@viu/emporix-sdk 2.20.0 → 2.21.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @viu/emporix-sdk
 
+## 2.21.0
+
+### Minor Changes
+
+- [#154](https://github.com/viuteam/emporix-sdk/pull/154) [`2c170d1`](https://github.com/viuteam/emporix-sdk/commit/2c170d182a2839bb39aba47a4075ee820195813a) Thanks [@amnael1](https://github.com/amnael1)! - Add full `AiService` parity with the ai-service API. New CRUD sub-resources
+  `ai.tools`, `ai.mcpServers`, `ai.tokens`, `ai.oauths` (list/search/get/upsert/patch/delete);
+  new resource groups `ai.jobs`, `ai.templates`, `ai.logs`, `ai.analytics`; and
+  new methods `ai.listModels`, `ai.listCommerceEvents`, `ai.uploadAttachment`,
+  `ai.exportAgents`, `ai.importAgents`.
+
+- [#157](https://github.com/viuteam/emporix-sdk/pull/157) [`f7e9839`](https://github.com/viuteam/emporix-sdk/commit/f7e983928c3d91d3093c875a3fef5c15d59133c0) Thanks [@amnael1](https://github.com/amnael1)! - Add `client.invoices` (invoice-generation jobs) and `client.quotes` (B2B quotes
+  CRUD + PDF + history, with a `client.quotes.reasons` config sub-resource),
+  backed by the generated `invoice` / `quote` types. Quote-domain methods take a
+  required `auth` argument (customer or admin token — quotes are never
+  anonymous). The OAuth Service is intentionally not wrapped — its token grant is
+  owned by the SDK auth core.
+
+- [#156](https://github.com/viuteam/emporix-sdk/pull/156) [`61df99e`](https://github.com/viuteam/emporix-sdk/commit/61df99ec09be5ff69327a3f70b82be58b7c90d34) Thanks [@amnael1](https://github.com/amnael1)! - Derive `SiteService` and `SessionContextService` public types from the
+  generated `site-settings-service` / `session-context` types. `Site` now
+  inherits every generated field (shipping/payment/tax/assistedBuying/mixins/
+  taxDeterminationBasedOn, richer address) while keeping `active`/`default`
+  required; `SessionContext.sessionId` stays required and the ergonomic flat
+  `patch({ …, version })` DX is unchanged. Note: `SessionContext.context` /
+  `SessionContextPatch.context` are now the accurate nested map type
+  (`Record<string, Record<string, unknown>>`) instead of `Record<string, unknown>`.
+
+### Patch Changes
+
+- [#151](https://github.com/viuteam/emporix-sdk/pull/151) [`7aa5fc9`](https://github.com/viuteam/emporix-sdk/commit/7aa5fc93c5ef6a83f7235b76e4e5ccc9bb545d33) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
+
+  Updated services: ai-service
+
+- [#159](https://github.com/viuteam/emporix-sdk/pull/159) [`7a7c90c`](https://github.com/viuteam/emporix-sdk/commit/7a7c90c7d569988dfdce8ca84ea261d311a419e7) Thanks [@amnael1](https://github.com/amnael1)! - Fix four facade methods that targeted HTTP paths/methods the live Emporix API
+  rejects (verified against the tenant). Signatures are unchanged.
+  - `cart.applyCoupon` / `cart.removeCoupon` used `…/carts/{id}/coupons`, which
+    returns 404 "No endpoint". Coupons are applied via the cart **discounts**
+    endpoint: `applyCoupon` now `POST …/discounts` (coupon-code payload),
+    `removeCoupon` now `DELETE …/discounts?codes=<code>`. Both re-fetch and return
+    the updated cart.
+  - `customer.changePassword` used `PUT …/password` (404). Now `POST …/password/change`.
+  - `customer.confirmPasswordReset` used `POST …/password/reset/confirm` (404). Now
+    `POST …/password/reset/update`.
+  - `companies.update` / `contacts.update` / `locations.update` used `PATCH`, which
+    the customer-management API rejects with 405 Method Not Allowed. Now `PUT`
+    (upsert). Send the complete entity, as the server replaces the resource.
+
+- [#155](https://github.com/viuteam/emporix-sdk/pull/155) [`c78ce7b`](https://github.com/viuteam/emporix-sdk/commit/c78ce7bb25c0208b02a4469904c56c38b11cc6cf) Thanks [@amnael1](https://github.com/amnael1)! - Register the five remaining Emporix OpenAPI specs that were missing from the
+  fetch registry — `oauth-service`, `site-settings-service`, `invoice`, `quote`,
+  `session-context` — so the SDK vendors and generates types for all 43 listed
+  API services. Generated types only; no new service facades.
+
+## 2.20.1
+
+### Patch Changes
+
+- [#149](https://github.com/viuteam/emporix-sdk/pull/149) [`7aed273`](https://github.com/viuteam/emporix-sdk/commit/7aed273c04af463edba7c749113d31c44eca6607) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
+
+  Updated services: schema
+
 ## 2.20.0
 
 ### Minor Changes

package/dist/availability.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.cjs';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.cjs';
 
 /**
  * Availability details.

package/dist/availability.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.js';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.js';
 
 /**
  * Availability details.

package/dist/cart.cjs

@@ -163,22 +163,37 @@ var CartService = class {
       auth: requireCartAuth(auth)
     });
   }
-  /** Applies a coupon. */
+  /**
+   * Applies a coupon by code. Coupon application goes through the cart's
+   * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —
+   * the live API has no `…/coupons` path. The apply response only carries the
+   * applied-discount reference (`{ discountId, discountIndex }`), so the updated
+   * cart is re-fetched and returned to preserve the `Cart` contract.
+   */
   async applyCoupon(cartId, code, auth) {
-    return this.ctx.http.request({
+    const cartAuth = requireCartAuth(auth);
+    await this.ctx.http.request({
       method: "POST",
-      path: `${this.base()}/${cartId}/coupons`,
-      auth: requireCartAuth(auth),
+      path: `${this.base()}/${cartId}/discounts`,
+      auth: cartAuth,
       body: { code }
     });
+    return this.get(cartId, cartAuth);
   }
-  /** Removes a coupon. */
+  /**
+   * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live
+   * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so
+   * the updated cart is re-fetched and returned.
+   */
   async removeCoupon(cartId, code, auth) {
-    return this.ctx.http.request({
+    const cartAuth = requireCartAuth(auth);
+    await this.ctx.http.request({
       method: "DELETE",
-      path: `${this.base()}/${cartId}/coupons/${code}`,
-      auth: requireCartAuth(auth)
+      path: `${this.base()}/${cartId}/discounts`,
+      query: { codes: code },
+      auth: cartAuth
     });
+    return this.get(cartId, cartAuth);
   }
   /** Sets the shipping address. */
   async setShippingAddress(cartId, address, auth) {

package/dist/cart.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/errors.ts","../src/services/cart.ts"],"names":[],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAOO,IAAM,oBAAA,GAAN,cAAmC,YAAA,CAAa;AAAC,CAAA;AAEjD,IAAM,sBAAA,GAAN,cAAqC,YAAA,CAAa;AAAC,CAAA;;;ACT1D,SAAS,gBAAgB,IAAA,EAA4C;AACnE,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,cAAc,OAAO,IAAA;AAC5E,EAAA,MAAM,IAAI,sBAAA;AAAA,IACR;AAAA,GACF;AACF;AAEA,SAAS,oBAAoB,IAAA,EAA4C;AACvE,EAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AAC7C,EAAA,MAAM,IAAI,uBAAuB,wDAAwD,CAAA;AAC3F;AAGO,IAAM,cAAN,MAAkB;AAAA,EAEvB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,MAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,IAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,SAAS;AAAC,KACjB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,MAAA,EAAgB,IAAA,EAAkC;AAC1D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAA,CACJ,IAAA,EACA,IAAA,EACsB;AACtB,IAAA,MAAM,KAAA,GAAyC,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS;AACzE,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,KAAA,CAAM,OAAO,IAAA,CAAK,IAAA;AAC/C,IAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,IAAA,CAAK,aAAA;AACjE,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA;AAChC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QACvC,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,KAAA;AAAA,QACA,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,sBAAsB,OAAO,IAAA;AAC9C,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAA,CACJ,MAAA,EACA,KAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAgC;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,WAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,WACJ,MAAA,EACA,MAAA,EACA,OACA,IAAA,EACA,IAAA,GAA8B,EAAC,EAChB;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,KAAA;AAAA,MACN,GAAI,IAAA,CAAK,OAAA,GAAU,EAAE,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAO,EAAE,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,IAAA,EAAkC;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,CAAM,MAAA,EAAgB,IAAA,EAAkC;AAC5D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AAChF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,QAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,EAAE,IAAA;AAAK,KACd,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,YAAY,IAAI,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,KAAA,CACJ,cAAA,EACA,gBAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,cAAc,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA,EAAM,oBAAoB,IAAI,CAAA;AAAA,MAC9B,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA;AAAiB,KACjC,CAAA;AAAA,EACH;AACF","file":"cart.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixNotFoundError, EmporixValidationError } from \"../core/errors\";\nimport type {\n  Cart as GeneratedCart,\n  CreateCart,\n  CreatedCart,\n  CartItemRequest,\n  UpdateCartItem,\n  AddressRequest,\n  BatchResponse as GeneratedBatchResponse,\n  SingleBatchResponse as GeneratedSingleBatchResponse,\n} from \"../generated/cart\";\n\n/** A cart as returned by the Cart service (all generated fields). */\nexport type Cart = GeneratedCart;\n\n/** The cart-create response (`{ cartId, yrn }`, generated). */\nexport type CartCreated = CreatedCart;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CreateCartInput = CreateCart;\nexport type CartItemInput = CartItemRequest;\nexport type CartItemUpdate = UpdateCartItem;\n\n/** Per-entry result of `addItemsBatch`. `status` is HTTP-style per entry (e.g. 201 = added, 4xx = failed). */\nexport type CartItemBatchEntry = GeneratedSingleBatchResponse;\n/** Response shape of `addItemsBatch` — one entry per input item, matching by `index`. */\nexport type CartItemsBatchResponse = GeneratedBatchResponse;\n\n/** An address payload for cart shipping/billing (generated). */\nexport type CartAddress = AddressRequest;\n\nfunction requireCartAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"anonymous\")) return auth;\n  throw new EmporixValidationError(\n    \"CartService requires an explicit { kind: 'customer' } or { kind: 'anonymous' } AuthContext\",\n  );\n}\n\nfunction requireCustomerAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && auth.kind === \"customer\") return auth;\n  throw new EmporixValidationError(\"cart.merge requires a { kind: 'customer' } AuthContext\");\n}\n\n/** Cart operations. Every method requires an explicit customer/anonymous context. */\nexport class CartService {\n  static readonly channel = \"cart\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/cart/${this.ctx.tenant}/carts`;\n  }\n\n  /** Creates a cart. */\n  async create(\n    input: CreateCartInput | undefined,\n    auth: AuthContext,\n  ): Promise<CartCreated> {\n    return this.ctx.http.request<CartCreated>({\n      method: \"POST\",\n      path: this.base(),\n      auth: requireCartAuth(auth),\n      body: input ?? {},\n    });\n  }\n\n  /** Fetches a cart by id. */\n  async get(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"GET\",\n      path: `${this.base()}/${cartId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Returns the current cart for the session, or null if none. */\n  /**\n   * Get the customer / anonymous cart matching the given criteria. Per Emporix:\n   * uniqueness is defined by `siteCode` + `type` + `legalEntityId` +\n   * (`customerId` derived from a customer token, or `sessionId` derived from an\n   * anonymous token). With `create: true`, Emporix creates a new cart if none\n   * matches.\n   *\n   * Returns `null` on 404 (no cart found and `create` was not set). All other\n   * errors are propagated.\n   */\n  async getCurrent(\n    auth: AuthContext,\n    opts: { siteCode: string; type?: string; legalEntityId?: string; create?: boolean },\n  ): Promise<Cart | null> {\n    const query: Record<string, string | number> = { siteCode: opts.siteCode };\n    if (opts.type !== undefined) query.type = opts.type;\n    if (opts.legalEntityId !== undefined) query.legalEntityId = opts.legalEntityId;\n    if (opts.create) query.create = \"true\";\n    try {\n      return await this.ctx.http.request<Cart>({\n        method: \"GET\",\n        path: this.base(),\n        query,\n        auth: requireCartAuth(auth),\n      });\n    } catch (e) {\n      if (e instanceof EmporixNotFoundError) return null;\n      throw e;\n    }\n  }\n\n  /** Adds an item. */\n  async addItem(\n    cartId: string,\n    item: CartItemInput,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n      body: item,\n    });\n  }\n\n  /**\n   * Adds multiple items in a single request via `POST /carts/{id}/itemsBatch`.\n   * Server-side limit is 200 entries per call — callers handling larger sets\n   * must chunk. The response carries a per-entry `status` (HTTP-style: 201\n   * for added, 4xx/5xx for failed) and `index` matching the input position;\n   * partial failures do **not** throw — inspect `status` per entry.\n   */\n  async addItemsBatch(\n    cartId: string,\n    items: CartItemInput[],\n    auth: AuthContext,\n  ): Promise<CartItemsBatchResponse> {\n    return this.ctx.http.request<CartItemsBatchResponse>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/itemsBatch`,\n      auth: requireCartAuth(auth),\n      body: items,\n    });\n  }\n\n  /**\n   * Updates an item. By default this is a **full replace** — the server expects\n   * the complete item (e.g. `itemYrn` + the `price` row). Pass\n   * `{ partial: true }` to send a **partial update** (`?partial=true`), e.g. a\n   * quantity-only change with just `{ quantity }`.\n   */\n  async updateItem(\n    cartId: string,\n    itemId: string,\n    patch: CartItemUpdate,\n    auth: AuthContext,\n    opts: { partial?: boolean } = {},\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n      body: patch,\n      ...(opts.partial ? { query: { partial: \"true\" } } : {}),\n    });\n  }\n\n  /** Removes an item. */\n  async removeItem(cartId: string, itemId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Empties the cart. */\n  async clear(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Applies a coupon. */\n  async applyCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/coupons`,\n      auth: requireCartAuth(auth),\n      body: { code },\n    });\n  }\n\n  /** Removes a coupon. */\n  async removeCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/coupons/${code}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Sets the shipping address. */\n  async setShippingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/shipping-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /** Sets the billing address. */\n  async setBillingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/billing-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /**\n   * Merges one or more anonymous carts into the specified customer cart.\n   * Per Emporix: the target cart in the path **must belong to the logged-in\n   * customer**, and each id in `anonymousCartIds` must belong to an anonymous\n   * customer. Anonymous carts go `CLOSED` on success.\n   *\n   * Requires a customer `AuthContext`.\n   */\n  async merge(\n    customerCartId: string,\n    anonymousCartIds: string[],\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${customerCartId}/merge`,\n      auth: requireCustomerAuth(auth),\n      body: { carts: anonymousCartIds },\n    });\n  }\n}\n"]}
+{"version":3,"sources":["../src/core/errors.ts","../src/services/cart.ts"],"names":[],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAOO,IAAM,oBAAA,GAAN,cAAmC,YAAA,CAAa;AAAC,CAAA;AAEjD,IAAM,sBAAA,GAAN,cAAqC,YAAA,CAAa;AAAC,CAAA;;;ACR1D,SAAS,gBAAgB,IAAA,EAA4C;AACnE,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,cAAc,OAAO,IAAA;AAC5E,EAAA,MAAM,IAAI,sBAAA;AAAA,IACR;AAAA,GACF;AACF;AAEA,SAAS,oBAAoB,IAAA,EAA4C;AACvE,EAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AAC7C,EAAA,MAAM,IAAI,uBAAuB,wDAAwD,CAAA;AAC3F;AAGO,IAAM,cAAN,MAAkB;AAAA,EAEvB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,MAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,IAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,SAAS;AAAC,KACjB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,MAAA,EAAgB,IAAA,EAAkC;AAC1D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAA,CACJ,IAAA,EACA,IAAA,EACsB;AACtB,IAAA,MAAM,KAAA,GAAyC,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS;AACzE,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,KAAA,CAAM,OAAO,IAAA,CAAK,IAAA;AAC/C,IAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,IAAA,CAAK,aAAA;AACjE,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA;AAChC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QACvC,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,KAAA;AAAA,QACA,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,sBAAsB,OAAO,IAAA;AAC9C,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAA,CACJ,MAAA,EACA,KAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAgC;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,WAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,WACJ,MAAA,EACA,MAAA,EACA,OACA,IAAA,EACA,IAAA,GAA8B,EAAC,EAChB;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,KAAA;AAAA,MACN,GAAI,IAAA,CAAK,OAAA,GAAU,EAAE,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAO,EAAE,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,IAAA,EAAkC;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,CAAM,MAAA,EAAgB,IAAA,EAAkC;AAC5D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AAChF,IAAA,MAAM,QAAA,GAAW,gBAAgB,IAAI,CAAA;AACrC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAyB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,UAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,EAAE,IAAA;AAAK,KACd,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AACjF,IAAA,MAAM,QAAA,GAAW,gBAAgB,IAAI,CAAA;AACrC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,UAAA,CAAA;AAAA,MAC9B,KAAA,EAAO,EAAE,KAAA,EAAO,IAAA,EAAK;AAAA,MACrB,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,KAAA,CACJ,cAAA,EACA,gBAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,cAAc,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA,EAAM,oBAAoB,IAAI,CAAA;AAAA,MAC9B,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA;AAAiB,KACjC,CAAA;AAAA,EACH;AACF","file":"cart.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixNotFoundError, EmporixValidationError } from \"../core/errors\";\nimport type {\n  Cart as GeneratedCart,\n  CreateCart,\n  CreatedCart,\n  CartItemRequest,\n  UpdateCartItem,\n  AddressRequest,\n  AppliedDiscount,\n  BatchResponse as GeneratedBatchResponse,\n  SingleBatchResponse as GeneratedSingleBatchResponse,\n} from \"../generated/cart\";\n\n/** A cart as returned by the Cart service (all generated fields). */\nexport type Cart = GeneratedCart;\n\n/** The cart-create response (`{ cartId, yrn }`, generated). */\nexport type CartCreated = CreatedCart;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CreateCartInput = CreateCart;\nexport type CartItemInput = CartItemRequest;\nexport type CartItemUpdate = UpdateCartItem;\n\n/** Per-entry result of `addItemsBatch`. `status` is HTTP-style per entry (e.g. 201 = added, 4xx = failed). */\nexport type CartItemBatchEntry = GeneratedSingleBatchResponse;\n/** Response shape of `addItemsBatch` — one entry per input item, matching by `index`. */\nexport type CartItemsBatchResponse = GeneratedBatchResponse;\n\n/** An address payload for cart shipping/billing (generated). */\nexport type CartAddress = AddressRequest;\n\nfunction requireCartAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"anonymous\")) return auth;\n  throw new EmporixValidationError(\n    \"CartService requires an explicit { kind: 'customer' } or { kind: 'anonymous' } AuthContext\",\n  );\n}\n\nfunction requireCustomerAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && auth.kind === \"customer\") return auth;\n  throw new EmporixValidationError(\"cart.merge requires a { kind: 'customer' } AuthContext\");\n}\n\n/** Cart operations. Every method requires an explicit customer/anonymous context. */\nexport class CartService {\n  static readonly channel = \"cart\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/cart/${this.ctx.tenant}/carts`;\n  }\n\n  /** Creates a cart. */\n  async create(\n    input: CreateCartInput | undefined,\n    auth: AuthContext,\n  ): Promise<CartCreated> {\n    return this.ctx.http.request<CartCreated>({\n      method: \"POST\",\n      path: this.base(),\n      auth: requireCartAuth(auth),\n      body: input ?? {},\n    });\n  }\n\n  /** Fetches a cart by id. */\n  async get(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"GET\",\n      path: `${this.base()}/${cartId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Returns the current cart for the session, or null if none. */\n  /**\n   * Get the customer / anonymous cart matching the given criteria. Per Emporix:\n   * uniqueness is defined by `siteCode` + `type` + `legalEntityId` +\n   * (`customerId` derived from a customer token, or `sessionId` derived from an\n   * anonymous token). With `create: true`, Emporix creates a new cart if none\n   * matches.\n   *\n   * Returns `null` on 404 (no cart found and `create` was not set). All other\n   * errors are propagated.\n   */\n  async getCurrent(\n    auth: AuthContext,\n    opts: { siteCode: string; type?: string; legalEntityId?: string; create?: boolean },\n  ): Promise<Cart | null> {\n    const query: Record<string, string | number> = { siteCode: opts.siteCode };\n    if (opts.type !== undefined) query.type = opts.type;\n    if (opts.legalEntityId !== undefined) query.legalEntityId = opts.legalEntityId;\n    if (opts.create) query.create = \"true\";\n    try {\n      return await this.ctx.http.request<Cart>({\n        method: \"GET\",\n        path: this.base(),\n        query,\n        auth: requireCartAuth(auth),\n      });\n    } catch (e) {\n      if (e instanceof EmporixNotFoundError) return null;\n      throw e;\n    }\n  }\n\n  /** Adds an item. */\n  async addItem(\n    cartId: string,\n    item: CartItemInput,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n      body: item,\n    });\n  }\n\n  /**\n   * Adds multiple items in a single request via `POST /carts/{id}/itemsBatch`.\n   * Server-side limit is 200 entries per call — callers handling larger sets\n   * must chunk. The response carries a per-entry `status` (HTTP-style: 201\n   * for added, 4xx/5xx for failed) and `index` matching the input position;\n   * partial failures do **not** throw — inspect `status` per entry.\n   */\n  async addItemsBatch(\n    cartId: string,\n    items: CartItemInput[],\n    auth: AuthContext,\n  ): Promise<CartItemsBatchResponse> {\n    return this.ctx.http.request<CartItemsBatchResponse>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/itemsBatch`,\n      auth: requireCartAuth(auth),\n      body: items,\n    });\n  }\n\n  /**\n   * Updates an item. By default this is a **full replace** — the server expects\n   * the complete item (e.g. `itemYrn` + the `price` row). Pass\n   * `{ partial: true }` to send a **partial update** (`?partial=true`), e.g. a\n   * quantity-only change with just `{ quantity }`.\n   */\n  async updateItem(\n    cartId: string,\n    itemId: string,\n    patch: CartItemUpdate,\n    auth: AuthContext,\n    opts: { partial?: boolean } = {},\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n      body: patch,\n      ...(opts.partial ? { query: { partial: \"true\" } } : {}),\n    });\n  }\n\n  /** Removes an item. */\n  async removeItem(cartId: string, itemId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Empties the cart. */\n  async clear(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /**\n   * Applies a coupon by code. Coupon application goes through the cart's\n   * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —\n   * the live API has no `…/coupons` path. The apply response only carries the\n   * applied-discount reference (`{ discountId, discountIndex }`), so the updated\n   * cart is re-fetched and returned to preserve the `Cart` contract.\n   */\n  async applyCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    const cartAuth = requireCartAuth(auth);\n    await this.ctx.http.request<AppliedDiscount>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/discounts`,\n      auth: cartAuth,\n      body: { code },\n    });\n    return this.get(cartId, cartAuth);\n  }\n\n  /**\n   * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live\n   * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so\n   * the updated cart is re-fetched and returned.\n   */\n  async removeCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    const cartAuth = requireCartAuth(auth);\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/discounts`,\n      query: { codes: code },\n      auth: cartAuth,\n    });\n    return this.get(cartId, cartAuth);\n  }\n\n  /** Sets the shipping address. */\n  async setShippingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/shipping-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /** Sets the billing address. */\n  async setBillingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/billing-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /**\n   * Merges one or more anonymous carts into the specified customer cart.\n   * Per Emporix: the target cart in the path **must belong to the logged-in\n   * customer**, and each id in `anonymousCartIds` must belong to an anonymous\n   * customer. Anonymous carts go `CLOSED` on success.\n   *\n   * Requires a customer `AuthContext`.\n   */\n  async merge(\n    customerCartId: string,\n    anonymousCartIds: string[],\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${customerCartId}/merge`,\n      auth: requireCustomerAuth(auth),\n      body: { carts: anonymousCartIds },\n    });\n  }\n}\n"]}

package/dist/cart.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.cjs';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.cjs';
 
 /**
  * Access control identifier that determines who can view or manage the cart.
@@ -1793,9 +1793,19 @@ declare class CartService {
     removeItem(cartId: string, itemId: string, auth: AuthContext): Promise<Cart>;
     /** Empties the cart. */
     clear(cartId: string, auth: AuthContext): Promise<Cart>;
-    /** Applies a coupon. */
+    /**
+     * Applies a coupon by code. Coupon application goes through the cart's
+     * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —
+     * the live API has no `…/coupons` path. The apply response only carries the
+     * applied-discount reference (`{ discountId, discountIndex }`), so the updated
+     * cart is re-fetched and returned to preserve the `Cart` contract.
+     */
     applyCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart>;
-    /** Removes a coupon. */
+    /**
+     * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live
+     * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so
+     * the updated cart is re-fetched and returned.
+     */
     removeCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart>;
     /** Sets the shipping address. */
     setShippingAddress(cartId: string, address: CartAddress, auth: AuthContext): Promise<Cart>;

package/dist/cart.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.js';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.js';
 
 /**
  * Access control identifier that determines who can view or manage the cart.
@@ -1793,9 +1793,19 @@ declare class CartService {
     removeItem(cartId: string, itemId: string, auth: AuthContext): Promise<Cart>;
     /** Empties the cart. */
     clear(cartId: string, auth: AuthContext): Promise<Cart>;
-    /** Applies a coupon. */
+    /**
+     * Applies a coupon by code. Coupon application goes through the cart's
+     * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —
+     * the live API has no `…/coupons` path. The apply response only carries the
+     * applied-discount reference (`{ discountId, discountIndex }`), so the updated
+     * cart is re-fetched and returned to preserve the `Cart` contract.
+     */
     applyCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart>;
-    /** Removes a coupon. */
+    /**
+     * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live
+     * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so
+     * the updated cart is re-fetched and returned.
+     */
     removeCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart>;
     /** Sets the shipping address. */
     setShippingAddress(cartId: string, address: CartAddress, auth: AuthContext): Promise<Cart>;

package/dist/cart.js

@@ -1,4 +1,4 @@
-export { CartService } from './chunk-PAT4CS36.js';
+export { CartService } from './chunk-HUEMYP2L.js';
 import './chunk-UWGGF4MC.js';
 //# sourceMappingURL=cart.js.map
 //# sourceMappingURL=cart.js.map

package/dist/category.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-Dawv2AtS.cjs';
+import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-CfXJcYKP.cjs';
 import { a as QueryFor } from './query-mLQs2WFr.cjs';
 import { Product } from './product.cjs';
 

package/dist/category.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-Dawv2AtS.js';
+import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-CfXJcYKP.js';
 import { a as QueryFor } from './query-mLQs2WFr.js';
 import { Product } from './product.js';
 

package/dist/checkout.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.cjs';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.cjs';
 
 /**
  * Information about the customer's address.

package/dist/checkout.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-Dawv2AtS.js';
+import { C as ClientContext, b as AuthContext } from './context-CfXJcYKP.js';
 
 /**
  * Information about the customer's address.

package/dist/{chunk-BNX3JULF.js → chunk-44F52KRE.js}

@@ -34,12 +34,14 @@ var CompaniesService = class {
     });
   }
   /**
-   * Patches a legal entity. The endpoint is a PATCH, so the body is a partial
-   * of the generated `LegalEntityUpdate` (full-replace) shape.
+   * Updates a legal entity via `PUT …/legal-entities/{id}` (upsert / full
+   * replace). The live API rejects `PATCH` on this path with 405; send the
+   * complete entity, as the server replaces the resource. The body stays typed
+   * as a partial of `LegalEntityUpdate` for backward compatibility.
    */
   async update(legalEntityId, patch, auth) {
     return this.ctx.http.request({
-      method: "PATCH",
+      method: "PUT",
       path: `${this.base()}/${legalEntityId}`,
       auth,
       body: patch
@@ -56,5 +58,5 @@ var CompaniesService = class {
 };
 
 export { CompaniesService };
-//# sourceMappingURL=chunk-BNX3JULF.js.map
-//# sourceMappingURL=chunk-BNX3JULF.js.map
+//# sourceMappingURL=chunk-44F52KRE.js.map
+//# sourceMappingURL=chunk-44F52KRE.js.map

package/dist/chunk-44F52KRE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/companies.ts"],"names":[],"mappings":";AAgBO,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,qBAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA2C;AACxD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,aAAA,EAAuB,IAAA,EAAyC;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA0B,IAAA,EAA4C;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CACJ,aAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,aAAA,EAAuB,IAAA,EAAkC;AACpE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-44F52KRE.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  LegalEntity,\n  LegalEntityCreate,\n  LegalEntityUpdate,\n} from \"../generated/customer-management\";\n\n/**\n * Storefront-customer access to Legal Entities.\n *\n * `listMine`/`get` require `customermanagement.legalentity_read_own` on the\n * customer token. `create`/`update`/`delete` require the corresponding\n * `_manage` scopes — typically only granted to Admin-group customers; a 403\n * surfaces as `EmporixInsufficientScopeError`.\n */\nexport class CompaniesService {\n  static readonly channel = \"customer-management\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/legal-entities`;\n  }\n\n  /** Lists the legal entities the calling customer is assigned to. */\n  async listMine(auth: AuthContext): Promise<LegalEntity[]> {\n    return this.ctx.http.request<LegalEntity[]>({\n      method: \"GET\",\n      path: this.base(),\n      auth,\n    });\n  }\n\n  /** Fetches a single legal entity by id. */\n  async get(legalEntityId: string, auth: AuthContext): Promise<LegalEntity> {\n    return this.ctx.http.request<LegalEntity>({\n      method: \"GET\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n    });\n  }\n\n  /** Creates a legal entity. Requires `customermanagement.legalentity_manage`. */\n  async create(input: LegalEntityCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Updates a legal entity via `PUT …/legal-entities/{id}` (upsert / full\n   * replace). The live API rejects `PATCH` on this path with 405; send the\n   * complete entity, as the server replaces the resource. The body stays typed\n   * as a partial of `LegalEntityUpdate` for backward compatibility.\n   */\n  async update(\n    legalEntityId: string,\n    patch: Partial<LegalEntityUpdate>,\n    auth: AuthContext,\n  ): Promise<LegalEntity> {\n    return this.ctx.http.request<LegalEntity>({\n      method: \"PUT\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a legal entity (async cascade on the server). */\n  async delete(legalEntityId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/{chunk-NEXUWPHW.js → chunk-HBEQEIT6.js}

@@ -153,8 +153,8 @@ var CustomerService = class {
   /** Changes the password. Requires customer/raw auth. */
   async changePassword(input, auth) {
     await this.ctx.http.request({
-      method: "PUT",
-      path: `/customer/${this.ctx.tenant}/password`,
+      method: "POST",
+      path: `/customer/${this.ctx.tenant}/password/change`,
       auth: requireCustomer(auth),
       body: input
     });
@@ -172,7 +172,7 @@ var CustomerService = class {
   async confirmPasswordReset(input, auth = { kind: "anonymous" }) {
     await this.ctx.http.request({
       method: "POST",
-      path: `/customer/${this.ctx.tenant}/password/reset/confirm`,
+      path: `/customer/${this.ctx.tenant}/password/reset/update`,
       auth,
       body: input
     });
@@ -205,5 +205,5 @@ var CustomerService = class {
 };
 
 export { CustomerService };
-//# sourceMappingURL=chunk-NEXUWPHW.js.map
-//# sourceMappingURL=chunk-NEXUWPHW.js.map
+//# sourceMappingURL=chunk-HBEQEIT6.js.map
+//# sourceMappingURL=chunk-HBEQEIT6.js.map

package/dist/chunk-HBEQEIT6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/customer.ts"],"names":[],"mappings":";;;;AAuEA,SAAS,SAAA,CACP,QAAA,EACA,IAAA,EACA,IAAA,GAAoC,EAAC,EACpB;AACjB,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,WAAA;AAChD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,gBAAA,CAAiB,CAAA,EAAG,QAAQ,CAAA,+BAAA,CAAA,EAAmC,QAAW,IAAI,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO;AAAA,IACL,aAAA;AAAA,IACA,WAAW,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,SAAA,IAAa,KAAK,cAAA,IAAkB,EAAA;AAAA,IACvE,YAAA,EAAc,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA,IAAgB,EAAA;AAAA,IACzD,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,WAAW,IAAA,CAAK,UAAA,IAAc,OAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AAAA,IAC/D,GAAI,KAAK,mBAAA,GAAsB,EAAE,mBAAmB,IAAA,CAAK,mBAAA,KAAwB,EAAC;AAAA,IAClF,GAAI,KAAK,eAAA,GAAkB,EAAE,eAAe,IAAA,CAAK,eAAA,KAAoB;AAAC,GACxE;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAE3B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,UAAA;AAAA;AAAA,EAI1B,MAAM,SAAA,GAAuC;AAC3C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,iBAAA,EAAkB;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACrB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CACJ,KAAA,EACA,IAAA,GAAoC,IACpC,IAAA,GAAoB,EAAE,IAAA,EAAM,WAAA,EAAY,EACd;AAC1B,IAAA,MAAM,SAAA,GAAyB,KAAK,cAAA,GAChC,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAe,GAC1C,IAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAClC,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,YAAA,EAAc,KAAA,CAAM,YAAA,EAAa;AACzE,IAAA,IAAI,KAAA,CAAM,aAAA,EAAe,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,aAAA;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,SAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA,CAAM,cAAc,MAAA,GAAY,EAAE,gBAAgB,KAAA,CAAM,SAAA,KAAc;AAAC,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,IAAA,EAAmC;AAC9C,IAAA,MAAM,GAAA,GAAM,gBAAgB,IAAI,CAAA;AAChC,IAAA,MAAM,QAAS,GAAA,CAA0B,KAAA;AACzC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,MAC5B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC;AAAA,MACpC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,YAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,KAAA,CAAM,SAAA,GAAY,EAAE,OAAA,EAAS,EAAE,YAAA,EAAc,KAAA,CAAM,SAAA,EAAU,EAAE,GAAI;AAAC,KACzE,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,eAAe,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,kBAAA,EAAoB,KAAA,CAAM,YAAA,EAAa;AAC/E,IAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAA;AACvC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,GAAG,IAAA,EAAuC;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA4B,IAAA,EAAuC;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,KAAA,EAA4B,IAAA,EAAmC;AAClF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGS,SAAA,GAAY;AAAA,IACnB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAA6B,SACvC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,KAAA,EAA2B,SACpD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,QAAQ,OAAO,EAAA,EAAY,SACzB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAc;AAAA,MAC1B,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B;AAAA,GACL;AACF","file":"chunk-HBEQEIT6.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext, AnonymousSession } from \"../core/auth\";\nimport { EmporixAuthError } from \"../core/errors\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  Customer as GeneratedCustomer,\n  Address as GeneratedAddress,\n  CustomerSignup,\n  CustomerUpdateDto,\n  PasswordChangeDto,\n  PasswordResetRequestDto,\n  PasswordUpdate,\n  AddressCreateDto,\n  AddressUpdateDto,\n} from \"../generated/customer\";\n\n/**\n * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to\n * idiomatic names: `access_token` → `customerToken`, `saas_token` →\n * `saasToken`. `saasToken` is a JWT required for the checkout (`saas-token`\n * header). The wire's `*_token` (snake_case) fields are canonical; the\n * camelCase variants are deprecated in the Emporix spec.\n */\nexport interface CustomerSession {\n  customerToken: string;\n  /** JWT required for completing checkout (sent as the `saas-token` header). */\n  saasToken: string;\n  refreshToken: string;\n  /** Same session as the anonymous token — preserves the cart across login. */\n  sessionId: string | undefined;\n  /** Customer access-token lifetime in seconds. */\n  expiresIn: number | undefined;\n  /** Only set by `socialLogin`: the IdP access token echoed by Emporix. */\n  socialAccessToken?: string;\n  /** Only set by `socialLogin`: the IdP ID token echoed by Emporix. */\n  socialIdToken?: string;\n}\n\n/** Customer profile as returned by the Customer service (all generated fields). */\nexport type Customer = GeneratedCustomer;\n\n/** A customer address as returned by the Customer service (all generated fields). */\nexport type Address = GeneratedAddress;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CustomerSignupInput = CustomerSignup;\nexport type CustomerUpdateInput = CustomerUpdateDto;\nexport type PasswordChangeInput = PasswordChangeDto;\nexport type PasswordResetRequestInput = PasswordResetRequestDto;\nexport type PasswordResetConfirmInput = PasswordUpdate;\nexport type AddressCreateInput = AddressCreateDto;\nexport type AddressUpdateInput = AddressUpdateDto;\n\n/** Union of the wire shapes the four session endpoints return. snake_case is\n * canonical; camelCase is the deprecated fallback (vendored spec, design §2). */\ninterface WireSession {\n  access_token?: string;\n  saas_token?: string;\n  refresh_token?: string;\n  session_id?: string;\n  expires_in?: string | number;\n  accessToken?: string;\n  saasToken?: string;\n  refreshToken?: string;\n  social_access_token?: string;\n  social_id_token?: string;\n}\n\n/** Wire→facade mapping shared by login/refresh/socialLogin/exchangeToken.\n * Throws instead of fabricating an empty session: `customerToken: \"\"` would\n * read as authenticated downstream and 401-loop every subsequent call. */\nfunction toSession(\n  endpoint: string,\n  wire: WireSession,\n  opts: { carrySaasToken?: string } = {},\n): CustomerSession {\n  const customerToken = wire.access_token ?? wire.accessToken;\n  if (!customerToken) {\n    throw new EmporixAuthError(`${endpoint}: response missing access_token`, undefined, wire);\n  }\n  return {\n    customerToken,\n    saasToken: wire.saas_token ?? wire.saasToken ?? opts.carrySaasToken ?? \"\",\n    refreshToken: wire.refresh_token ?? wire.refreshToken ?? \"\",\n    sessionId: wire.session_id,\n    expiresIn: wire.expires_in != null ? Number(wire.expires_in) : undefined,\n    ...(wire.social_access_token ? { socialAccessToken: wire.social_access_token } : {}),\n    ...(wire.social_id_token ? { socialIdToken: wire.social_id_token } : {}),\n  };\n}\n\n/** Customer signup, session, profile and addresses. */\nexport class CustomerService {\n  static readonly channel = \"customer\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  /** Obtains an anonymous storefront session (accessToken + sessionId + refreshToken). */\n  async anonymous(): Promise<AnonymousSession> {\n    return this.ctx.tokenProvider.getAnonymousToken();\n  }\n\n  /** Registers a customer. Default auth: anonymous. */\n  async signup(\n    input: CustomerSignupInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Logs a customer in. Threads the anonymous token so the session (and its\n   * cart) survives — losing it silently creates a new session per Emporix docs.\n   * Wire `accessToken` is mapped to `customerToken`.\n   */\n  async login(\n    creds: { email: string; password: string },\n    opts: { anonymousToken?: string } = {},\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const effective: AuthContext = opts.anonymousToken\n      ? { kind: \"raw\", token: opts.anonymousToken }\n      : auth;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/login`,\n      auth: effective,\n      body: creds,\n    });\n    return toSession(\"login\", wire);\n  }\n\n  /**\n   * Refreshes an authenticated customer session via its refresh token,\n   * preserving the same `sessionId`. Calls\n   * `GET /customer/{tenant}/refreshauthtoken?refreshToken=…`, which **must be\n   * authorized with an anonymous token** (default auth: anonymous) — not the\n   * expired customer token. The refresh response does **not** include a\n   * `saas_token`; pass the original `saasToken` to carry it forward (it has\n   * its own, independent lifetime).\n   */\n  async refresh(\n    input: { refreshToken: string; saasToken?: string; legalEntityId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { refreshToken: input.refreshToken };\n    if (input.legalEntityId) query.legalEntityId = input.legalEntityId;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/refreshauthtoken`,\n      query,\n      auth,\n    });\n    // Refresh does not return a saas_token — carry the original forward.\n    return toSession(\n      \"refresh\",\n      wire,\n      input.saasToken !== undefined ? { carrySaasToken: input.saasToken } : {},\n    );\n  }\n\n  /**\n   * Logs the customer out server-side: `GET /customer/{tenant}/logout?\n   * accessToken=…` authorized with the customer token. Invalidates the\n   * access token (204 No Content). Requires customer/raw auth — the token is\n   * sent both as the bearer and the `accessToken` query param (per Emporix).\n   */\n  async logout(auth?: AuthContext): Promise<void> {\n    const ctx = requireCustomer(auth);\n    const token = (ctx as { token: string }).token;\n    await this.ctx.http.request<void>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/logout`,\n      query: { accessToken: token },\n      auth: ctx,\n    });\n  }\n\n  /**\n   * Authorization-Code SSO: exchanges the IdP `code` for an Emporix customer\n   * session via `POST /customer/{tenant}/socialLogin`. The browser performs\n   * the IdP redirect itself; the SDK only does this Emporix exchange.\n   * Default auth: anonymous (Emporix requires an anonymous Bearer). The\n   * response has no `session_id` and returns `expires_in` as a string —\n   * normalized to a number here.\n   */\n  async socialLogin(\n    input: { code: string; redirectUri: string; codeVerifier?: string; sessionId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = {\n      code: input.code,\n      redirect_uri: input.redirectUri,\n    };\n    if (input.codeVerifier) query.code_verifier = input.codeVerifier;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/socialLogin`,\n      query,\n      auth,\n      ...(input.sessionId ? { headers: { \"session-id\": input.sessionId } } : {}),\n    });\n    return toSession(\"socialLogin\", wire);\n  }\n\n  /**\n   * RFC 8693 token exchange: exchanges an external IdP JWT for an Emporix\n   * customer session via `POST /customer/{tenant}/exchangeauthtoken`.\n   * Emporix uses a proprietary query-param wire (not the RFC form body).\n   * Default auth: anonymous. `config` selects a site-specific IdP config\n   * (multi-site); omit for the tenant default. Returns `session_id` and a\n   * fresh `saas_token`; `expires_in` is an integer (normalized anyway).\n   */\n  async exchangeToken(\n    input: { subjectToken: string; config?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { subjectAccessToken: input.subjectToken };\n    if (input.config) query.config = input.config;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/exchangeauthtoken`,\n      query,\n      auth,\n    });\n    return toSession(\"exchangeToken\", wire);\n  }\n\n  /** Returns the authenticated customer. Requires customer/raw auth. */\n  async me(auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /** Updates the authenticated customer. Requires customer/raw auth. */\n  async update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"PUT\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n      body: patch,\n    });\n  }\n\n  /** Changes the password. Requires customer/raw auth. */\n  async changePassword(input: PasswordChangeInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Requests a password reset email. Default auth: anonymous. */\n  async requestPasswordReset(\n    input: PasswordResetRequestInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Confirms a password reset. Default auth: anonymous. */\n  async confirmPasswordReset(\n    input: PasswordResetConfirmInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset/update`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Address sub-resource. All operations require customer/raw auth. */\n  readonly addresses = {\n    list: async (auth?: AuthContext): Promise<Address[]> =>\n      this.ctx.http.request<Address[]>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n      }),\n    add: async (address: AddressCreateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n        body: address,\n      }),\n    update: async (id: string, patch: AddressUpdateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"PUT\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n        body: patch,\n      }),\n    remove: async (id: string, auth?: AuthContext): Promise<void> =>\n      this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n  };\n}\n"]}

package/dist/{chunk-EAWGUZHS.js → chunk-HD5RBCM6.js}

@@ -27,12 +27,14 @@ var ContactsService = class {
     });
   }
   /**
-   * Patches a contact assignment. PATCH endpoint, so the body is a partial of
-   * the generated `ContactAssignmentUpdate` shape.
+   * Updates a contact assignment via `PUT …/contact-assignments/{id}` (upsert /
+   * full replace). The live API rejects `PATCH` on this path with 405; send the
+   * complete entity, as the server replaces the resource. The body stays typed
+   * as a partial of `ContactAssignmentUpdate` for backward compatibility.
    */
   async update(contactAssignmentId, patch, auth) {
     return this.ctx.http.request({
-      method: "PATCH",
+      method: "PUT",
       path: `${this.base()}/${contactAssignmentId}`,
       auth,
       body: patch
@@ -49,5 +51,5 @@ var ContactsService = class {
 };
 
 export { ContactsService };
-//# sourceMappingURL=chunk-EAWGUZHS.js.map
-//# sourceMappingURL=chunk-EAWGUZHS.js.map
+//# sourceMappingURL=chunk-HD5RBCM6.js.map
+//# sourceMappingURL=chunk-HD5RBCM6.js.map

package/dist/chunk-HD5RBCM6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/contacts.ts"],"names":[],"mappings":";AAeO,IAAM,kBAAN,MAAsB;AAAA,EAE3B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,qBAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,oBAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAiD;AAC3F,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA6B;AAAA,MAChD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA,EAAO,EAAE,aAAA,EAAc;AAAA,MACvB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAAgC,IAAA,EAA4C;AACvF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CACJ,mBAAA,EACA,KAAA,EACA,IAAA,EAC4B;AAC5B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA2B;AAAA,MAC9C,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,mBAAmB,CAAA,CAAA;AAAA,MAC3C,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAA,CAAS,mBAAA,EAA6B,IAAA,EAAkC;AAC5E,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,mBAAmB,CAAA,CAAA;AAAA,MAC3C;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-HD5RBCM6.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  ContactAssignment,\n  ContactAssignmentCreate,\n  ContactAssignmentUpdate,\n} from \"../generated/customer-management\";\n\n/**\n * Manages contact assignments linking customers to legal entities.\n *\n * `listForCompany` requires `customermanagement.contactassignment_read`;\n * `assign`/`update`/`unassign` require `_manage`. The query param\n * `legalEntityId` scopes the list to one company.\n */\nexport class ContactsService {\n  static readonly channel = \"customer-management\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/contact-assignments`;\n  }\n\n  /** Lists contact assignments for one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<ContactAssignment[]> {\n    return this.ctx.http.request<ContactAssignment[]>({\n      method: \"GET\",\n      path: this.base(),\n      query: { legalEntityId },\n      auth,\n    });\n  }\n\n  /** Creates a contact assignment. */\n  async assign(input: ContactAssignmentCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Updates a contact assignment via `PUT …/contact-assignments/{id}` (upsert /\n   * full replace). The live API rejects `PATCH` on this path with 405; send the\n   * complete entity, as the server replaces the resource. The body stays typed\n   * as a partial of `ContactAssignmentUpdate` for backward compatibility.\n   */\n  async update(\n    contactAssignmentId: string,\n    patch: Partial<ContactAssignmentUpdate>,\n    auth: AuthContext,\n  ): Promise<ContactAssignment> {\n    return this.ctx.http.request<ContactAssignment>({\n      method: \"PUT\",\n      path: `${this.base()}/${contactAssignmentId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a contact assignment. */\n  async unassign(contactAssignmentId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${contactAssignmentId}`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/{chunk-PAT4CS36.js → chunk-HUEMYP2L.js}

@@ -120,22 +120,37 @@ var CartService = class {
       auth: requireCartAuth(auth)
     });
   }
-  /** Applies a coupon. */
+  /**
+   * Applies a coupon by code. Coupon application goes through the cart's
+   * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —
+   * the live API has no `…/coupons` path. The apply response only carries the
+   * applied-discount reference (`{ discountId, discountIndex }`), so the updated
+   * cart is re-fetched and returned to preserve the `Cart` contract.
+   */
   async applyCoupon(cartId, code, auth) {
-    return this.ctx.http.request({
+    const cartAuth = requireCartAuth(auth);
+    await this.ctx.http.request({
       method: "POST",
-      path: `${this.base()}/${cartId}/coupons`,
-      auth: requireCartAuth(auth),
+      path: `${this.base()}/${cartId}/discounts`,
+      auth: cartAuth,
       body: { code }
     });
+    return this.get(cartId, cartAuth);
   }
-  /** Removes a coupon. */
+  /**
+   * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live
+   * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so
+   * the updated cart is re-fetched and returned.
+   */
   async removeCoupon(cartId, code, auth) {
-    return this.ctx.http.request({
+    const cartAuth = requireCartAuth(auth);
+    await this.ctx.http.request({
       method: "DELETE",
-      path: `${this.base()}/${cartId}/coupons/${code}`,
-      auth: requireCartAuth(auth)
+      path: `${this.base()}/${cartId}/discounts`,
+      query: { codes: code },
+      auth: cartAuth
     });
+    return this.get(cartId, cartAuth);
   }
   /** Sets the shipping address. */
   async setShippingAddress(cartId, address, auth) {
@@ -174,5 +189,5 @@ var CartService = class {
 };
 
 export { CartService };
-//# sourceMappingURL=chunk-PAT4CS36.js.map
-//# sourceMappingURL=chunk-PAT4CS36.js.map
+//# sourceMappingURL=chunk-HUEMYP2L.js.map
+//# sourceMappingURL=chunk-HUEMYP2L.js.map

package/dist/chunk-HUEMYP2L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/cart.ts"],"names":[],"mappings":";;;AAkCA,SAAS,gBAAgB,IAAA,EAA4C;AACnE,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,cAAc,OAAO,IAAA;AAC5E,EAAA,MAAM,IAAI,sBAAA;AAAA,IACR;AAAA,GACF;AACF;AAEA,SAAS,oBAAoB,IAAA,EAA4C;AACvE,EAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AAC7C,EAAA,MAAM,IAAI,uBAAuB,wDAAwD,CAAA;AAC3F;AAGO,IAAM,cAAN,MAAkB;AAAA,EAEvB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,MAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,EACjC;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,IAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,SAAS;AAAC,KACjB,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,MAAA,EAAgB,IAAA,EAAkC;AAC1D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAA,CACJ,IAAA,EACA,IAAA,EACsB;AACtB,IAAA,MAAM,KAAA,GAAyC,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS;AACzE,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,KAAA,CAAM,OAAO,IAAA,CAAK,IAAA;AAC/C,IAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,IAAA,CAAK,aAAA;AACjE,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,MAAA;AAChC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QACvC,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,KAAA;AAAA,QACA,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,sBAAsB,OAAO,IAAA;AAC9C,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAA,CACJ,MAAA,EACA,KAAA,EACA,IAAA,EACiC;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAgC;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,WAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,WACJ,MAAA,EACA,MAAA,EACA,OACA,IAAA,EACA,IAAA,GAA8B,EAAC,EAChB;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM,KAAA;AAAA,MACN,GAAI,IAAA,CAAK,OAAA,GAAU,EAAE,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAO,EAAE,GAAI;AAAC,KACtD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CAAW,MAAA,EAAgB,MAAA,EAAgB,IAAA,EAAkC;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MAC9C,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,CAAM,MAAA,EAAgB,IAAA,EAAkC;AAC5D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AAChF,IAAA,MAAM,QAAA,GAAW,gBAAgB,IAAI,CAAA;AACrC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAyB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,UAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,QAAA;AAAA,MACN,IAAA,EAAM,EAAE,IAAA;AAAK,KACd,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAA,CAAa,MAAA,EAAgB,IAAA,EAAc,IAAA,EAAkC;AACjF,IAAA,MAAM,QAAA,GAAW,gBAAgB,IAAI,CAAA;AACrC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,UAAA,CAAA;AAAA,MAC9B,KAAA,EAAO,EAAE,KAAA,EAAO,IAAA,EAAK;AAAA,MACrB,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,MAAA,EACA,OAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAC9B,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,KAAA,CACJ,cAAA,EACA,gBAAA,EACA,IAAA,EACe;AACf,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MACjC,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,cAAc,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA,EAAM,oBAAoB,IAAI,CAAA;AAAA,MAC9B,IAAA,EAAM,EAAE,KAAA,EAAO,gBAAA;AAAiB,KACjC,CAAA;AAAA,EACH;AACF","file":"chunk-HUEMYP2L.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixNotFoundError, EmporixValidationError } from \"../core/errors\";\nimport type {\n  Cart as GeneratedCart,\n  CreateCart,\n  CreatedCart,\n  CartItemRequest,\n  UpdateCartItem,\n  AddressRequest,\n  AppliedDiscount,\n  BatchResponse as GeneratedBatchResponse,\n  SingleBatchResponse as GeneratedSingleBatchResponse,\n} from \"../generated/cart\";\n\n/** A cart as returned by the Cart service (all generated fields). */\nexport type Cart = GeneratedCart;\n\n/** The cart-create response (`{ cartId, yrn }`, generated). */\nexport type CartCreated = CreatedCart;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CreateCartInput = CreateCart;\nexport type CartItemInput = CartItemRequest;\nexport type CartItemUpdate = UpdateCartItem;\n\n/** Per-entry result of `addItemsBatch`. `status` is HTTP-style per entry (e.g. 201 = added, 4xx = failed). */\nexport type CartItemBatchEntry = GeneratedSingleBatchResponse;\n/** Response shape of `addItemsBatch` — one entry per input item, matching by `index`. */\nexport type CartItemsBatchResponse = GeneratedBatchResponse;\n\n/** An address payload for cart shipping/billing (generated). */\nexport type CartAddress = AddressRequest;\n\nfunction requireCartAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"anonymous\")) return auth;\n  throw new EmporixValidationError(\n    \"CartService requires an explicit { kind: 'customer' } or { kind: 'anonymous' } AuthContext\",\n  );\n}\n\nfunction requireCustomerAuth(auth: AuthContext | undefined): AuthContext {\n  if (auth && auth.kind === \"customer\") return auth;\n  throw new EmporixValidationError(\"cart.merge requires a { kind: 'customer' } AuthContext\");\n}\n\n/** Cart operations. Every method requires an explicit customer/anonymous context. */\nexport class CartService {\n  static readonly channel = \"cart\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/cart/${this.ctx.tenant}/carts`;\n  }\n\n  /** Creates a cart. */\n  async create(\n    input: CreateCartInput | undefined,\n    auth: AuthContext,\n  ): Promise<CartCreated> {\n    return this.ctx.http.request<CartCreated>({\n      method: \"POST\",\n      path: this.base(),\n      auth: requireCartAuth(auth),\n      body: input ?? {},\n    });\n  }\n\n  /** Fetches a cart by id. */\n  async get(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"GET\",\n      path: `${this.base()}/${cartId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Returns the current cart for the session, or null if none. */\n  /**\n   * Get the customer / anonymous cart matching the given criteria. Per Emporix:\n   * uniqueness is defined by `siteCode` + `type` + `legalEntityId` +\n   * (`customerId` derived from a customer token, or `sessionId` derived from an\n   * anonymous token). With `create: true`, Emporix creates a new cart if none\n   * matches.\n   *\n   * Returns `null` on 404 (no cart found and `create` was not set). All other\n   * errors are propagated.\n   */\n  async getCurrent(\n    auth: AuthContext,\n    opts: { siteCode: string; type?: string; legalEntityId?: string; create?: boolean },\n  ): Promise<Cart | null> {\n    const query: Record<string, string | number> = { siteCode: opts.siteCode };\n    if (opts.type !== undefined) query.type = opts.type;\n    if (opts.legalEntityId !== undefined) query.legalEntityId = opts.legalEntityId;\n    if (opts.create) query.create = \"true\";\n    try {\n      return await this.ctx.http.request<Cart>({\n        method: \"GET\",\n        path: this.base(),\n        query,\n        auth: requireCartAuth(auth),\n      });\n    } catch (e) {\n      if (e instanceof EmporixNotFoundError) return null;\n      throw e;\n    }\n  }\n\n  /** Adds an item. */\n  async addItem(\n    cartId: string,\n    item: CartItemInput,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n      body: item,\n    });\n  }\n\n  /**\n   * Adds multiple items in a single request via `POST /carts/{id}/itemsBatch`.\n   * Server-side limit is 200 entries per call — callers handling larger sets\n   * must chunk. The response carries a per-entry `status` (HTTP-style: 201\n   * for added, 4xx/5xx for failed) and `index` matching the input position;\n   * partial failures do **not** throw — inspect `status` per entry.\n   */\n  async addItemsBatch(\n    cartId: string,\n    items: CartItemInput[],\n    auth: AuthContext,\n  ): Promise<CartItemsBatchResponse> {\n    return this.ctx.http.request<CartItemsBatchResponse>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/itemsBatch`,\n      auth: requireCartAuth(auth),\n      body: items,\n    });\n  }\n\n  /**\n   * Updates an item. By default this is a **full replace** — the server expects\n   * the complete item (e.g. `itemYrn` + the `price` row). Pass\n   * `{ partial: true }` to send a **partial update** (`?partial=true`), e.g. a\n   * quantity-only change with just `{ quantity }`.\n   */\n  async updateItem(\n    cartId: string,\n    itemId: string,\n    patch: CartItemUpdate,\n    auth: AuthContext,\n    opts: { partial?: boolean } = {},\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n      body: patch,\n      ...(opts.partial ? { query: { partial: \"true\" } } : {}),\n    });\n  }\n\n  /** Removes an item. */\n  async removeItem(cartId: string, itemId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items/${itemId}`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /** Empties the cart. */\n  async clear(cartId: string, auth: AuthContext): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/items`,\n      auth: requireCartAuth(auth),\n    });\n  }\n\n  /**\n   * Applies a coupon by code. Coupon application goes through the cart's\n   * `discounts` endpoint (`POST …/discounts` with a coupon-code-only payload) —\n   * the live API has no `…/coupons` path. The apply response only carries the\n   * applied-discount reference (`{ discountId, discountIndex }`), so the updated\n   * cart is re-fetched and returned to preserve the `Cart` contract.\n   */\n  async applyCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    const cartAuth = requireCartAuth(auth);\n    await this.ctx.http.request<AppliedDiscount>({\n      method: \"POST\",\n      path: `${this.base()}/${cartId}/discounts`,\n      auth: cartAuth,\n      body: { code },\n    });\n    return this.get(cartId, cartAuth);\n  }\n\n  /**\n   * Removes a coupon by code via `DELETE …/discounts?codes=<code>` — the live\n   * API has no `…/coupons/<code>` path. The delete responds 204 No Content, so\n   * the updated cart is re-fetched and returned.\n   */\n  async removeCoupon(cartId: string, code: string, auth: AuthContext): Promise<Cart> {\n    const cartAuth = requireCartAuth(auth);\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${cartId}/discounts`,\n      query: { codes: code },\n      auth: cartAuth,\n    });\n    return this.get(cartId, cartAuth);\n  }\n\n  /** Sets the shipping address. */\n  async setShippingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/shipping-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /** Sets the billing address. */\n  async setBillingAddress(\n    cartId: string,\n    address: CartAddress,\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"PUT\",\n      path: `${this.base()}/${cartId}/billing-address`,\n      auth: requireCartAuth(auth),\n      body: address,\n    });\n  }\n\n  /**\n   * Merges one or more anonymous carts into the specified customer cart.\n   * Per Emporix: the target cart in the path **must belong to the logged-in\n   * customer**, and each id in `anonymousCartIds` must belong to an anonymous\n   * customer. Anonymous carts go `CLOSED` on success.\n   *\n   * Requires a customer `AuthContext`.\n   */\n  async merge(\n    customerCartId: string,\n    anonymousCartIds: string[],\n    auth: AuthContext,\n  ): Promise<Cart> {\n    return this.ctx.http.request<Cart>({\n      method: \"POST\",\n      path: `${this.base()}/${customerCartId}/merge`,\n      auth: requireCustomerAuth(auth),\n      body: { carts: anonymousCartIds },\n    });\n  }\n}\n"]}

package/dist/{chunk-DUVIIWFG.js → chunk-IAOWDMTA.js}

@@ -35,12 +35,14 @@ var LocationsService = class {
     });
   }
   /**
-   * Patches a location. PATCH endpoint, so the body is a partial of the
-   * generated `LocationUpdate` shape.
+   * Updates a location via `PUT …/locations/{id}` (upsert / full replace). The
+   * live API rejects `PATCH` on this path with 405; send the complete entity,
+   * as the server replaces the resource. The body stays typed as a partial of
+   * `LocationUpdate` for backward compatibility.
    */
   async update(locationId, patch, auth) {
     return this.ctx.http.request({
-      method: "PATCH",
+      method: "PUT",
       path: `${this.base()}/${locationId}`,
       auth,
       body: patch
@@ -57,5 +59,5 @@ var LocationsService = class {
 };
 
 export { LocationsService };
-//# sourceMappingURL=chunk-DUVIIWFG.js.map
-//# sourceMappingURL=chunk-DUVIIWFG.js.map
+//# sourceMappingURL=chunk-IAOWDMTA.js.map
+//# sourceMappingURL=chunk-IAOWDMTA.js.map

package/dist/chunk-IAOWDMTA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/locations.ts"],"names":[],"mappings":";AAeO,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,qBAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,UAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAwC;AAClF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAoB;AAAA,MACvC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,KAAA,EAAO,EAAE,aAAA,EAAc;AAAA,MACvB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,UAAA,EAAoB,IAAA,EAAsC;AAClE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAAuB,IAAA,EAA4C;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CACJ,UAAA,EACA,KAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,UAAA,EAAoB,IAAA,EAAkC;AACjE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,UAAU,CAAA,CAAA;AAAA,MAClC;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-IAOWDMTA.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  Location,\n  LocationCreate,\n  LocationUpdate,\n} from \"../generated/customer-management\";\n\n/**\n * Manages locations owned by a legal entity. Three types are supported:\n * HEADQUARTER, WAREHOUSE, OFFICE.\n *\n * Reads require `customermanagement.location_read`; mutations require\n * `_manage`.\n */\nexport class LocationsService {\n  static readonly channel = \"customer-management\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/locations`;\n  }\n\n  /** Lists locations owned by one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<Location[]> {\n    return this.ctx.http.request<Location[]>({\n      method: \"GET\",\n      path: this.base(),\n      query: { legalEntityId },\n      auth,\n    });\n  }\n\n  /** Fetches one location by id. */\n  async get(locationId: string, auth: AuthContext): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"GET\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n\n  /** Creates a location for a legal entity. */\n  async create(input: LocationCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Updates a location via `PUT …/locations/{id}` (upsert / full replace). The\n   * live API rejects `PATCH` on this path with 405; send the complete entity,\n   * as the server replaces the resource. The body stays typed as a partial of\n   * `LocationUpdate` for backward compatibility.\n   */\n  async update(\n    locationId: string,\n    patch: Partial<LocationUpdate>,\n    auth: AuthContext,\n  ): Promise<Location> {\n    return this.ctx.http.request<Location>({\n      method: \"PUT\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a location. */\n  async delete(locationId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${locationId}`,\n      auth,\n    });\n  }\n}\n"]}