@viu/emporix-sdk 2.34.0 → 2.36.0

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # @viu/emporix-sdk
 
+## 2.36.0
+
+### Minor Changes
+
+- [#278](https://github.com/viuteam/emporix-sdk/pull/278) [`9cb8b15`](https://github.com/viuteam/emporix-sdk/commit/9cb8b15d14a122e5a69a36a4c1d4cce7c1308c3f) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
+
+  Updated services: ai-service
+
+  Raised from `patch` to `minor` by hand: this sync reshapes the MCP server model
+  rather than extending it, and a patch would not announce that.
+
+  **`McpServerResponse` is now a union.** Emporix split the single managed-MCP-server
+  shape into a custom and a dynamic variant:
+
+  ```ts
+  // before
+  type McpServerResponse = BaseMcpServer & { … }
+  // after
+  type McpServerResponse = CustomMcpServerResponse | DynamicMcpServerResponse
+  ```
+
+  `McpServerRequest` splits the same way. Since `client.ai.mcpServers` is typed
+  `AgenticCrudResource<McpServer, McpServerInput>` and `McpServer` aliases
+  `McpServerResponse`, code that reads fields off a returned MCP server now has to
+  narrow first. Nothing inside the SDK does, which is why the build stays green — the
+  break lands in consumer code.
+
+  Also in this sync:
+  - `McpServerType` gains `'dynamic'` (was `'custom' | 'predefined'`).
+  - `BaseMcpServer` and `CustomAgentMcpServerResponse` are gone, replaced by
+    `BaseManagedMcpServer` and `AgentMcpServerResponse`.
+  - `AgentMcpServersResponse` changes element type to `Array<AgentMcpServerResponse>`.
+  - Eight new types describe MCP tool invocation: `McpToolRequest`/`Response`,
+    `McpToolConfigRequest`/`Response`, `McpToolInvocationRequest`/`Response`,
+    `McpToolInvocationMethod` and `McpToolInvocationArgsLocation`.
+
+  No facade change: all 57 ai-service operations were already wrapped, and none of
+  the removed type names appear outside the generated file.
+
+### Patch Changes
+
+- [#277](https://github.com/viuteam/emporix-sdk/pull/277) [`f2b5def`](https://github.com/viuteam/emporix-sdk/commit/f2b5def1f125725602ca461f3cdd6b6cb485795c) Thanks [@amnael1](https://github.com/amnael1)! - docs: correct three stale claims in the SDK README, add the missing mixins LICENSE
+
+  Checked every verifiable claim in the sdk, react and mixins READMEs against the
+  code. The react one was clean. Three things in the SDK README were wrong:
+  - **`credentials.backend` was marked «(required)»**. It is not: `validateConfig`
+    requires only that the `credentials` object exists, so `credentials: {}` is a
+    legal credential-free client — which is exactly what `examples/md-module` does,
+    where the Managed Dashboard host owns the token. The table now marks
+    `credentials` itself as required and explains the empty case.
+  - **`customerGroups` was described as «read-only for now»**. It has `addMember`
+    and `removeMember`, and the React README already documented the
+    `useAddGroupMember` / `useRemoveGroupMember` hooks for them — the two READMEs
+    contradicted each other.
+  - **`availability` was described as a read-only service** naming two of its nine
+    methods. It has three reads defaulting to `anonymous` and six writes
+    (`create`, `update`, `delete`, `bulkCreate`, `bulkUpdate`, `bulkDelete`)
+    defaulting to `service`.
+
+  The documented tenant pattern was also the one from the error message
+  (`^[a-z][a-z0-9]+$`) rather than the one the code applies
+  (`^[a-z][a-z0-9]{2,15}$`); the prose «3–16 chars» was already right.
+
+  **`@viu/emporix-mixins` was shipping without a LICENSE file.** Its `files` array
+  has listed `LICENSE` since the changelog-links change, and `package.json`
+  declares `"license": "MIT"`, but the file itself never existed — so the published
+  tarball carried no license text. Added, identical to the other three packages.
+  Its README also gains the CI/npm badges and the Authors and License sections the
+  others have.
+
+## 2.35.0
+
+### Minor Changes
+
+- [#273](https://github.com/viuteam/emporix-sdk/pull/273) [`23406dc`](https://github.com/viuteam/emporix-sdk/commit/23406dc3b99bde255c3c01157f3ee6093bbc490a) Thanks [@amnael1](https://github.com/amnael1)! - feat(sdk): expose the customer password-migration endpoints
+
+  `client.customerAdmin` gains the four operations Emporix added to the Customer
+  Service: `getPasswordMigrationRetention`, `configurePasswordMigrationRetention`
+  and `deletePasswordMigrationRetention` for the retention window, plus
+  `importCustomers` for the bulk import.
+
+  Together they cover migrating customers off a legacy shop. Configure a retention
+  window, import customers carrying `legacyAuth`, and each legacy password hash is
+  replaced with an Emporix hash on that customer's first successful login. Without
+  an active config the import is rejected — the order matters.
+
+  `importCustomers` answers **207 Multi-Status**, so per-item failures arrive as
+  data with their own `code` rather than throwing. Inspect every entry.
+
+  All four need a service token with `customer.import_read` or
+  `customer.import_manage`, so there are no React hooks — see `docs/customer-admin.md`.
+
+### Patch Changes
+
+- [#272](https://github.com/viuteam/emporix-sdk/pull/272) [`87552e7`](https://github.com/viuteam/emporix-sdk/commit/87552e72d5e2de7d1523c3664c49d3cd2f643214) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
+
+  Updated services: customer-service
+
 ## 2.34.0
 
 ### Minor Changes

package/README.md

@@ -93,8 +93,9 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
 
 | Option | Default | Notes |
 | --- | --- | --- |
-| `tenant` (required) | — | lowercase, 3–16 chars, `^[a-z][a-z0-9]+$` |
-| `credentials.backend` (required) | — | `{ clientId, secret, scope? }` — service token |
+| `tenant` (required) | — | lowercase, 3–16 chars, `^[a-z][a-z0-9]{2,15}$` |
+| `credentials` (required) | — | the object itself is required; which sets it holds is up to you |
+| `credentials.backend` | — | `{ clientId, secret, scope? }` — service token |
 | `credentials.storefront` | — | `{ clientId }` — anonymous token (no secret) |
 | `credentials.custom` | — | `Record<name, { clientId, secret, scope? }>` |
 | `host` | `https://api.emporix.io` | |
@@ -104,6 +105,13 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
 | `logger` | console @ `warn` | `false`, a `Logger`, or `{ level, services, pretty, redact }` |
 | `tokenProvider` | built-in | inject for SSO/token-exchange |
 
+`credentials: {}` is legal: a client that never mints its own token, for when the
+token comes from outside. The Managed Dashboard module in
+[`examples/md-module`](../../examples/md-module) is built exactly that way — the
+host hands it a customer token and the SDK only passes it through. Pass
+`credentials.backend` when you need a `service` AuthContext, `storefront` for
+anonymous browsing, both when you need both.
+
 ## AuthContext per method
 
 `auth.service(name?)`, `auth.anonymous()`, `auth.customer(token)`,
@@ -141,8 +149,9 @@ header, guest checkout and deferred payment are covered in
 ## B2B
 
 `sdk.companies` (legal entities), `sdk.contacts` (contact assignments),
-`sdk.locations` (HQ/warehouse/office), `sdk.customerGroups` (IAM groups,
-read-only for now). Switching company scope is a customer-token rescope via
+`sdk.locations` (HQ/warehouse/office), `sdk.customerGroups` (IAM groups —
+`listForCompany` plus `addMember` / `removeMember`). Switching company scope is
+a customer-token rescope via
 `sdk.customers.refresh({ refreshToken, legalEntityId })`. Mutations that the
 customer's role lacks scope for surface as `EmporixInsufficientScopeError`
 (extends `EmporixForbiddenError`, carries `requiredScope`). See
@@ -162,11 +171,16 @@ the Media service directly. See [`../../docs/media.md`](../../docs/media.md).
 
 ## Availability
 
-`sdk.availability` reads site-aware product availability: `get(productId, siteCode)`
-for one product and `getMany(productIds, siteCode)` for a batch (single
-`POST .../search` request, result in input order). The opt-in
+`sdk.availability` covers site-aware product availability in both directions.
+
+**Reads** (default `anonymous`): `get(productId, siteCode)` for one product,
+`getMany(productIds, siteCode)` for a batch (single `POST .../search` request,
+result in input order), and `listForSite(siteCode)`. The opt-in
 `defaultAvailableOnNotFound` returns `{ available: true }` for products without a
-stock record. There is no restock-date field. See [`../../docs/availability.md`](../../docs/availability.md).
+stock record. There is no restock-date field.
+
+**Writes** (default `service`, so server-only): `create`, `update`, `delete`, plus
+`bulkCreate` / `bulkUpdate` / `bulkDelete`. See [`../../docs/availability.md`](../../docs/availability.md).
 
 ## Subpath exports
 

package/dist/index.cjs

@@ -995,7 +995,7 @@ var HttpClient = class {
 };
 
 // package.json
-var version = "2.34.0";
+var version = "2.36.0";
 
 // src/version.ts
 var SDK_VERSION = version;
@@ -8390,6 +8390,9 @@ var CustomerAdminService = class {
   customerPath(customerNumber) {
     return `${this.base()}/${encodeURIComponent(customerNumber)}`;
   }
+  configPath() {
+    return `/customer/${this.ctx.tenant}/config/password-migration-retention`;
+  }
   addressPath(customerNumber, addressId) {
     return `${this.customerPath(customerNumber)}/addresses/${encodeURIComponent(addressId)}`;
   }
@@ -8480,6 +8483,59 @@ var CustomerAdminService = class {
       query: { tags: tags.join(",") }
     });
   }
+  // --- Password-migration retention ---
+  /**
+   * Retrieves the tenant's password-migration retention config. Requires the
+   * `customer.import_read` scope. An unconfigured tenant answers with an empty
+   * object rather than a 404.
+   */
+  async getPasswordMigrationRetention(auth2 = SERVICE35) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: this.configPath(),
+      auth: auth2
+    });
+  }
+  /**
+   * Creates or updates the retention config (`POST`). Requires the
+   * `customer.import_manage` scope. **Call this before importing customers with
+   * `legacyAuth`** — that import is rejected without an active config. Re-POST with
+   * an earlier `retentionEndDate` to shorten a running window.
+   */
+  async configurePasswordMigrationRetention(input, auth2 = SERVICE35) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: this.configPath(),
+      auth: auth2,
+      body: input
+    });
+  }
+  /**
+   * Removes the retention config. Requires the `customer.import_manage` scope.
+   * Intended for after the migration window: when the window ends, unmigrated
+   * accounts need a password reset and their legacy credentials are cleared.
+   */
+  async deletePasswordMigrationRetention(auth2 = SERVICE35) {
+    await this.ctx.http.request({ method: "DELETE", path: this.configPath(), auth: auth2 });
+  }
+  // --- Bulk import ---
+  /**
+   * Bulk-imports customers (`POST /customers/import`). Requires the
+   * `customer.import_manage` scope.
+   *
+   * Responds **207 Multi-Status**: per-item failures do **not** throw — inspect each
+   * entry's `code`. Each item must carry exactly one of `account.passwordHash` or
+   * `account.legacyAuth`, and importing `legacyAuth` requires an active retention
+   * config (see `configurePasswordMigrationRetention`).
+   */
+  async importCustomers(input, auth2 = SERVICE35) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/import`,
+      auth: auth2,
+      body: input
+    });
+  }
 };
 
 // src/services/approval.ts