — useful when the\n *   storefront wants to send the user there directly.\n * - `PRIVATE` assets respond with the raw bytes (plus an `ETag` header\n *   for caching). The asset is delivered through Cloudinary behind the\n *   server-side service token, never publicly addressable.\n */\nexport type DownloadResult =\n  | { kind: \"redirect\"; url: string }\n  | {\n      kind: \"bytes\";\n      data: ArrayBuffer;\n      etag?: string;\n      contentType?: string;\n    };\n\nconst SERVICE: AuthContext = { kind: \"service\" };\n\nfunction isProductRef(r: AssetRefId, productId: string): boolean {\n  return r.type === \"PRODUCT\" && r.id === productId;\n}\n\n/**\n * Media assets (BLOB/LINK). All endpoints require a backend-only scope\n * (`media.asset_manage` / `media.asset_read`) — default auth: service.\n */\nexport class MediaService {\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/media/${this.ctx.tenant}/assets`;\n  }\n\n  /** Create an asset. BLOB uploads via multipart; LINK via JSON. */\n  async create(\n    input:\n      | { kind: \"blob\"; file: Blob; body: AssetCreateBlobInput }\n      | { kind: \"link\"; body: AssetCreateLinkInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<{ id: string }>({\n        method: \"POST\",\n        path: this.base(),\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input.body,\n    });\n  }\n\n  /**\n   * List assets, wrapped in the shared {@link PaginatedItems} envelope so\n   * callers can iterate over pages consistently with the rest of the SDK.\n   * `hasNextPage` is the standard SDK heuristic: `true` when the returned\n   * page is full (`items.length === requested pageSize`). Pagination\n   * defaults match Emporix's server defaults (`pageNumber: 1`,\n   * `pageSize: 60`) so an empty `query` produces stable expectations.\n   */\n  async list(\n    query: ListAssetsQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    const pageNumber = query.pageNumber ?? 1;\n    const pageSize = query.pageSize ?? 60;\n    const items = await this.ctx.http.request<Asset[]>({\n      method: \"GET\",\n      path: this.base(),\n      auth,\n      query: { ...query, pageNumber, pageSize },\n    });\n    return {\n      items,\n      pageNumber,\n      pageSize,\n      hasNextPage: items.length === pageSize,\n    };\n  }\n\n  /** Fetch an asset by id. */\n  async get(assetId: string, auth: AuthContext = SERVICE): Promise<Asset> {\n    return this.ctx.http.request<Asset>({\n      method: \"GET\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Update an asset. The input is a discriminated union mirroring\n   * {@link create}:\n   * - `{ kind: \"json\", body }` — metadata-only patch (BLOB or LINK).\n   *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,\n   *   or `url` changes.\n   * - `{ kind: \"blob\", file, body }` — replaces the BLOB file content\n   *   (max 10MB) AND patches metadata in the same request. Sends\n   *   `multipart/form-data`.\n   *\n   * `type` and `access` are immutable per Emporix — they must match the\n   * existing asset's values. Optimistic-locking is via `body.metadata.version`;\n   * the server returns 409 Conflict on a stale version.\n   */\n  async update(\n    assetId: string,\n    input:\n      | { kind: \"json\"; body: AssetUpdateInput }\n      | { kind: \"blob\"; file: Blob; body: AssetUpdateBlobInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<Asset>({\n        method: \"PUT\",\n        path: `${this.base()}/${assetId}`,\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<Asset>({\n      method: \"PUT\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n      body: input.body,\n    });\n  }\n\n  /** Remove an asset. */\n  async remove(assetId: string, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Download an asset by id. Returns a discriminated union:\n   * - `{ kind: \"redirect\", url }` for `PUBLIC` assets (server-side 30x with\n   *   the storage URL in `Location`).\n   * - `{ kind: \"bytes\", data }` for `PRIVATE` assets (server-side 200 with\n   *   the asset bytes; `etag` + `contentType` headers are exposed for\n   *   caching). When the server reports `text/plain` Content-Type (the\n   *   OpenAPI-documented format), the SDK decodes the base64 stream into\n   *   an `ArrayBuffer` transparently; binary Content-Types are passed\n   *   through verbatim.\n   *\n   * Implementation note: uses `redirect: \"manual\"` so the redirect-location\n   * is observable. In Node.js this works; in a browser the redirect Location\n   * is intentionally hidden by fetch — there, `PUBLIC` downloads will\n   * surface as an opaque-redirect and the SDK throws. Browser code should\n   * use the asset's `url` field from `get()` for `LINK` assets, or the\n   * direct storage URL for `PUBLIC` `BLOB` assets (typically delivered via\n   * an `<img>` tag rather than `download()`).\n   */\n  async download(\n    assetId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<DownloadResult> {\n    const path = `${this.base()}/${assetId}/download`;\n    const res = await this.ctx.http.requestRaw(\n      { method: \"GET\", path, auth },\n      { redirect: \"manual\" },\n    );\n\n    // PUBLIC: server-side redirect — capture Location.\n    if (res.status >= 300 && res.status < 400) {\n      const url = res.headers.get(\"location\");\n      if (!url) {\n        throw new EmporixError(\n          `media.download: ${res.status} response without a Location header`,\n          res.status,\n        );\n      }\n      return { kind: \"redirect\", url };\n    }\n\n    // PRIVATE: bytes.\n    if (res.ok) {\n      const etag = res.headers.get(\"etag\") ?? undefined;\n      const contentType = res.headers.get(\"content-type\") ?? undefined;\n      let data: ArrayBuffer;\n      if (contentType?.startsWith(\"text/plain\")) {\n        // Per OpenAPI spec the server returns the byte stream as a\n        // base64-encoded text/plain body. Decode once into raw bytes\n        // so callers always see an ArrayBuffer.\n        const text = await res.text();\n        const bin = atob(text);\n        const arr = new Uint8Array(bin.length);\n        for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);\n        data = arr.buffer;\n      } else {\n        data = await res.arrayBuffer();\n      }\n      return {\n        kind: \"bytes\",\n        data,\n        ...(etag !== undefined ? { etag } : {}),\n        ...(contentType !== undefined ? { contentType } : {}),\n      };\n    }\n\n    // Error: surface via the standard EmporixError hierarchy.\n    const text = await res.text();\n    let parsed: unknown = undefined;\n    if (text) {\n      try {\n        parsed = JSON.parse(text);\n      } catch {\n        parsed = text;\n      }\n    }\n    throw errorFromResponse(res.status, `GET ${path} → ${res.status}`, parsed);\n  }\n\n  /** Multipart upload sugar: builds `AssetCreateBlob` from input. */\n  async uploadFile(\n    input: {\n      file: Blob;\n      productId?: string;\n      filename?: string;\n      mimeType?: string;\n      access?: \"PUBLIC\" | \"PRIVATE\";\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateBlobInput = {\n      type: \"BLOB\",\n      access: input.access ?? \"PUBLIC\",\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n    };\n    return this.create({ kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /**\n   * Replace the file content of an existing BLOB asset. Sugar over\n   * {@link update} with `kind: \"blob\"`. `access` is required because the\n   * field is immutable and the server validates that the patch matches.\n   * Pass `version` from `asset.metadata.version` if you want optimistic\n   * locking (recommended when concurrent writers are possible).\n   */\n  async replaceFile(\n    assetId: string,\n    input: {\n      file: Blob;\n      access: \"PUBLIC\" | \"PRIVATE\";\n      filename?: string;\n      mimeType?: string;\n      version?: number;\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const body: AssetUpdateBlobInput = {\n      type: \"BLOB\",\n      access: input.access,\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n      ...(input.version !== undefined\n        ? { metadata: { version: input.version } }\n        : {}),\n    };\n    return this.update(assetId, { kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /** External-URL sugar: builds `AssetCreateLink`. */\n  async link(\n    input: { url: string; productId?: string; access?: \"PUBLIC\" | \"PRIVATE\" },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateLinkInput = {\n      type: \"LINK\",\n      access: input.access ?? \"PUBLIC\",\n      url: input.url,\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n    };\n    return this.create({ kind: \"link\", body }, auth);\n  }\n\n  /** Idempotently add a PRODUCT refId to an asset. */\n  async attachToProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    if (refIds.some((r) => isProductRef(r, productId))) return a;\n    const next: AssetRefId[] = [...refIds, { type: \"PRODUCT\", id: productId }];\n    // Preserve the asset's type discriminator so the update body satisfies\n    // the AssetUpdateBlob | AssetUpdateLink union.\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Remove a PRODUCT refId from an asset (no-op if absent). */\n  async detachFromProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    const next = refIds.filter((r) => !isProductRef(r, productId));\n    if (next.length === refIds.length) return a;\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Convenience: list assets attached to a product (server-side filter). */\n  async listForProduct(\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    return this.list({ \"refIds.id\": productId }, auth);\n  }\n}\n\n// Re-export so consumers can `import { isProductRef } from \"@viu/emporix-sdk/media\"`?\n// Internal helper — kept module-private; convenience methods in Task 4 use it.\nexport const _internalMedia = { isProductRef };\n"]}
+{"version":3,"sources":["../src/core/errors.ts","../src/services/media.ts"],"names":["text"],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;AAE7C,IAAM,qBAAA,GAAN,cAAoC,YAAA,CAAa;AAAC,CAAA;AAElD,IAAM,oBAAA,GAAN,cAAmC,YAAA,CAAa;AAAC,CAAA;AAEjD,IAAM,sBAAA,GAAN,cAAqC,YAAA,CAAa;AAAC,CAAA;AAEnD,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAC,CAAA;AAU/C,IAAM,6BAAA,GAAN,cAA4C,qBAAA,CAAsB;AAAA,EAC9D,aAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe,aAAA,EAAwB;AAClF,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,IAAI,CAAA;AAC3B,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF,CAAA;AAEA,IAAM,aAAA,GAAgB,mCAAA;AAEtB,SAAS,qBAAqB,IAAA,EAAmC;AAC/D,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,aAAa,IAAA,EAAM;AACzD,IAAA,MAAM,UAAW,IAAA,CAA+B,OAAA;AAChD,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC1B,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,UAAA,MAAM,CAAA,GAAI,CAAA,CAAE,KAAA,CAAM,aAAa,CAAA;AAC/B,UAAA,IAAI,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,iBAAA,CAAkB,MAAA,EAAgB,OAAA,EAAiB,IAAA,EAA6B;AAC9F,EAAA,IAAI,WAAW,GAAA,EAAK,OAAO,IAAI,gBAAA,CAAiB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACrE,EAAA,IAAI,WAAW,GAAA,EAAK;AAClB,IAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAI,CAAA;AACvC,IAAA,IAAI,OAAO,OAAO,IAAI,8BAA8B,OAAA,EAAS,MAAA,EAAQ,MAAM,KAAK,CAAA;AAChF,IAAA,OAAO,IAAI,qBAAA,CAAsB,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,EACxD;AACA,EAAA,IAAI,WAAW,GAAA,EAAK,OAAO,IAAI,oBAAA,CAAqB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACzE,EAAA,IAAI,MAAA,KAAW,OAAO,MAAA,KAAW,GAAA,SAAY,IAAI,sBAAA,CAAuB,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAC7F,EAAA,IAAI,UAAU,GAAA,EAAK,OAAO,IAAI,kBAAA,CAAmB,OAAA,EAAS,QAAQ,IAAI,CAAA;AACtE,EAAA,OAAO,IAAI,YAAA,CAAa,OAAA,EAAS,MAAA,EAAQ,IAAI,CAAA;AAC/C;;;ACpCA,IAAM,OAAA,GAAuB,EAAE,IAAA,EAAM,SAAA,EAAU;AAE/C,SAAS,YAAA,CAAa,GAAe,SAAA,EAA4B;AAC/D,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,EAAA,KAAO,SAAA;AAC1C;AAMO,IAAM,eAAN,MAAmB;AAAA,EAExB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,OAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EAGA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAA,CACJ,KAAA,GAAyB,EAAC,EAC1B,OAAoB,OAAA,EACY;AAChC,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,EAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MACjD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,KAAA,EAAO,EAAE,GAAG,KAAA,EAAO,YAAY,QAAA;AAAS,KACzC,CAAA;AACD,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,UAAA;AAAA,MACA,QAAA;AAAA,MACA,WAAA,EAAa,MAAM,MAAA,KAAW;AAAA,KAChC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAyB;AACtE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,MAAA,CACJ,OAAA,EACA,KAAA,EAGA,OAAoB,OAAA,EACJ;AAChB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,QAC/B,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAwB;AACxE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,QAAA,CACJ,OAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,SAAA,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,UAAA;AAAA,MAC9B,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAAA,MAC5B,EAAE,UAAU,QAAA;AAAS,KACvB;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,gBAAA,EAAmB,IAAI,MAAM,CAAA,mCAAA,CAAA;AAAA,UAC7B,GAAA,CAAI;AAAA,SACN;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAA,EAAI;AAAA,IACjC;AAGA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AACxC,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,MAAA;AACvD,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAIzC,QAAA,MAAMA,KAAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,MAAM,GAAA,GAAM,KAAKA,KAAI,CAAA;AACrB,QAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,QAAA,IAAA,GAAO,GAAA,CAAI,MAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,GAAO,MAAM,IAAI,WAAA,EAAY;AAAA,MAC/B;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA;AAAA,QACA,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB;AAAC,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,MAAA,GAAkB,MAAA;AACtB,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC1B,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,GAAS,IAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,MAAM,iBAAA,CAAkB,IAAI,MAAA,EAAQ,CAAA,IAAA,EAAO,IAAI,CAAA,QAAA,EAAM,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA;AAAA,EAC3E;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,KAAA,EAOA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAA,CACJ,OAAA,EACA,KAAA,EAOA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,OAAA,KAAY,MAAA,GAClB,EAAE,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,EAAE,GACvC;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,IAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD;AAAC,KACP;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,EAAE,MAAM,MAAA,EAAQ,IAAA,IAAQ,IAAI,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,eAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,KAAM,aAAa,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,OAAO,CAAA;AAC3D,IAAA,MAAM,IAAA,GAAqB,CAAC,GAAG,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,SAAA,EAAW,CAAA;AAGzE,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,CAAA,EAAG,SAAS,CAAC,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAC1C,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,GAAoB,OAAA,EACY;AAChC,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,WAAA,EAAa,SAAA,IAAa,IAAI,CAAA;AAAA,EACnD;AACF;AAIO,IAAM,cAAA,GAAiB,EAAE,YAAA","file":"media.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixError, errorFromResponse } from \"../core/errors\";\nimport type {\n  AssetCreateBlob,\n  AssetCreateLink,\n  AssetUpdateBlob,\n  AssetUpdateLink,\n  GetAsset,\n  RefId,\n} from \"../generated/media\";\n\n/** Generated media types (caller sends the exact wire shape). */\nexport type AssetCreateBlobInput = AssetCreateBlob;\nexport type AssetCreateLinkInput = AssetCreateLink;\nexport type AssetUpdateBlobInput = AssetUpdateBlob;\nexport type AssetUpdateLinkInput = AssetUpdateLink;\nexport type AssetUpdateInput = AssetUpdateBlob | AssetUpdateLink;\nexport type Asset = GetAsset;\nexport type AssetRefId = RefId;\n\n/**\n * Filter / pagination options for {@link MediaService.list}. The explicit\n * fields are typed for autocomplete; the index signature stays open so\n * Emporix `q`-syntax filters like `\"refIds.id\"` can be passed verbatim.\n */\nexport interface ListAssetsQuery {\n  pageNumber?: number;\n  pageSize?: number;\n  /** Emporix sort syntax, e.g. `\"name,metadata.createdAt:desc\"`. */\n  sort?: string;\n  /** Emporix `q`-syntax filter, e.g. `\"name:hero\"`. */\n  q?: string;\n  [key: string]: string | number | undefined;\n}\n\n/**\n * Result of {@link MediaService.download}. The endpoint's behaviour depends\n * on the asset's `access`:\n * - `PUBLIC` assets respond with a 30x redirect whose `Location` header\n *   carries the externally-cacheable storage URL — useful when the\n *   storefront wants to send the user there directly.\n * - `PRIVATE` assets respond with the raw bytes (plus an `ETag` header\n *   for caching). The asset is delivered through Cloudinary behind the\n *   server-side service token, never publicly addressable.\n */\nexport type DownloadResult =\n  | { kind: \"redirect\"; url: string }\n  | {\n      kind: \"bytes\";\n      data: ArrayBuffer;\n      etag?: string;\n      contentType?: string;\n    };\n\nconst SERVICE: AuthContext = { kind: \"service\" };\n\nfunction isProductRef(r: AssetRefId, productId: string): boolean {\n  return r.type === \"PRODUCT\" && r.id === productId;\n}\n\n/**\n * Media assets (BLOB/LINK). All endpoints require a backend-only scope\n * (`media.asset_manage` / `media.asset_read`) — default auth: service.\n */\nexport class MediaService {\n  static readonly channel = \"media\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/media/${this.ctx.tenant}/assets`;\n  }\n\n  /** Create an asset. BLOB uploads via multipart; LINK via JSON. */\n  async create(\n    input:\n      | { kind: \"blob\"; file: Blob; body: AssetCreateBlobInput }\n      | { kind: \"link\"; body: AssetCreateLinkInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<{ id: string }>({\n        method: \"POST\",\n        path: this.base(),\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input.body,\n    });\n  }\n\n  /**\n   * List assets, wrapped in the shared {@link PaginatedItems} envelope so\n   * callers can iterate over pages consistently with the rest of the SDK.\n   * `hasNextPage` is the standard SDK heuristic: `true` when the returned\n   * page is full (`items.length === requested pageSize`). Pagination\n   * defaults match Emporix's server defaults (`pageNumber: 1`,\n   * `pageSize: 60`) so an empty `query` produces stable expectations.\n   */\n  async list(\n    query: ListAssetsQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    const pageNumber = query.pageNumber ?? 1;\n    const pageSize = query.pageSize ?? 60;\n    const items = await this.ctx.http.request<Asset[]>({\n      method: \"GET\",\n      path: this.base(),\n      auth,\n      query: { ...query, pageNumber, pageSize },\n    });\n    return {\n      items,\n      pageNumber,\n      pageSize,\n      hasNextPage: items.length === pageSize,\n    };\n  }\n\n  /** Fetch an asset by id. */\n  async get(assetId: string, auth: AuthContext = SERVICE): Promise<Asset> {\n    return this.ctx.http.request<Asset>({\n      method: \"GET\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Update an asset. The input is a discriminated union mirroring\n   * {@link create}:\n   * - `{ kind: \"json\", body }` — metadata-only patch (BLOB or LINK).\n   *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,\n   *   or `url` changes.\n   * - `{ kind: \"blob\", file, body }` — replaces the BLOB file content\n   *   (max 10MB) AND patches metadata in the same request. Sends\n   *   `multipart/form-data`.\n   *\n   * `type` and `access` are immutable per Emporix — they must match the\n   * existing asset's values. Optimistic-locking is via `body.metadata.version`;\n   * the server returns 409 Conflict on a stale version.\n   */\n  async update(\n    assetId: string,\n    input:\n      | { kind: \"json\"; body: AssetUpdateInput }\n      | { kind: \"blob\"; file: Blob; body: AssetUpdateBlobInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<Asset>({\n        method: \"PUT\",\n        path: `${this.base()}/${assetId}`,\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<Asset>({\n      method: \"PUT\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n      body: input.body,\n    });\n  }\n\n  /** Remove an asset. */\n  async remove(assetId: string, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Download an asset by id. Returns a discriminated union:\n   * - `{ kind: \"redirect\", url }` for `PUBLIC` assets (server-side 30x with\n   *   the storage URL in `Location`).\n   * - `{ kind: \"bytes\", data }` for `PRIVATE` assets (server-side 200 with\n   *   the asset bytes; `etag` + `contentType` headers are exposed for\n   *   caching). When the server reports `text/plain` Content-Type (the\n   *   OpenAPI-documented format), the SDK decodes the base64 stream into\n   *   an `ArrayBuffer` transparently; binary Content-Types are passed\n   *   through verbatim.\n   *\n   * Implementation note: uses `redirect: \"manual\"` so the redirect-location\n   * is observable. In Node.js this works; in a browser the redirect Location\n   * is intentionally hidden by fetch — there, `PUBLIC` downloads will\n   * surface as an opaque-redirect and the SDK throws. Browser code should\n   * use the asset's `url` field from `get()` for `LINK` assets, or the\n   * direct storage URL for `PUBLIC` `BLOB` assets (typically delivered via\n   * an `<img>` tag rather than `download()`).\n   */\n  async download(\n    assetId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<DownloadResult> {\n    const path = `${this.base()}/${assetId}/download`;\n    const res = await this.ctx.http.requestRaw(\n      { method: \"GET\", path, auth },\n      { redirect: \"manual\" },\n    );\n\n    // PUBLIC: server-side redirect — capture Location.\n    if (res.status >= 300 && res.status < 400) {\n      const url = res.headers.get(\"location\");\n      if (!url) {\n        throw new EmporixError(\n          `media.download: ${res.status} response without a Location header`,\n          res.status,\n        );\n      }\n      return { kind: \"redirect\", url };\n    }\n\n    // PRIVATE: bytes.\n    if (res.ok) {\n      const etag = res.headers.get(\"etag\") ?? undefined;\n      const contentType = res.headers.get(\"content-type\") ?? undefined;\n      let data: ArrayBuffer;\n      if (contentType?.startsWith(\"text/plain\")) {\n        // Per OpenAPI spec the server returns the byte stream as a\n        // base64-encoded text/plain body. Decode once into raw bytes\n        // so callers always see an ArrayBuffer.\n        const text = await res.text();\n        const bin = atob(text);\n        const arr = new Uint8Array(bin.length);\n        for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);\n        data = arr.buffer;\n      } else {\n        data = await res.arrayBuffer();\n      }\n      return {\n        kind: \"bytes\",\n        data,\n        ...(etag !== undefined ? { etag } : {}),\n        ...(contentType !== undefined ? { contentType } : {}),\n      };\n    }\n\n    // Error: surface via the standard EmporixError hierarchy.\n    const text = await res.text();\n    let parsed: unknown = undefined;\n    if (text) {\n      try {\n        parsed = JSON.parse(text);\n      } catch {\n        parsed = text;\n      }\n    }\n    throw errorFromResponse(res.status, `GET ${path} → ${res.status}`, parsed);\n  }\n\n  /** Multipart upload sugar: builds `AssetCreateBlob` from input. */\n  async uploadFile(\n    input: {\n      file: Blob;\n      productId?: string;\n      filename?: string;\n      mimeType?: string;\n      access?: \"PUBLIC\" | \"PRIVATE\";\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateBlobInput = {\n      type: \"BLOB\",\n      access: input.access ?? \"PUBLIC\",\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n    };\n    return this.create({ kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /**\n   * Replace the file content of an existing BLOB asset. Sugar over\n   * {@link update} with `kind: \"blob\"`. `access` is required because the\n   * field is immutable and the server validates that the patch matches.\n   * Pass `version` from `asset.metadata.version` if you want optimistic\n   * locking (recommended when concurrent writers are possible).\n   */\n  async replaceFile(\n    assetId: string,\n    input: {\n      file: Blob;\n      access: \"PUBLIC\" | \"PRIVATE\";\n      filename?: string;\n      mimeType?: string;\n      version?: number;\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const body: AssetUpdateBlobInput = {\n      type: \"BLOB\",\n      access: input.access,\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n      ...(input.version !== undefined\n        ? { metadata: { version: input.version } }\n        : {}),\n    };\n    return this.update(assetId, { kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /** External-URL sugar: builds `AssetCreateLink`. */\n  async link(\n    input: { url: string; productId?: string; access?: \"PUBLIC\" | \"PRIVATE\" },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateLinkInput = {\n      type: \"LINK\",\n      access: input.access ?? \"PUBLIC\",\n      url: input.url,\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n    };\n    return this.create({ kind: \"link\", body }, auth);\n  }\n\n  /** Idempotently add a PRODUCT refId to an asset. */\n  async attachToProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    if (refIds.some((r) => isProductRef(r, productId))) return a;\n    const next: AssetRefId[] = [...refIds, { type: \"PRODUCT\", id: productId }];\n    // Preserve the asset's type discriminator so the update body satisfies\n    // the AssetUpdateBlob | AssetUpdateLink union.\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Remove a PRODUCT refId from an asset (no-op if absent). */\n  async detachFromProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    const next = refIds.filter((r) => !isProductRef(r, productId));\n    if (next.length === refIds.length) return a;\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Convenience: list assets attached to a product (server-side filter). */\n  async listForProduct(\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    return this.list({ \"refIds.id\": productId }, auth);\n  }\n}\n\n// Re-export so consumers can `import { isProductRef } from \"@viu/emporix-sdk/media\"`?\n// Internal helper — kept module-private; convenience methods in Task 4 use it.\nexport const _internalMedia = { isProductRef };\n"]}

package/dist/media.d.cts

@@ -201,6 +201,7 @@ declare function isProductRef(r: AssetRefId, productId: string): boolean;
  */
 declare class MediaService {
     private readonly ctx;
+    static readonly channel: "media";
     constructor(ctx: ClientContext);
     private base;
     /** Create an asset. BLOB uploads via multipart; LINK via JSON. */

package/dist/media.d.ts

@@ -201,6 +201,7 @@ declare function isProductRef(r: AssetRefId, productId: string): boolean;
  */
 declare class MediaService {
     private readonly ctx;
+    static readonly channel: "media";
     constructor(ctx: ClientContext);
     private base;
     /** Create an asset. BLOB uploads via multipart; LINK via JSON. */

package/dist/media.js

@@ -1,4 +1,4 @@
-export { MediaService, _internalMedia } from './chunk-FU5WQALW.js';
+export { MediaService, _internalMedia } from './chunk-OTG2S2L4.js';
 import './chunk-UWGGF4MC.js';
 //# sourceMappingURL=media.js.map
 //# sourceMappingURL=media.js.map

package/dist/orders.cjs

@@ -11,6 +11,7 @@ var OrdersService = class {
     this.ctx = ctx;
   }
   ctx;
+  static channel = "orders";
   base() {
     return `/order-v2/${this.ctx.tenant}/orders`;
   }
@@ -71,6 +72,7 @@ var SalesOrdersService = class {
     this.ctx = ctx;
   }
   ctx;
+  static channel = "sales-orders";
   base() {
     return `/order-v2/${this.ctx.tenant}/salesorders`;
   }

package/dist/orders.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/services/orders.ts"],"names":[],"mappings":";;;AAsCA,SAAS,YAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,EAAA,EAAI;AACvC,IAAA,CAAA,CAAE,GAAG,CAAA,GAAI,KAAA;AAAA,EACX;AACF;AASO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAErB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EACrC;AAAA,EAEQ,WAAW,SAAA,EAAmE;AACpF,IAAA,OAAO,SAAA,GAAY,EAAE,YAAA,EAAc,SAAA,EAAU,GAAI,MAAA;AAAA,EACnD;AAAA;AAAA,EAGA,MAAM,QAAA,CACJ,IAAA,EACA,IAAA,GAA4B,EAAC,EACG;AAChC,IAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,EAAA;AAClC,IAAA,MAAM,KAAA,GAAqD;AAAA,MACzD,UAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,YAAA,CAAa,KAAA,EAAO,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA;AACzC,IAAA,YAAA,CAAa,KAAA,EAAO,eAAA,EAAiB,IAAA,CAAK,aAAa,CAAA;AACvD,IAAA,YAAA,CAAa,KAAA,EAAO,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAK9C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MACjD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AACD,IAAA,OAAO,EAAE,KAAA,EAAO,UAAA,EAAY,UAAU,WAAA,EAAa,KAAA,CAAM,WAAW,QAAA,EAAS;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAM,GAAA,CACJ,OAAA,EACA,IAAA,EACA,IAAA,GAAwB,EAAC,EACT;AAChB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,OAAA,EACA,QACA,IAAA,EACA,IAAA,GAA+B,EAAC,EACjB;AACf,IAAA,MAAM,IAAA,GAAkD,EAAE,MAAA,EAAO;AACjE,IAAA,IAAI,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AACpD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,YAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,OAAA,EACA,IAAA,EACA,IAAA,GAA+B,EAAC,EACjB;AACf,IAAA,MAAM,IAAA,CAAK,UAAA,CAAW,OAAA,EAAS,UAAA,EAAY,MAAM,IAAI,CAAA;AAAA,EACvD;AACF;AAWO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAErB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,EAAmC;AAC5D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,OAAA,EACA,OACA,IAAA,EACA,IAAA,GAAgC,EAAC,EACjB;AAChB,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,EAAO,KAAA,CAAM,WAAA,GAAc,OAAA;AACpD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,OAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACjD,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF","file":"orders.cjs","sourcesContent":["import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type { Order, OrderStatus, OrderUpdateDto } from \"../generated/order-v2\";\n\n/**\n * Salesorder PATCH body. The generated `orderUpdateDto` models a full order\n * (it requires `entries`/`customer`), but `PATCH /salesorders/{id}` accepts a\n * subset — so the SDK exposes a partial of it.\n */\nexport type SalesOrderPatch = Partial<OrderUpdateDto>;\n\n/** Optional fields supported by the order-v2 list endpoint. */\nexport interface ListMyOrdersOptions {\n  pageNumber?: number;\n  pageSize?: number;\n  status?: OrderStatus;\n  legalEntityId?: string;\n  siteCode?: string;\n  saasToken?: string;\n}\n\n/** Options for single-order reads (saas-token only). */\nexport interface GetOrderOptions {\n  saasToken?: string;\n}\n\n/** Options for status transitions. */\nexport interface OrderTransitionOptions {\n  saasToken?: string;\n  comment?: string;\n}\n\n/** Options for `salesOrders.update`. */\nexport interface UpdateSalesOrderOptions {\n  /** Forwarded as `?recalculate=`. Omit to use the server default (true). */\n  recalculate?: boolean;\n}\n\nfunction setIfDefined<V>(\n  q: Record<string, string | number | undefined>,\n  key: string,\n  value: V | undefined,\n): void {\n  if (value !== undefined && value !== \"\") {\n    q[key] = value as unknown as string | number;\n  }\n}\n\n/**\n * Storefront-customer access to Order-v2's customer endpoints.\n *\n * `listMine`/`get` require `order.order_read_own`; transitions require\n * `order.order_manage_own`. All methods accept an optional `saasToken` that\n * is passed as the `saas-token` header (mirrors `checkout.placeOrder`).\n */\nexport class OrdersService {\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/order-v2/${this.ctx.tenant}/orders`;\n  }\n\n  private saasHeader(saasToken: string | undefined): Record<string, string> | undefined {\n    return saasToken ? { \"saas-token\": saasToken } : undefined;\n  }\n\n  /** Lists the calling customer's orders. */\n  async listMine(\n    auth: AuthContext,\n    opts: ListMyOrdersOptions = {},\n  ): Promise<PaginatedItems<Order>> {\n    const pageNumber = opts.pageNumber ?? 1;\n    const pageSize = opts.pageSize ?? 50;\n    const query: Record<string, string | number | undefined> = {\n      pageNumber,\n      pageSize,\n    };\n    setIfDefined(query, \"status\", opts.status);\n    setIfDefined(query, \"legalEntityId\", opts.legalEntityId);\n    setIfDefined(query, \"siteCode\", opts.siteCode);\n    const headers = this.saasHeader(opts.saasToken);\n    // order-v2 returns a bare JSON array (the total count lives in the\n    // X-Total-Count header), not a {items,...} envelope — so wrap it into the\n    // shared PaginatedItems shape like every other paginated service.\n    // hasNextPage is inferred from the page being full.\n    const items = await this.ctx.http.request<Order[]>({\n      method: \"GET\",\n      path: this.base(),\n      query,\n      auth,\n      ...(headers ? { headers } : {}),\n    });\n    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };\n  }\n\n  /** Fetches one of the calling customer's orders by id. */\n  async get(\n    orderId: string,\n    auth: AuthContext,\n    opts: GetOrderOptions = {},\n  ): Promise<Order> {\n    const headers = this.saasHeader(opts.saasToken);\n    return this.ctx.http.request<Order>({\n      method: \"GET\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n      ...(headers ? { headers } : {}),\n    });\n  }\n\n  /** Transitions an order to a new status. Server enforces legal transitions. */\n  async transition(\n    orderId: string,\n    status: OrderStatus,\n    auth: AuthContext,\n    opts: OrderTransitionOptions = {},\n  ): Promise<void> {\n    const body: { status: OrderStatus; comment?: string } = { status };\n    if (opts.comment !== undefined) body.comment = opts.comment;\n    const headers = this.saasHeader(opts.saasToken);\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `${this.base()}/${orderId}/transitions`,\n      auth,\n      body,\n      ...(headers ? { headers } : {}),\n    });\n  }\n\n  /** Convenience: transitions to `DECLINED` (customer cancel). */\n  async cancel(\n    orderId: string,\n    auth: AuthContext,\n    opts: { saasToken?: string } = {},\n  ): Promise<void> {\n    await this.transition(orderId, \"DECLINED\", auth, opts);\n  }\n}\n\n/**\n * Backend / service-account access to the merchant-facing\n * `/salesorders/{id}` resource. Requires `order.order_read` (read) /\n * `order.order_manage` (update) scopes on a service token.\n *\n * The full admin list + filter surface is deferred to a follow-up\n * sub-spec. This service ships only single-resource read + patch — the\n * common backend use case (e.g. mixin updates after fulfilment).\n */\nexport class SalesOrdersService {\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/order-v2/${this.ctx.tenant}/salesorders`;\n  }\n\n  /** Fetches a single sales-order by id. */\n  async get(orderId: string, auth: AuthContext): Promise<Order> {\n    return this.ctx.http.request<Order>({\n      method: \"GET\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n    });\n  }\n\n  /** Patches an existing order (status, mixins, customAttributes, metadata). */\n  async update(\n    orderId: string,\n    patch: SalesOrderPatch,\n    auth: AuthContext,\n    opts: UpdateSalesOrderOptions = {},\n  ): Promise<Order> {\n    const query: Record<string, string> = {};\n    if (opts.recalculate === false) query.recalculate = \"false\";\n    return this.ctx.http.request<Order>({\n      method: \"PATCH\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n      ...(Object.keys(query).length > 0 ? { query } : {}),\n      body: patch,\n    });\n  }\n}\n"]}
+{"version":3,"sources":["../src/services/orders.ts"],"names":[],"mappings":";;;AAsCA,SAAS,YAAA,CACP,CAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,EAAA,EAAI;AACvC,IAAA,CAAA,CAAE,GAAG,CAAA,GAAI,KAAA;AAAA,EACX;AACF;AASO,IAAM,gBAAN,MAAoB;AAAA,EAEzB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,QAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EACrC;AAAA,EAEQ,WAAW,SAAA,EAAmE;AACpF,IAAA,OAAO,SAAA,GAAY,EAAE,YAAA,EAAc,SAAA,EAAU,GAAI,MAAA;AAAA,EACnD;AAAA;AAAA,EAGA,MAAM,QAAA,CACJ,IAAA,EACA,IAAA,GAA4B,EAAC,EACG;AAChC,IAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,CAAA;AACtC,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,EAAA;AAClC,IAAA,MAAM,KAAA,GAAqD;AAAA,MACzD,UAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,YAAA,CAAa,KAAA,EAAO,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA;AACzC,IAAA,YAAA,CAAa,KAAA,EAAO,eAAA,EAAiB,IAAA,CAAK,aAAa,CAAA;AACvD,IAAA,YAAA,CAAa,KAAA,EAAO,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAK9C,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MACjD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AACD,IAAA,OAAO,EAAE,KAAA,EAAO,UAAA,EAAY,UAAU,WAAA,EAAa,KAAA,CAAM,WAAW,QAAA,EAAS;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAM,GAAA,CACJ,OAAA,EACA,IAAA,EACA,IAAA,GAAwB,EAAC,EACT;AAChB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,OAAA,EACA,QACA,IAAA,EACA,IAAA,GAA+B,EAAC,EACjB;AACf,IAAA,MAAM,IAAA,GAAkD,EAAE,MAAA,EAAO;AACjE,IAAA,IAAI,IAAA,CAAK,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,IAAA,CAAK,OAAA;AACpD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,YAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC9B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,OAAA,EACA,IAAA,EACA,IAAA,GAA+B,EAAC,EACjB;AACf,IAAA,MAAM,IAAA,CAAK,UAAA,CAAW,OAAA,EAAS,UAAA,EAAY,MAAM,IAAI,CAAA;AAAA,EACvD;AACF;AAWO,IAAM,qBAAN,MAAyB;AAAA,EAE9B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,cAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,EAAmC;AAC5D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,OAAA,EACA,OACA,IAAA,EACA,IAAA,GAAgC,EAAC,EACjB;AAChB,IAAA,MAAM,QAAgC,EAAC;AACvC,IAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,EAAO,KAAA,CAAM,WAAA,GAAc,OAAA;AACpD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,OAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,KAAA,EAAM,GAAI,EAAC;AAAA,MACjD,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF","file":"orders.cjs","sourcesContent":["import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type { Order, OrderStatus, OrderUpdateDto } from \"../generated/order-v2\";\n\n/**\n * Salesorder PATCH body. The generated `orderUpdateDto` models a full order\n * (it requires `entries`/`customer`), but `PATCH /salesorders/{id}` accepts a\n * subset — so the SDK exposes a partial of it.\n */\nexport type SalesOrderPatch = Partial<OrderUpdateDto>;\n\n/** Optional fields supported by the order-v2 list endpoint. */\nexport interface ListMyOrdersOptions {\n  pageNumber?: number;\n  pageSize?: number;\n  status?: OrderStatus;\n  legalEntityId?: string;\n  siteCode?: string;\n  saasToken?: string;\n}\n\n/** Options for single-order reads (saas-token only). */\nexport interface GetOrderOptions {\n  saasToken?: string;\n}\n\n/** Options for status transitions. */\nexport interface OrderTransitionOptions {\n  saasToken?: string;\n  comment?: string;\n}\n\n/** Options for `salesOrders.update`. */\nexport interface UpdateSalesOrderOptions {\n  /** Forwarded as `?recalculate=`. Omit to use the server default (true). */\n  recalculate?: boolean;\n}\n\nfunction setIfDefined<V>(\n  q: Record<string, string | number | undefined>,\n  key: string,\n  value: V | undefined,\n): void {\n  if (value !== undefined && value !== \"\") {\n    q[key] = value as unknown as string | number;\n  }\n}\n\n/**\n * Storefront-customer access to Order-v2's customer endpoints.\n *\n * `listMine`/`get` require `order.order_read_own`; transitions require\n * `order.order_manage_own`. All methods accept an optional `saasToken` that\n * is passed as the `saas-token` header (mirrors `checkout.placeOrder`).\n */\nexport class OrdersService {\n  static readonly channel = \"orders\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/order-v2/${this.ctx.tenant}/orders`;\n  }\n\n  private saasHeader(saasToken: string | undefined): Record<string, string> | undefined {\n    return saasToken ? { \"saas-token\": saasToken } : undefined;\n  }\n\n  /** Lists the calling customer's orders. */\n  async listMine(\n    auth: AuthContext,\n    opts: ListMyOrdersOptions = {},\n  ): Promise<PaginatedItems<Order>> {\n    const pageNumber = opts.pageNumber ?? 1;\n    const pageSize = opts.pageSize ?? 50;\n    const query: Record<string, string | number | undefined> = {\n      pageNumber,\n      pageSize,\n    };\n    setIfDefined(query, \"status\", opts.status);\n    setIfDefined(query, \"legalEntityId\", opts.legalEntityId);\n    setIfDefined(query, \"siteCode\", opts.siteCode);\n    const headers = this.saasHeader(opts.saasToken);\n    // order-v2 returns a bare JSON array (the total count lives in the\n    // X-Total-Count header), not a {items,...} envelope — so wrap it into the\n    // shared PaginatedItems shape like every other paginated service.\n    // hasNextPage is inferred from the page being full.\n    const items = await this.ctx.http.request<Order[]>({\n      method: \"GET\",\n      path: this.base(),\n      query,\n      auth,\n      ...(headers ? { headers } : {}),\n    });\n    return { items, pageNumber, pageSize, hasNextPage: items.length === pageSize };\n  }\n\n  /** Fetches one of the calling customer's orders by id. */\n  async get(\n    orderId: string,\n    auth: AuthContext,\n    opts: GetOrderOptions = {},\n  ): Promise<Order> {\n    const headers = this.saasHeader(opts.saasToken);\n    return this.ctx.http.request<Order>({\n      method: \"GET\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n      ...(headers ? { headers } : {}),\n    });\n  }\n\n  /** Transitions an order to a new status. Server enforces legal transitions. */\n  async transition(\n    orderId: string,\n    status: OrderStatus,\n    auth: AuthContext,\n    opts: OrderTransitionOptions = {},\n  ): Promise<void> {\n    const body: { status: OrderStatus; comment?: string } = { status };\n    if (opts.comment !== undefined) body.comment = opts.comment;\n    const headers = this.saasHeader(opts.saasToken);\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `${this.base()}/${orderId}/transitions`,\n      auth,\n      body,\n      ...(headers ? { headers } : {}),\n    });\n  }\n\n  /** Convenience: transitions to `DECLINED` (customer cancel). */\n  async cancel(\n    orderId: string,\n    auth: AuthContext,\n    opts: { saasToken?: string } = {},\n  ): Promise<void> {\n    await this.transition(orderId, \"DECLINED\", auth, opts);\n  }\n}\n\n/**\n * Backend / service-account access to the merchant-facing\n * `/salesorders/{id}` resource. Requires `order.order_read` (read) /\n * `order.order_manage` (update) scopes on a service token.\n *\n * The full admin list + filter surface is deferred to a follow-up\n * sub-spec. This service ships only single-resource read + patch — the\n * common backend use case (e.g. mixin updates after fulfilment).\n */\nexport class SalesOrdersService {\n  static readonly channel = \"sales-orders\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/order-v2/${this.ctx.tenant}/salesorders`;\n  }\n\n  /** Fetches a single sales-order by id. */\n  async get(orderId: string, auth: AuthContext): Promise<Order> {\n    return this.ctx.http.request<Order>({\n      method: \"GET\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n    });\n  }\n\n  /** Patches an existing order (status, mixins, customAttributes, metadata). */\n  async update(\n    orderId: string,\n    patch: SalesOrderPatch,\n    auth: AuthContext,\n    opts: UpdateSalesOrderOptions = {},\n  ): Promise<Order> {\n    const query: Record<string, string> = {};\n    if (opts.recalculate === false) query.recalculate = \"false\";\n    return this.ctx.http.request<Order>({\n      method: \"PATCH\",\n      path: `${this.base()}/${orderId}`,\n      auth,\n      ...(Object.keys(query).length > 0 ? { query } : {}),\n      body: patch,\n    });\n  }\n}\n"]}

package/dist/orders.d.cts

@@ -1777,6 +1777,7 @@ interface UpdateSalesOrderOptions {
  */
 declare class OrdersService {
     private readonly ctx;
+    static readonly channel: "orders";
     constructor(ctx: ClientContext);
     private base;
     private saasHeader;
@@ -1802,6 +1803,7 @@ declare class OrdersService {
  */
 declare class SalesOrdersService {
     private readonly ctx;
+    static readonly channel: "sales-orders";
     constructor(ctx: ClientContext);
     private base;
     /** Fetches a single sales-order by id. */

package/dist/orders.d.ts

@@ -1777,6 +1777,7 @@ interface UpdateSalesOrderOptions {
  */
 declare class OrdersService {
     private readonly ctx;
+    static readonly channel: "orders";
     constructor(ctx: ClientContext);
     private base;
     private saasHeader;
@@ -1802,6 +1803,7 @@ declare class OrdersService {
  */
 declare class SalesOrdersService {
     private readonly ctx;
+    static readonly channel: "sales-orders";
     constructor(ctx: ClientContext);
     private base;
     /** Fetches a single sales-order by id. */

package/dist/orders.js

@@ -1,3 +1,3 @@
-export { OrdersService, SalesOrdersService } from './chunk-WW3H7VJ5.js';
+export { OrdersService, SalesOrdersService } from './chunk-62PCCHZ2.js';
 //# sourceMappingURL=orders.js.map
 //# sourceMappingURL=orders.js.map

package/dist/payment.cjs

@@ -41,32 +41,50 @@ var EmporixError = class extends Error {
 var EmporixAuthError = class extends EmporixError {
 };
 
+// src/core/auth.ts
+var auth = {
+  /** Service/custom credential set (default `backend`). */
+  service: (credentials) => credentials === void 0 ? { kind: "service" } : { kind: "service", credentials },
+  /** Cached anonymous storefront token. */
+  anonymous: () => ({ kind: "anonymous" }),
+  /** Caller-owned customer bearer token. */
+  customer: (token) => ({ kind: "customer", token }),
+  /** Exact token, no transformation (SSO / token-exchange). */
+  raw: (token) => ({ kind: "raw", token })
+};
+
 // src/core/require-customer.ts
-function requireCustomer(auth) {
-  if (auth && (auth.kind === "customer" || auth.kind === "raw")) return auth;
+function requireCustomer(auth2) {
+  if (auth2 && (auth2.kind === "customer" || auth2.kind === "raw")) return auth2;
   throw new EmporixAuthError("This operation requires a customer or raw AuthContext");
 }
 
 // src/services/payment.ts
+var ANON = auth.anonymous();
 var PaymentGatewayService = class {
   constructor(ctx) {
     this.ctx = ctx;
   }
   ctx;
-  /** Lists configured frontend payment modes. */
-  async listPaymentModes(auth) {
+  static channel = "payment";
+  /**
+   * Lists configured frontend payment modes. The endpoint requires a bearer
+   * token but no customer scope ("No scope required"), so it defaults to an
+   * anonymous context and works for guests and logged-in customers alike.
+   */
+  async listPaymentModes(authCtx = ANON) {
     return this.ctx.http.request({
       method: "GET",
       path: `/payment-gateway/${this.ctx.tenant}/paymentmodes/frontend`,
-      auth: requireCustomer(auth)
+      auth: authCtx
     });
   }
   /** Authorizes a post-checkout (deferred) payment for an existing order. */
-  async authorize(input, auth) {
+  async authorize(input, authCtx) {
     return this.ctx.http.request({
       method: "POST",
       path: `/payment-gateway/${this.ctx.tenant}/payment/frontend/authorize`,
-      auth: requireCustomer(auth),
+      auth: requireCustomer(authCtx),
       body: input
     });
   }

package/dist/payment.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/errors.ts","../src/core/require-customer.ts","../src/services/payment.ts"],"names":[],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;;;AC3B7C,SAAS,gBAAgB,IAAA,EAA4C;AAC1E,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,QAAQ,OAAO,IAAA;AACtE,EAAA,MAAM,IAAI,iBAAiB,uDAAuD,CAAA;AACpF;;;ACeO,IAAM,wBAAN,MAA4B;AAAA,EACjC,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA;AAAA,EAG7B,MAAM,iBAAiB,IAAA,EAA4C;AACjE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MACzC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,KAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAgC;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA;AAAA,MACzC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF","file":"payment.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { AuthContext } from \"./auth\";\nimport { EmporixAuthError } from \"./errors\";\n\n/**\n * Enforces a caller-owned customer or raw token. Throws `EmporixAuthError`\n * for any other `AuthContext` kind (or when `auth` is missing). Shared by\n * services whose endpoints require a customer scope (`/me`, payments,\n * customer-segments…).\n */\nexport function requireCustomer(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"raw\")) return auth;\n  throw new EmporixAuthError(\"This operation requires a customer or raw AuthContext\");\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixAuthError } from \"../core/errors\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  PaymentModeFrontendResponse,\n  AuthorizePaymentRequest,\n} from \"../generated/payment\";\n\n/** A frontend payment mode (generated). */\nexport type PaymentMode = PaymentModeFrontendResponse;\n\n/** Post-checkout authorize request (generated; caller sends the exact wire shape). */\nexport type AuthorizePaymentInput = AuthorizePaymentRequest;\n\n/** Post-checkout authorize result. */\nexport interface AuthorizePaymentResult {\n  successful: boolean;\n  paymentTransactionId?: string;\n  authorizationToken?: string;\n  requiresExternalPayment?: boolean;\n  externalPaymentRedirectURL?: string;\n  externalPaymentHttpMethod?: string;\n  [k: string]: unknown;\n}\n\n/** Payment-Gateway: list frontend payment modes, authorize deferred payments. */\nexport class PaymentGatewayService {\n  constructor(private readonly ctx: ClientContext) {}\n\n  /** Lists configured frontend payment modes. */\n  async listPaymentModes(auth?: AuthContext): Promise<PaymentMode[]> {\n    return this.ctx.http.request<PaymentMode[]>({\n      method: \"GET\",\n      path: `/payment-gateway/${this.ctx.tenant}/paymentmodes/frontend`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /** Authorizes a post-checkout (deferred) payment for an existing order. */\n  async authorize(\n    input: AuthorizePaymentInput,\n    auth?: AuthContext,\n  ): Promise<AuthorizePaymentResult> {\n    return this.ctx.http.request<AuthorizePaymentResult>({\n      method: \"POST\",\n      path: `/payment-gateway/${this.ctx.tenant}/payment/frontend/authorize`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n}\n"]}
+{"version":3,"sources":["../src/core/errors.ts","../src/core/auth.ts","../src/core/require-customer.ts","../src/services/payment.ts"],"names":["auth"],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;;;ACwD7C,IAAM,IAAA,GAAO;AAAA;AAAA,EAElB,OAAA,EAAS,CAAC,WAAA,KACR,WAAA,KAAgB,MAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAU,GAAI,EAAE,IAAA,EAAM,SAAA,EAAW,WAAA,EAAY;AAAA;AAAA,EAEnF,SAAA,EAAW,OAAoB,EAAE,IAAA,EAAM,WAAA,EAAY,CAAA;AAAA;AAAA,EAEnD,UAAU,CAAC,KAAA,MAAgC,EAAE,IAAA,EAAM,YAAY,KAAA,EAAM,CAAA;AAAA;AAAA,EAErE,KAAK,CAAC,KAAA,MAAgC,EAAE,IAAA,EAAM,OAAO,KAAA,EAAM;AAC7D,CAAA;;;AC7FO,SAAS,gBAAgBA,KAAAA,EAA4C;AAC1E,EAAA,IAAIA,UAASA,KAAAA,CAAK,IAAA,KAAS,cAAcA,KAAAA,CAAK,IAAA,KAAS,QAAQ,OAAOA,KAAAA;AACtE,EAAA,MAAM,IAAI,iBAAiB,uDAAuD,CAAA;AACpF;;;ACJA,IAAM,IAAA,GAAoB,KAAK,SAAA,EAAU;AAoBlC,IAAM,wBAAN,MAA4B;AAAA,EAEjC,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1B,MAAM,gBAAA,CAAiB,OAAA,GAAuB,IAAA,EAA8B;AAC1E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MACzC,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,KAAA,EACA,OAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAgC;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,iBAAA,EAAoB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA;AAAA,MACzC,IAAA,EAAM,gBAAgB,OAAO,CAAA;AAAA,MAC7B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF","file":"payment.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { ResolvedConfig, ServiceCredentials } from \"./config\";\nimport { EmporixAuthError, EmporixTimeoutError, EmporixNetworkError } from \"./errors\";\n\n/** Which token a call should use. */\nexport type AuthKind = \"service\" | \"customer\" | \"anonymous\" | \"raw\";\n\n/** Caller-supplied, per-call auth selector. Never stored on the client. */\nexport type AuthContext =\n  | { kind: \"service\"; credentials?: string }\n  | { kind: \"anonymous\" }\n  | { kind: \"customer\"; token: string }\n  | { kind: \"raw\"; token: string };\n\n/**\n * Supplies a fresh customer token when a `customer`-kind request 401s. The host\n * (e.g. EmporixProvider) implements this; the SDK never refreshes the\n * caller-owned customer token unless a refresher is registered.\n */\nexport interface CustomerTokenRefresher {\n  /**\n   * Called on a `customer`-kind 401. Receives the token that just failed;\n   * returns a fresh customer token to retry with, or `null` to give up (the\n   * 401 then propagates as EmporixAuthError).\n   */\n  refresh(expiredToken: string): Promise<string | null>;\n}\n\n/** An obtained anonymous storefront session. */\nexport interface AnonymousSession {\n  accessToken: string;\n  refreshToken: string;\n  sessionId: string;\n  expiresIn: number;\n}\n\n/**\n * Persistence callback for anonymous sessions. `read` is called once on the\n * first need for an anonymous token to bootstrap a possibly-existing session;\n * `write` is called after every successful login or refresh. `write(null)`\n * means the SDK is invalidating the stored session.\n */\nexport interface AnonymousSessionStore {\n  read(): { refreshToken: string; sessionId: string } | null;\n  write(session: { refreshToken: string; sessionId: string } | null): void;\n}\n\n/** Supplies SDK-managed tokens (service/custom + anonymous). May be user-injected. */\nexport interface TokenProvider {\n  /** Service/custom client-credentials token for the named credential set. */\n  getToken(credentialSet: string): Promise<string>;\n  /** Cached anonymous storefront session (preserves sessionId across refreshes). */\n  getAnonymousToken(): Promise<AnonymousSession>;\n  /** Refresh the anonymous session, preserving sessionId. */\n  refreshAnonymous?(): Promise<AnonymousSession>;\n  /** Invalidate a cached SDK-managed token so the next call re-auths. */\n  invalidate?(credentialSet: string): void;\n  /** Invalidate the cached anonymous session entirely (next call re-logs in). */\n  invalidateAnonymous?(): void;\n  /**\n   * Mark the anonymous access token stale but keep the refresh token, so the\n   * next {@link getAnonymousToken} refreshes (preserving sessionId) rather\n   * than starting a brand-new session.\n   */\n  expireAnonymous?(): void;\n  /**\n   * Install a persistence adapter for the anonymous session. The host (e.g.\n   * `EmporixProvider`) calls this at construction so the SDK can bootstrap\n   * an existing session and persist refreshes. Idempotent: a later call\n   * replaces the previous adapter.\n   */\n  attachAnonymousStore?(store: AnonymousSessionStore): void;\n  /**\n   * Override the storefront context (currency/site/country) used for the next\n   * anonymous login, then invalidate the current anonymous session so it\n   * re-mints with the new context. No-op for providers without anon support.\n   */\n  setAnonymousContext?(ctx: {\n    currency?: string;\n    siteCode?: string;\n    targetLocation?: string;\n  }): void;\n  /**\n   * Subscribe to token-refresh events. Optional — implementations may no-op.\n   * Returns an unsubscribe function. `DefaultTokenProvider` emits for the\n   * anonymous-login / anonymous-refresh paths.\n   */\n  onRefresh?(\n    listener: (event: { kind: \"anonymous\" | \"customer\"; success: boolean }) => void,\n  ): () => void;\n}\n\n/** Tiny constructors for {@link AuthContext}. */\nexport const auth = {\n  /** Service/custom credential set (default `backend`). */\n  service: (credentials?: string): AuthContext =>\n    credentials === undefined ? { kind: \"service\" } : { kind: \"service\", credentials },\n  /** Cached anonymous storefront token. */\n  anonymous: (): AuthContext => ({ kind: \"anonymous\" }),\n  /** Caller-owned customer bearer token. */\n  customer: (token: string): AuthContext => ({ kind: \"customer\", token }),\n  /** Exact token, no transformation (SSO / token-exchange). */\n  raw: (token: string): AuthContext => ({ kind: \"raw\", token }),\n};\n\n/** Resolves an {@link AuthContext} to a concrete bearer token. */\nexport async function resolveToken(ctx: AuthContext, provider: TokenProvider): Promise<string> {\n  switch (ctx.kind) {\n    case \"service\":\n      return provider.getToken(ctx.credentials ?? \"backend\");\n    case \"anonymous\":\n      return (await provider.getAnonymousToken()).accessToken;\n    case \"customer\":\n    case \"raw\":\n      return ctx.token;\n  }\n}\n\n/**\n * Late-bindable, single-flight holder for an optional\n * {@link CustomerTokenRefresher}. Single-flight is required because Emporix\n * rotates the refresh token on each refresh — concurrent refreshes would\n * invalidate each other. Off (returns `null`) until a refresher is set.\n */\nexport class CustomerRefreshRegistry {\n  private refresher: CustomerTokenRefresher | null = null;\n  private inflight: Promise<string | null> | null = null;\n\n  set(refresher: CustomerTokenRefresher | null): void {\n    this.refresher = refresher;\n  }\n\n  get enabled(): boolean {\n    return this.refresher !== null;\n  }\n\n  /** Concurrent callers share one in-flight refresh. */\n  refresh(expiredToken: string): Promise<string | null> {\n    if (!this.refresher) return Promise.resolve(null);\n    if (this.inflight) return this.inflight;\n    const p = Promise.resolve(this.refresher.refresh(expiredToken)).finally(() => {\n      this.inflight = null;\n    });\n    this.inflight = p;\n    return p;\n  }\n}\n\ninterface CacheEntry {\n  token: string;\n  expiresAt: number;\n  obtainedAt: number;\n}\n\n/** SDK-owned token provider: client-credentials service tokens + anonymous session. */\nexport class DefaultTokenProvider implements TokenProvider {\n  private readonly serviceCache = new Map<string, CacheEntry>();\n  private readonly serviceLocks = new Map<string, Promise<string>>();\n  private anon: (AnonymousSession & { expiresAt: number }) | undefined;\n  private anonLock: Promise<AnonymousSession> | undefined;\n  private anonStore?: AnonymousSessionStore;\n  private contextOverride:\n    | { currency?: string; siteCode?: string; targetLocation?: string }\n    | undefined;\n  private readonly refreshListeners = new Set<\n    (event: { kind: \"anonymous\" | \"customer\"; success: boolean }) => void\n  >();\n\n  constructor(private readonly cfg: ResolvedConfig) {}\n\n  onRefresh(\n    listener: (event: { kind: \"anonymous\" | \"customer\"; success: boolean }) => void,\n  ): () => void {\n    this.refreshListeners.add(listener);\n    return () => {\n      this.refreshListeners.delete(listener);\n    };\n  }\n\n  private notifyRefresh(kind: \"anonymous\" | \"customer\", success: boolean): void {\n    for (const l of this.refreshListeners) {\n      try {\n        l({ kind, success });\n      } catch {\n        // Never let a telemetry listener break the auth path.\n      }\n    }\n  }\n\n  attachAnonymousStore(store: AnonymousSessionStore): void {\n    this.anonStore = store;\n    // Bootstrap `this.anon` from the store if we don't have it yet. The seeded\n    // session has expiresAt = 0 so the next getAnonymousToken triggers a refresh\n    // (which preserves sessionId) instead of a fresh login.\n    if (!this.anon) {\n      const persisted = store.read();\n      if (persisted) {\n        this.anon = {\n          accessToken: \"\",\n          refreshToken: persisted.refreshToken,\n          sessionId: persisted.sessionId,\n          expiresIn: 0,\n          expiresAt: 0,\n        };\n      }\n    }\n  }\n\n  private creds(set: string): ServiceCredentials {\n    if (set === \"backend\") {\n      const b = this.cfg.credentials.backend;\n      if (!b?.clientId || !b.secret) {\n        throw new EmporixAuthError(\n          \"A 'service' AuthContext was used but credentials.backend is not configured\",\n        );\n      }\n      return b;\n    }\n    const c = this.cfg.credentials.custom?.[set];\n    if (!c) throw new Error(`Unknown credential set \"${set}\"`);\n    return c;\n  }\n\n  private fresh(e: CacheEntry | undefined): boolean {\n    if (!e) return false;\n    const now = Date.now();\n    if (now - e.obtainedAt >= this.cfg.cache.maxLifetimeSeconds * 1000) return false;\n    return now < e.expiresAt;\n  }\n\n  async getToken(set: string): Promise<string> {\n    // Surface an unknown credential set before entering the cache/lock path.\n    this.creds(set);\n    const cached = this.serviceCache.get(set);\n    if (this.fresh(cached)) return cached!.token;\n    const inflight = this.serviceLocks.get(set);\n    if (inflight) return inflight;\n    const p = this.requestServiceToken(set).finally(() => this.serviceLocks.delete(set));\n    this.serviceLocks.set(set, p);\n    return p;\n  }\n\n  /**\n   * fetch with the configured read timeout. Token endpoints sit in front of\n   * single-flight locks — one hung call would otherwise block every request\n   * on this credential set forever.\n   */\n  private async boundedFetch(url: string | URL, init: RequestInit = {}): Promise<Response> {\n    const ms = this.cfg.timeouts?.readMs ?? 60_000;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), ms);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } catch (err) {\n      if ((err as Error).name === \"AbortError\") {\n        throw new EmporixTimeoutError(`token request timed out after ${ms}ms`);\n      }\n      throw new EmporixNetworkError(`token request network failure: ${(err as Error).message}`);\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async requestServiceToken(set: string): Promise<string> {\n    const c = this.creds(set);\n    const body = new URLSearchParams({\n      grant_type: \"client_credentials\",\n      client_id: c.clientId,\n      client_secret: c.secret,\n    });\n    if (c.scope) body.set(\"scope\", c.scope);\n    const res = await this.boundedFetch(`${this.cfg.host}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body,\n    });\n    const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!res.ok) {\n      throw new EmporixAuthError(`Token request failed for \"${set}\"`, res.status, json);\n    }\n    const obtainedAt = Date.now();\n    const ttl = Number((json.expires_in as number | undefined) ?? 3600);\n    this.serviceCache.set(set, {\n      token: json.access_token as string,\n      obtainedAt,\n      expiresAt: obtainedAt + (ttl - this.cfg.cache.expirationBufferSeconds) * 1000,\n    });\n    return this.serviceCache.get(set)!.token;\n  }\n\n  invalidate(set: string): void {\n    this.serviceCache.delete(set);\n  }\n\n  private anonFresh(): boolean {\n    return !!this.anon && Date.now() < this.anon.expiresAt;\n  }\n\n  async getAnonymousToken(): Promise<AnonymousSession> {\n    if (this.anonFresh()) return this.stripExpiry(this.anon!);\n    if (this.anonLock) return this.anonLock;\n    // Token expired but a refresh token survives → refresh to keep the same\n    // sessionId; only fall back to a brand-new login if the refresh fails.\n    const canRefresh = !!this.anon?.refreshToken;\n    const obtain = canRefresh\n      ? this.fetchAnonymous(\"refresh\").catch(() => this.fetchAnonymous(\"login\"))\n      : this.fetchAnonymous(\"login\");\n    const p = obtain.finally(() => {\n      this.anonLock = undefined;\n    });\n    this.anonLock = p;\n    return p;\n  }\n\n  /** Refreshes the anonymous session, preserving its sessionId. */\n  async refreshAnonymous(): Promise<AnonymousSession> {\n    if (!this.anon) return this.getAnonymousToken();\n    return this.fetchAnonymous(\"refresh\");\n  }\n\n  invalidateAnonymous(): void {\n    this.anon = undefined;\n    this.anonStore?.write(null);\n  }\n\n  setAnonymousContext(ctx: {\n    currency?: string;\n    siteCode?: string;\n    targetLocation?: string;\n  }): void {\n    const base = this.contextOverride ?? this.cfg.credentials.storefront?.context ?? {};\n    this.contextOverride = { ...base, ...ctx };\n    this.invalidateAnonymous();\n  }\n\n  /** Force a stale access token while keeping the refresh token + sessionId. */\n  expireAnonymous(): void {\n    if (this.anon) this.anon = { ...this.anon, expiresAt: 0 };\n  }\n\n  private stripExpiry(s: AnonymousSession & { expiresAt: number }): AnonymousSession {\n    const { expiresAt: _expiresAt, ...rest } = s;\n    return rest;\n  }\n\n  private async fetchAnonymous(mode: \"login\" | \"refresh\"): Promise<AnonymousSession> {\n    const sf = this.cfg.credentials.storefront;\n    if (!sf?.clientId) {\n      throw new Error(\"credentials.storefront.clientId is required for anonymous tokens\");\n    }\n    const url = new URL(`${this.cfg.host}/customerlogin/auth/anonymous/${mode}`);\n    url.searchParams.set(\"tenant\", this.cfg.tenant);\n    url.searchParams.set(\"client_id\", sf.clientId);\n    // Context is the runtime override (set via setAnonymousContext) if present,\n    // else the config-fixed context.\n    const c = this.contextOverride ?? sf.context;\n    if (c?.currency) url.searchParams.set(\"currency\", c.currency);\n    if (c?.siteCode) url.searchParams.set(\"siteCode\", c.siteCode);\n    if (c?.targetLocation) url.searchParams.set(\"targetLocation\", c.targetLocation);\n    if (mode === \"refresh\" && this.anon) {\n      url.searchParams.set(\"refresh_token\", this.anon.refreshToken);\n    }\n    try {\n      const res = await this.boundedFetch(url, { method: \"GET\" });\n      const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n      if (!res.ok) {\n        this.notifyRefresh(\"anonymous\", false);\n        throw new EmporixAuthError(`Anonymous token ${mode} failed`, res.status, json);\n      }\n      const obtainedAt = Date.now();\n      this.anon = {\n        accessToken: json.access_token as string,\n        refreshToken: json.refresh_token as string,\n        sessionId: json.sessionId as string,\n        expiresIn: json.expires_in as number,\n        expiresAt:\n          obtainedAt +\n          ((json.expires_in as number) - this.cfg.cache.expirationBufferSeconds) * 1000,\n      };\n      this.anonStore?.write({\n        refreshToken: this.anon.refreshToken,\n        sessionId: this.anon.sessionId,\n      });\n      this.notifyRefresh(\"anonymous\", true);\n      return this.stripExpiry(this.anon);\n    } catch (err) {\n      // Re-throw EmporixAuthError as-is; for non-Emporix errors (network), also notify.\n      if (!(err instanceof EmporixAuthError)) {\n        this.notifyRefresh(\"anonymous\", false);\n      }\n      throw err;\n    }\n  }\n}\n// Customer-token refreshes happen via client.customers.refresh() and don't\n// route through this TokenProvider — only the anonymous flow notifies.\n// React-side useCustomerSession.refresh emits its own telemetry event in a\n// follow-up if needed.\n","import type { AuthContext } from \"./auth\";\nimport { EmporixAuthError } from \"./errors\";\n\n/**\n * Enforces a caller-owned customer or raw token. Throws `EmporixAuthError`\n * for any other `AuthContext` kind (or when `auth` is missing). Shared by\n * services whose endpoints require a customer scope (`/me`, payments,\n * customer-segments…).\n */\nexport function requireCustomer(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"raw\")) return auth;\n  throw new EmporixAuthError(\"This operation requires a customer or raw AuthContext\");\n}\n","import type { ClientContext } from \"../core/context\";\nimport { auth, type AuthContext } from \"../core/auth\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  PaymentModeFrontendResponse,\n  AuthorizePaymentRequest,\n} from \"../generated/payment\";\n\nconst ANON: AuthContext = auth.anonymous();\n\n/** A frontend payment mode (generated). */\nexport type PaymentMode = PaymentModeFrontendResponse;\n\n/** Post-checkout authorize request (generated; caller sends the exact wire shape). */\nexport type AuthorizePaymentInput = AuthorizePaymentRequest;\n\n/** Post-checkout authorize result. */\nexport interface AuthorizePaymentResult {\n  successful: boolean;\n  paymentTransactionId?: string;\n  authorizationToken?: string;\n  requiresExternalPayment?: boolean;\n  externalPaymentRedirectURL?: string;\n  externalPaymentHttpMethod?: string;\n  [k: string]: unknown;\n}\n\n/** Payment-Gateway: list frontend payment modes, authorize deferred payments. */\nexport class PaymentGatewayService {\n  static readonly channel = \"payment\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  /**\n   * Lists configured frontend payment modes. The endpoint requires a bearer\n   * token but no customer scope (\"No scope required\"), so it defaults to an\n   * anonymous context and works for guests and logged-in customers alike.\n   */\n  async listPaymentModes(authCtx: AuthContext = ANON): Promise<PaymentMode[]> {\n    return this.ctx.http.request<PaymentMode[]>({\n      method: \"GET\",\n      path: `/payment-gateway/${this.ctx.tenant}/paymentmodes/frontend`,\n      auth: authCtx,\n    });\n  }\n\n  /** Authorizes a post-checkout (deferred) payment for an existing order. */\n  async authorize(\n    input: AuthorizePaymentInput,\n    authCtx?: AuthContext,\n  ): Promise<AuthorizePaymentResult> {\n    return this.ctx.http.request<AuthorizePaymentResult>({\n      method: \"POST\",\n      path: `/payment-gateway/${this.ctx.tenant}/payment/frontend/authorize`,\n      auth: requireCustomer(authCtx),\n      body: input,\n    });\n  }\n}\n"]}

package/dist/payment.d.cts

@@ -100,11 +100,16 @@ interface AuthorizePaymentResult {
 /** Payment-Gateway: list frontend payment modes, authorize deferred payments. */
 declare class PaymentGatewayService {
     private readonly ctx;
+    static readonly channel: "payment";
     constructor(ctx: ClientContext);
-    /** Lists configured frontend payment modes. */
-    listPaymentModes(auth?: AuthContext): Promise<PaymentMode[]>;
+    /**
+     * Lists configured frontend payment modes. The endpoint requires a bearer
+     * token but no customer scope ("No scope required"), so it defaults to an
+     * anonymous context and works for guests and logged-in customers alike.
+     */
+    listPaymentModes(authCtx?: AuthContext): Promise<PaymentMode[]>;
     /** Authorizes a post-checkout (deferred) payment for an existing order. */
-    authorize(input: AuthorizePaymentInput, auth?: AuthContext): Promise<AuthorizePaymentResult>;
+    authorize(input: AuthorizePaymentInput, authCtx?: AuthContext): Promise<AuthorizePaymentResult>;
 }
 
 export { type AuthorizePaymentInput, type AuthorizePaymentResult, PaymentGatewayService, type PaymentMode };

package/dist/payment.d.ts

@@ -100,11 +100,16 @@ interface AuthorizePaymentResult {
 /** Payment-Gateway: list frontend payment modes, authorize deferred payments. */
 declare class PaymentGatewayService {
     private readonly ctx;
+    static readonly channel: "payment";
     constructor(ctx: ClientContext);
-    /** Lists configured frontend payment modes. */
-    listPaymentModes(auth?: AuthContext): Promise<PaymentMode[]>;
+    /**
+     * Lists configured frontend payment modes. The endpoint requires a bearer
+     * token but no customer scope ("No scope required"), so it defaults to an
+     * anonymous context and works for guests and logged-in customers alike.
+     */
+    listPaymentModes(authCtx?: AuthContext): Promise<PaymentMode[]>;
     /** Authorizes a post-checkout (deferred) payment for an existing order. */
-    authorize(input: AuthorizePaymentInput, auth?: AuthContext): Promise<AuthorizePaymentResult>;
+    authorize(input: AuthorizePaymentInput, authCtx?: AuthContext): Promise<AuthorizePaymentResult>;
 }
 
 export { type AuthorizePaymentInput, type AuthorizePaymentResult, PaymentGatewayService, type PaymentMode };

package/dist/payment.js

@@ -1,4 +1,4 @@
-export { PaymentGatewayService } from './chunk-EINAVCV2.js';
+export { PaymentGatewayService } from './chunk-PYLWZZC4.js';
 import './chunk-3BDDYX3V.js';
 import './chunk-UWGGF4MC.js';
 //# sourceMappingURL=payment.js.map

package/dist/price.cjs

@@ -66,6 +66,7 @@ var PriceService = class {
     this.ctx = ctx;
   }
   ctx;
+  static channel = "price";
   /**
    * Resolves prices using the session context bound to the bearer token
    * (currency/site/country were set at anonymous-login time). Default auth: