@viu/emporix-sdk 2.36.0 → 2.37.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @viu/emporix-sdk
 
+## 2.37.0
+
+### Minor Changes
+
+- [#292](https://github.com/viuteam/emporix-sdk/pull/292) [`6efa5b0`](https://github.com/viuteam/emporix-sdk/commit/6efa5b02ab213ab92a7b57edbd09845d1d017a6a) Thanks [@amnael1](https://github.com/amnael1)! - feat(sdk): wrap the two operations an audit found unwrapped
+
+  An operation-by-operation audit of all 44 vendored specs found the SDK covering
+  every non-deprecated operation except two. Both are now wrapped:
+  - **`client.customers.validateToken(auth)`** — `GET /customer/{tenant}/validateauthtoken`.
+    Reports what a customer token carries: `scope`, `sessionId`, `email`,
+    `legalEntityId`, `expires_in`. A check rather than a predicate — an invalid
+    token answers `401`, which surfaces as `EmporixAuthError`. Useful when the
+    token came from elsewhere (an SSO exchange, a Managed Dashboard host) and you
+    need its scopes before deciding what to render.
+  - **`client.iam.users.getGroup(userId, groupId, auth)`** —
+    `GET /iam/{tenant}/users/{userId}/groups/{groupId}`. The collection read
+    (`users.getGroups`) was already there; the item read was not, so a caller
+    holding both ids had to page the collection to resolve one group.
+
+  `SessionContextService`'s doc comment now states which operations it
+  deliberately does **not** wrap and why: Emporix exposes the same four
+  session-context operations addressed by an explicit session id, which lets a
+  caller read and rewrite someone else's session. That is an administrative
+  surface and does not belong on the object a storefront holds.
+
+  No behaviour changes to existing methods.
+
+### Patch Changes
+
+- [#291](https://github.com/viuteam/emporix-sdk/pull/291) [`15e5f63`](https://github.com/viuteam/emporix-sdk/commit/15e5f63cd682bc528aad7ca9ae898e0249750a69) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
+
+  Updated services: ai-service
+
+## 2.36.1
+
+### Patch Changes
+
+- [#286](https://github.com/viuteam/emporix-sdk/pull/286) [`2d7e496`](https://github.com/viuteam/emporix-sdk/commit/2d7e496c64fc1df4ffe24db436ec10cc1c2ae4b4) Thanks [@amnael1](https://github.com/amnael1)! - chore(sdk): bump the type generator to @hey-api/openapi-ts 0.97.3
+
+  Answers two Dependabot alerts on the codegen. Regenerated from the **same** vendored
+  specs, so no Emporix API surface changes — only how the generator emits it: 88 files,
+  +2051/-352.
+
+  Two generated names disappear, both internal and neither reachable from the package
+  root: `_Error` and `_Object` are now emitted under their real names, `Error` and
+  `Object`. The bundler renames the collision away (`Object$1` in `dist/index.d.ts`), so
+  nothing shadows the globals and no export list mentions either name. Every other
+  exported name is unchanged; 102 are new.
+
+  `jiti` is pinned to `2.6.1` in the root `pnpm.overrides` as part of this change.
+  Bumping the generator pulls `jiti` to 2.7.0 through `c12`, which re-resolves every
+  `vite`, `vitest` and `eslint` peer in the tree — and with that resolution the
+  `packages/react` suite fails intermittently: 2 failures in 6 runs, against 0 in 9 runs
+  without it. Pinning `jiti` restores 6 of 6. The pin is a quarantine, not a diagnosis:
+  the underlying reason jiti 2.7.0 destabilises that suite is unknown and will need
+  finding before the pin can go.
+
 ## 2.36.0
 
 ### Minor Changes

package/dist/cart.d.cts

@@ -135,6 +135,7 @@ type Cart$1 = BaseCart & {
      *
      * ***NOTE***
      * This attribute is deprecated. Please use the `deliveryWindow` attribute.
+     *
      * @deprecated
      */
     deliveryWindowId?: string;
@@ -218,13 +219,15 @@ type CartItemRequest = {
      */
     id?: string;
     /**
-     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated.  When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
+     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated. When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
      */
     keepAsSeparateLineItem?: boolean;
     product?: Product & {
         [key: string]: unknown;
     };
     /**
+     * YRN
+     *
      * A unique identifier of a global resource, which stores information about the resource, such as its type, ID or name of the tenant. This field should not be provided when itemType is EXTERNAL and request contains external product.
      */
     itemYrn?: string;
@@ -270,6 +273,7 @@ type CartItemRequest = {
      * Deprecated, use product `weightDependent` attribute that is stored in the database.
      * If set to `true`, the storefront displays a hint that the total price of the product may vary depending on the product’s actual weight.
      *
+     *
      * @deprecated
      */
     weightDependent?: boolean;
@@ -425,7 +429,7 @@ type BaseCartItemResponse = {
      */
     id?: string;
     /**
-     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated.  When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
+     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated. When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
      */
     keepAsSeparateLineItem?: boolean;
     yrn?: Yrn;
@@ -497,6 +501,7 @@ type CartItemResponse = BaseCartItemResponse & {
     };
     /**
      * **This field is deprecated**. Please use `calculatedPrice.price` instead.
+     *
      * @deprecated
      */
     itemTaxInfo?: Array<TaxValue>;
@@ -519,7 +524,8 @@ type CartItemResponse = BaseCartItemResponse & {
         [key: string]: unknown;
     };
     /**
-     * **This field is deprecated**. Please use `calculatedPrice.fees` instead.  A fee has an enum value that allows to distinguish external prices
+     * **This field is deprecated**. Please use `calculatedPrice.fees` instead. A fee has an enum value that allows to distinguish external prices
+     *
      * @deprecated
      */
     externalFees?: Array<ExternalFee>;
@@ -792,6 +798,9 @@ type DiscountValidationDetails = {
     message?: string;
     details?: Array<string>;
 };
+/**
+ * fee
+ */
 type Fee = {
     yrn?: Yrn;
     name?: LocalizedValue;
@@ -1031,6 +1040,8 @@ type SingleBatchResponse = {
     yrn?: Yrn;
 };
 /**
+ * updateCartItemsBatchEntryResponse
+ *
  * Result for a single cart item in a batch update, aligned with bulk operation entry responses.
  */
 type UpdateCartItemsBatchEntryResponse = {
@@ -1277,6 +1288,8 @@ type CartItemsBatchUpdateRequest = Array<CartItemRequest & {
 }>;
 type BatchResponse = Array<SingleBatchResponse>;
 /**
+ * YRN
+ *
  * A unique identifier of a global resource, which stores information about the resource, such as its type, ID or name of the tenant.
  */
 type Yrn = string;
@@ -1813,6 +1826,9 @@ type ItemCalculatedPrice = {
         taxCode?: string;
     };
 };
+/**
+ * calculatedAppliedDiscount
+ */
 type CalculatedAppliedDiscount = {
     /**
      * The ID of the applied discount.
@@ -1835,6 +1851,8 @@ type CalculatedAppliedDiscount = {
     origin?: 'INTERNAL' | 'EXTERNAL';
 };
 /**
+ * calculatedTotalDiscount
+ *
  * The total combined value of all applied discounts.
  */
 type CalculatedTotalDiscount = {

package/dist/cart.d.ts

@@ -135,6 +135,7 @@ type Cart$1 = BaseCart & {
      *
      * ***NOTE***
      * This attribute is deprecated. Please use the `deliveryWindow` attribute.
+     *
      * @deprecated
      */
     deliveryWindowId?: string;
@@ -218,13 +219,15 @@ type CartItemRequest = {
      */
     id?: string;
     /**
-     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated.  When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
+     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated. When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
      */
     keepAsSeparateLineItem?: boolean;
     product?: Product & {
         [key: string]: unknown;
     };
     /**
+     * YRN
+     *
      * A unique identifier of a global resource, which stores information about the resource, such as its type, ID or name of the tenant. This field should not be provided when itemType is EXTERNAL and request contains external product.
      */
     itemYrn?: string;
@@ -270,6 +273,7 @@ type CartItemRequest = {
      * Deprecated, use product `weightDependent` attribute that is stored in the database.
      * If set to `true`, the storefront displays a hint that the total price of the product may vary depending on the product’s actual weight.
      *
+     *
      * @deprecated
      */
     weightDependent?: boolean;
@@ -425,7 +429,7 @@ type BaseCartItemResponse = {
      */
     id?: string;
     /**
-     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated.  When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
+     * Indicates that products are maintained as individual entries in the cart, rather than being consolidated. When identical products are added multiple times, each addition creates a new line item instead of increasing the quantity of an existing one.
      */
     keepAsSeparateLineItem?: boolean;
     yrn?: Yrn;
@@ -497,6 +501,7 @@ type CartItemResponse = BaseCartItemResponse & {
     };
     /**
      * **This field is deprecated**. Please use `calculatedPrice.price` instead.
+     *
      * @deprecated
      */
     itemTaxInfo?: Array<TaxValue>;
@@ -519,7 +524,8 @@ type CartItemResponse = BaseCartItemResponse & {
         [key: string]: unknown;
     };
     /**
-     * **This field is deprecated**. Please use `calculatedPrice.fees` instead.  A fee has an enum value that allows to distinguish external prices
+     * **This field is deprecated**. Please use `calculatedPrice.fees` instead. A fee has an enum value that allows to distinguish external prices
+     *
      * @deprecated
      */
     externalFees?: Array<ExternalFee>;
@@ -792,6 +798,9 @@ type DiscountValidationDetails = {
     message?: string;
     details?: Array<string>;
 };
+/**
+ * fee
+ */
 type Fee = {
     yrn?: Yrn;
     name?: LocalizedValue;
@@ -1031,6 +1040,8 @@ type SingleBatchResponse = {
     yrn?: Yrn;
 };
 /**
+ * updateCartItemsBatchEntryResponse
+ *
  * Result for a single cart item in a batch update, aligned with bulk operation entry responses.
  */
 type UpdateCartItemsBatchEntryResponse = {
@@ -1277,6 +1288,8 @@ type CartItemsBatchUpdateRequest = Array<CartItemRequest & {
 }>;
 type BatchResponse = Array<SingleBatchResponse>;
 /**
+ * YRN
+ *
  * A unique identifier of a global resource, which stores information about the resource, such as its type, ID or name of the tenant.
  */
 type Yrn = string;
@@ -1813,6 +1826,9 @@ type ItemCalculatedPrice = {
         taxCode?: string;
     };
 };
+/**
+ * calculatedAppliedDiscount
+ */
 type CalculatedAppliedDiscount = {
     /**
      * The ID of the applied discount.
@@ -1835,6 +1851,8 @@ type CalculatedAppliedDiscount = {
     origin?: 'INTERNAL' | 'EXTERNAL';
 };
 /**
+ * calculatedTotalDiscount
+ *
  * The total combined value of all applied discounts.
  */
 type CalculatedTotalDiscount = {

package/dist/category.d.cts

@@ -131,11 +131,13 @@ type Category$1 = {
     };
     /**
      * Category name in tenant default language.
+     *
      * @deprecated
      */
     name?: string;
     /**
      * Description in tenant default language.
+     *
      * @deprecated
      */
     description?: string;
@@ -344,11 +346,13 @@ type CategoryTree = {
     id: string;
     /**
      * Category name in tenant default language.
+     *
      * @deprecated
      */
     name: string;
     /**
      * Description in tenant default language.
+     *
      * @deprecated
      */
     description?: string;

package/dist/category.d.ts

@@ -131,11 +131,13 @@ type Category$1 = {
     };
     /**
      * Category name in tenant default language.
+     *
      * @deprecated
      */
     name?: string;
     /**
      * Description in tenant default language.
+     *
      * @deprecated
      */
     description?: string;
@@ -344,11 +346,13 @@ type CategoryTree = {
     id: string;
     /**
      * Category name in tenant default language.
+     *
      * @deprecated
      */
     name: string;
     /**
      * Description in tenant default language.
+     *
      * @deprecated
      */
     description?: string;

package/dist/{chunk-LQFRJSVT.js → chunk-5XZ6MSXW.js}

@@ -51,6 +51,17 @@ var IamService = class {
       path: `${this.base()}/users/${userId}/groups`,
       auth
     }),
+    /**
+     * Reads one of a user's groups (`GET /users/{userId}/groups/{groupId}`).
+     * The collection read above returns the same shape per entry; this exists
+     * because Emporix exposes the item separately and a caller holding both ids
+     * should not have to page the collection to resolve one group.
+     */
+    getGroup: async (userId, groupId, auth) => this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/users/${encodeURIComponent(userId)}/groups/${encodeURIComponent(groupId)}`,
+      auth
+    }),
     getScopes: async (userId, auth) => this.ctx.http.request({
       method: "GET",
       path: `${this.base()}/users/${userId}/scopes`,
@@ -220,5 +231,5 @@ var CustomerGroupsService = class {
 };
 
 export { CustomerGroupsService, IamService };
-//# sourceMappingURL=chunk-LQFRJSVT.js.map
-//# sourceMappingURL=chunk-LQFRJSVT.js.map
+//# sourceMappingURL=chunk-5XZ6MSXW.js.map
+//# sourceMappingURL=chunk-5XZ6MSXW.js.map

package/dist/chunk-5XZ6MSXW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/iam.ts","../src/services/customer-groups.ts"],"names":[],"mappings":";AA+BO,IAAM,aAAN,MAAiB;AAAA,EAEtB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,EAChC;AAAA,EAES,KAAA,GAAQ;AAAA,IACf,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAsB,SACnC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAwB;AAAA,MACpC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,MAAA,EAAgB,SAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,OAAO,OAAO,IAAA,KACZ,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,SAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,MAAA,EAAgB,KAAA,EAAsB,IAAA,KAAqC;AACxF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,MAAA,EAAgB,IAAA,KAAqC;AAClE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOH,QAAA,EAAU,OAAO,MAAA,EAAgB,OAAA,EAAiB,SAChD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,EAAU,kBAAA,CAAmB,MAAM,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC9F;AAAA,KACD,CAAA;AAAA,IACH,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,aAAa,OAAO,IAAA,KAClB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,mBAAmB,OAAO,MAAA,EAAgB,SACxC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,gBAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,qBAAqB,OAAO,IAAA,KAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,yBAAA,CAAA;AAAA,MACpB;AAAA,KACD;AAAA,GACL;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAuB,SACpC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,OAAA,EAAiB,KAAA,EAAuB,IAAA,KAAqC;AAC1F,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACnE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,OAAA,EAAiB,SACjC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,OACP,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,UAAA,EAAY,OACV,OAAA,EACA,QAAA,EACA,MAAA,EACA,OACA,IAAA,KAEA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAAA,MAClE,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,cAAA,EAAgB,OAAO,OAAA,EAAiB,IAAA,KAAqC;AAC3E,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,oBAAoB,OAAO,OAAA,EAAiB,SAC1C,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,gBAAA,CAAA;AAAA,MACtC;AAAA,KACD;AAAA,GACL;AAAA,EAES,cAAA,GAAiB;AAAA,IACxB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA0B;AAAA,MACtC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OACN,EAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiC;AAAA,MAC7C,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,IAAA,KAAqC;AAC9D,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,QAC1C;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,YAAA,EAAc,OACZ,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,YAAA,EAAc,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACzE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AACF;;;ACjQO,IAAM,wBAAN,MAA4B;AAAA,EAGjC,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAC3B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,UAAA,CAAW,GAAG,CAAA;AAAA,EAC/B;AAAA,EAF6B,GAAA;AAAA,EAF7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EACT,GAAA;AAAA;AAAA,EAMjB,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAmD;AAC7F,IAAA,OAAO,IAAA,CAAK,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,mBAAA,EAAqB,eAAe,CAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,OAAA,EACA,MAAA,EACA,IAAA,EACyB;AAIzB,IAAA,OAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,OAAO,OAAA,CAAQ,OAAA,EAAS,QAAQ,IAAI,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAA,CAAa,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAkC;AACpF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,QAAA,EAAW,OAAO,UAAU,MAAM,CAAA,CAAA;AAAA,MAC/D;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-5XZ6MSXW.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  IamUser,\n  IamUserDetail,\n  IamUserCreate,\n  IamUserUpdate,\n  IamUserScopes,\n  IamUserCreated,\n  IamGroup,\n  IamGroupCreate,\n  IamGroupUpdate,\n  IamGroupCreated,\n  IamGroupMemberInput,\n  IamGroupMemberCreated,\n  IamAccessControl,\n  IamAccessControlUpsert,\n  IamAccessControlCreated,\n  IamScope,\n  IamScopeUpsert,\n  IamScopeCreated,\n} from \"./iam-types\";\n\nexport type * from \"./iam-types\";\n\n/**\n * IAM admin CRUD: users, user-groups, access-controls, scopes. Every method\n * requires an explicit `auth` (admin/service token; `getMe*` take the caller's\n * customer token). The deprecated legacy-RBAC model (roles/permissions/\n * resources/templates) is intentionally not wrapped.\n */\nexport class IamService {\n  static readonly channel = \"iam\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/iam/${this.ctx.tenant}`;\n  }\n\n  readonly users = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/users`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamUserCreate, auth: AuthContext): Promise<IamUserCreated> =>\n      this.ctx.http.request<IamUserCreated>({\n        method: \"POST\",\n        path: `${this.base()}/users`,\n        auth,\n        body: input,\n      }),\n    get: async (userId: string, auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      }),\n    getMe: async (auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/me`,\n        auth,\n      }),\n    update: async (userId: string, input: IamUserUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (userId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      });\n    },\n    getGroups: async (userId: string, auth: AuthContext): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/groups`,\n        auth,\n      }),\n    /**\n     * Reads one of a user's groups (`GET /users/{userId}/groups/{groupId}`).\n     * The collection read above returns the same shape per entry; this exists\n     * because Emporix exposes the item separately and a caller holding both ids\n     * should not have to page the collection to resolve one group.\n     */\n    getGroup: async (userId: string, groupId: string, auth: AuthContext): Promise<IamGroup> =>\n      this.ctx.http.request<IamGroup>({\n        method: \"GET\",\n        path: `${this.base()}/users/${encodeURIComponent(userId)}/groups/${encodeURIComponent(groupId)}`,\n        auth,\n      }),\n    getScopes: async (userId: string, auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/scopes`,\n        auth,\n      }),\n    getMyScopes: async (auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/scopes`,\n        auth,\n      }),\n    getAccessControls: async (userId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/access-controls`,\n        auth,\n      }),\n    getMyAccessControls: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly groups = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamGroupCreate, auth: AuthContext): Promise<IamGroupCreated> =>\n      this.ctx.http.request<IamGroupCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups`,\n        auth,\n        body: input,\n      }),\n    get: async (groupId: string, auth: AuthContext): Promise<IamGroup> =>\n      this.ctx.http.request<IamGroup>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      }),\n    update: async (groupId: string, input: IamGroupUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      });\n    },\n    listUsers: async (groupId: string, auth: AuthContext): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      }),\n    addUser: async (\n      groupId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n        body: input,\n      }),\n    updateUser: async (\n      groupId: string,\n      userType: string,\n      userId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}/users/${userType}/${userId}`,\n        auth,\n        body: input,\n      }),\n    removeAllUsers: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      });\n    },\n    listAccessControls: async (groupId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly accessControls = {\n    list: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls`,\n        auth,\n      }),\n    get: async (id: string, auth: AuthContext): Promise<IamAccessControl> =>\n      this.ctx.http.request<IamAccessControl>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      }),\n    upsert: async (\n      id: string,\n      input: IamAccessControlUpsert,\n      auth: AuthContext,\n    ): Promise<IamAccessControlCreated> =>\n      this.ctx.http.request<IamAccessControlCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n        body: input,\n      }),\n    delete: async (id: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      });\n    },\n  };\n\n  readonly scopes = {\n    list: async (auth: AuthContext): Promise<IamScope[]> =>\n      this.ctx.http.request<IamScope[]>({\n        method: \"GET\",\n        path: `${this.base()}/scopes`,\n        auth,\n      }),\n    get: async (scopeId: string, auth: AuthContext): Promise<IamScope> =>\n      this.ctx.http.request<IamScope>({\n        method: \"GET\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      }),\n    upsertCustom: async (\n      scopeId: string,\n      input: IamScopeUpsert,\n      auth: AuthContext,\n    ): Promise<IamScopeCreated> =>\n      this.ctx.http.request<IamScopeCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n        body: input,\n      }),\n    deleteCustom: async (scopeId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      });\n    },\n  };\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type { GroupsQueryDocument, AssignmentCreateRequest } from \"../generated/iam\";\nimport { IamService } from \"./iam\";\n\n/**\n * Access to IAM customer groups for a legal entity. Thin B2B-friendly wrapper\n * over {@link IamService.groups}; kept for backward compatibility.\n *\n * `listForCompany` requires `iam.group_read`; the member mutations\n * (`addMember`/`removeMember`) require `iam.group_manage` — typically only\n * granted to Admin-group customers; a 403 surfaces as\n * `EmporixInsufficientScopeError`.\n */\nexport class CustomerGroupsService {\n  static readonly channel = \"iam\" as const;\n  private readonly iam: IamService;\n  constructor(private readonly ctx: ClientContext) {\n    this.iam = new IamService(ctx);\n  }\n\n  /** Lists customer groups belonging to one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<GroupsQueryDocument[]> {\n    return this.iam.groups.list(auth, { \"b2b.legalEntityId\": legalEntityId });\n  }\n\n  /** Adds a user (customer or employee) to a group. */\n  async addMember(\n    groupId: string,\n    member: AssignmentCreateRequest,\n    auth: AuthContext,\n  ): Promise<{ id: string }> {\n    // `addUser` returns `AssignmentIdResponse` (id optional); the original public\n    // contract is `{ id: string }` (the old `request<{id:string}>` asserted the\n    // same). Cast to preserve that contract — the wire body is identical.\n    return (await this.iam.groups.addUser(groupId, member, auth)) as { id: string };\n  }\n\n  /**\n   * Removes a user from a group. Uses `DELETE …/groups/{groupId}/users/{userId}`\n   * directly — this endpoint is deprecated upstream and intentionally not\n   * exposed on {@link IamService}, so it is not delegated. No non-deprecated\n   * single-user removal exists.\n   */\n  async removeMember(groupId: string, userId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `/iam/${this.ctx.tenant}/groups/${groupId}/users/${userId}`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/{chunk-PRN3T6TY.js → chunk-UA4BM6OP.js}

@@ -141,6 +141,24 @@ var CustomerService = class {
       auth: requireCustomer(auth)
     });
   }
+  /**
+   * Validates a customer token and returns what the tenant knows about it —
+   * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`
+   * (`GET /validateauthtoken`). Requires customer/raw auth.
+   *
+   * An invalid or expired token answers `401`, which surfaces as
+   * {@link EmporixAuthError} rather than a falsy result: this is a check, not a
+   * predicate. Reach for it when you hold a token from elsewhere — an SSO
+   * exchange, a Managed Dashboard host — and need its scopes before deciding
+   * what to render, instead of discovering them from a failed call.
+   */
+  async validateToken(auth) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/validateauthtoken`,
+      auth: requireCustomer(auth)
+    });
+  }
   /** Updates the authenticated customer. Requires customer/raw auth. */
   async update(patch, auth) {
     return this.ctx.http.request({
@@ -265,5 +283,5 @@ var CustomerService = class {
 };
 
 export { CustomerService };
-//# sourceMappingURL=chunk-PRN3T6TY.js.map
-//# sourceMappingURL=chunk-PRN3T6TY.js.map
+//# sourceMappingURL=chunk-UA4BM6OP.js.map
+//# sourceMappingURL=chunk-UA4BM6OP.js.map

package/dist/chunk-UA4BM6OP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/customer.ts"],"names":[],"mappings":";;;;AAoFA,SAAS,SAAA,CACP,QAAA,EACA,IAAA,EACA,IAAA,GAAoC,EAAC,EACpB;AACjB,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,WAAA;AAChD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,gBAAA,CAAiB,CAAA,EAAG,QAAQ,CAAA,+BAAA,CAAA,EAAmC,QAAW,IAAI,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO;AAAA,IACL,aAAA;AAAA,IACA,WAAW,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,SAAA,IAAa,KAAK,cAAA,IAAkB,EAAA;AAAA,IACvE,YAAA,EAAc,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA,IAAgB,EAAA;AAAA,IACzD,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,WAAW,IAAA,CAAK,UAAA,IAAc,OAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AAAA,IAC/D,GAAI,KAAK,mBAAA,GAAsB,EAAE,mBAAmB,IAAA,CAAK,mBAAA,KAAwB,EAAC;AAAA,IAClF,GAAI,KAAK,eAAA,GAAkB,EAAE,eAAe,IAAA,CAAK,eAAA,KAAoB;AAAC,GACxE;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAE3B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,UAAA;AAAA;AAAA,EAI1B,MAAM,SAAA,GAAuC;AAC3C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,iBAAA,EAAkB;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACrB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CACJ,KAAA,EACA,IAAA,GAAoC,IACpC,IAAA,GAAoB,EAAE,IAAA,EAAM,WAAA,EAAY,EACd;AAC1B,IAAA,MAAM,SAAA,GAAyB,KAAK,cAAA,GAChC,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAe,GAC1C,IAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAClC,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,YAAA,EAAc,KAAA,CAAM,YAAA,EAAa;AACzE,IAAA,IAAI,KAAA,CAAM,aAAA,EAAe,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,aAAA;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,SAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA,CAAM,cAAc,MAAA,GAAY,EAAE,gBAAgB,KAAA,CAAM,SAAA,KAAc;AAAC,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,IAAA,EAAmC;AAC9C,IAAA,MAAM,GAAA,GAAM,gBAAgB,IAAI,CAAA;AAChC,IAAA,MAAM,QAAS,GAAA,CAA0B,KAAA;AACzC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,MAC5B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC;AAAA,MACpC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,YAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,KAAA,CAAM,SAAA,GAAY,EAAE,OAAA,EAAS,EAAE,YAAA,EAAc,KAAA,CAAM,SAAA,EAAU,EAAE,GAAI;AAAC,KACzE,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,eAAe,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,kBAAA,EAAoB,KAAA,CAAM,YAAA,EAAa;AAC/E,IAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAA;AACvC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,GAAG,IAAA,EAAuC;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,cAAc,IAAA,EAAsD;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAiC;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA4B,IAAA,EAAuC;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,KAAA,EAA4B,IAAA,EAAmC;AAClF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,aAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5E;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,gBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,KAAA,EAAyB,IAAA,EAAmC;AAC5E,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kCAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,0CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGS,SAAA,GAAY;AAAA,IACnB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAA6B,SACvC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,KAAA,EAA2B,SACpD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,QAAQ,OAAO,EAAA,EAAY,SACzB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAc;AAAA,MAC1B,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AAChF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,MAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,CAAA;AAAA,IACA,UAAA,EAAY,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AACnF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH;AAAA,GACF;AACF","file":"chunk-UA4BM6OP.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext, AnonymousSession } from \"../core/auth\";\nimport { EmporixAuthError } from \"../core/errors\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  Customer as GeneratedCustomer,\n  Address as GeneratedAddress,\n  CustomerSignup,\n  CustomerUpdateDto,\n  PasswordChangeDto,\n  PasswordResetRequestDto,\n  PasswordUpdate,\n  AddressCreateDto,\n  AddressUpdateDto,\n  ChangeEmailRequestDto,\n  UpdateEmail,\n  RefreshToken,\n  ValidateTokenResponse,\n} from \"../generated/customer\";\n\n/**\n * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to\n * idiomatic names: `access_token` → `customerToken`, `saas_token` →\n * `saasToken`. `saasToken` is a JWT required for the checkout (`saas-token`\n * header). The wire's `*_token` (snake_case) fields are canonical; the\n * camelCase variants are deprecated in the Emporix spec.\n */\nexport interface CustomerSession {\n  customerToken: string;\n  /** JWT required for completing checkout (sent as the `saas-token` header). */\n  saasToken: string;\n  refreshToken: string;\n  /** Same session as the anonymous token — preserves the cart across login. */\n  sessionId: string | undefined;\n  /** Customer access-token lifetime in seconds. */\n  expiresIn: number | undefined;\n  /** Only set by `socialLogin`: the IdP access token echoed by Emporix. */\n  socialAccessToken?: string;\n  /** Only set by `socialLogin`: the IdP ID token echoed by Emporix. */\n  socialIdToken?: string;\n}\n\n/** Customer profile as returned by the Customer service (all generated fields). */\nexport type Customer = GeneratedCustomer;\n\n/** A customer address as returned by the Customer service (all generated fields). */\nexport type Address = GeneratedAddress;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CustomerSignupInput = CustomerSignup;\nexport type CustomerUpdateInput = CustomerUpdateDto;\nexport type PasswordChangeInput = PasswordChangeDto;\nexport type PasswordResetRequestInput = PasswordResetRequestDto;\nexport type PasswordResetConfirmInput = PasswordUpdate;\nexport type AddressCreateInput = AddressCreateDto;\nexport type AddressUpdateInput = AddressUpdateDto;\nexport type ChangeEmailInput = ChangeEmailRequestDto;\nexport type ConfirmEmailChangeInput = UpdateEmail;\nexport type ResendActivationInput = RefreshToken;\n/**\n * What `validateToken` reports about a customer token: `scope` is the\n * space-separated scope list, plus `sessionId`, `email`, `legalEntityId` and\n * `expires_in`. Every field is optional upstream.\n */\nexport type CustomerTokenValidation = ValidateTokenResponse;\n\n/** Union of the wire shapes the four session endpoints return. snake_case is\n * canonical; camelCase is the deprecated fallback (vendored spec, design §2). */\ninterface WireSession {\n  access_token?: string;\n  saas_token?: string;\n  refresh_token?: string;\n  session_id?: string;\n  expires_in?: string | number;\n  accessToken?: string;\n  saasToken?: string;\n  refreshToken?: string;\n  social_access_token?: string;\n  social_id_token?: string;\n}\n\n/** Wire→facade mapping shared by login/refresh/socialLogin/exchangeToken.\n * Throws instead of fabricating an empty session: `customerToken: \"\"` would\n * read as authenticated downstream and 401-loop every subsequent call. */\nfunction toSession(\n  endpoint: string,\n  wire: WireSession,\n  opts: { carrySaasToken?: string } = {},\n): CustomerSession {\n  const customerToken = wire.access_token ?? wire.accessToken;\n  if (!customerToken) {\n    throw new EmporixAuthError(`${endpoint}: response missing access_token`, undefined, wire);\n  }\n  return {\n    customerToken,\n    saasToken: wire.saas_token ?? wire.saasToken ?? opts.carrySaasToken ?? \"\",\n    refreshToken: wire.refresh_token ?? wire.refreshToken ?? \"\",\n    sessionId: wire.session_id,\n    expiresIn: wire.expires_in != null ? Number(wire.expires_in) : undefined,\n    ...(wire.social_access_token ? { socialAccessToken: wire.social_access_token } : {}),\n    ...(wire.social_id_token ? { socialIdToken: wire.social_id_token } : {}),\n  };\n}\n\n/** Customer signup, session, profile and addresses. */\nexport class CustomerService {\n  static readonly channel = \"customer\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  /** Obtains an anonymous storefront session (accessToken + sessionId + refreshToken). */\n  async anonymous(): Promise<AnonymousSession> {\n    return this.ctx.tokenProvider.getAnonymousToken();\n  }\n\n  /** Registers a customer. Default auth: anonymous. */\n  async signup(\n    input: CustomerSignupInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Logs a customer in. Threads the anonymous token so the session (and its\n   * cart) survives — losing it silently creates a new session per Emporix docs.\n   * Wire `accessToken` is mapped to `customerToken`.\n   */\n  async login(\n    creds: { email: string; password: string },\n    opts: { anonymousToken?: string } = {},\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const effective: AuthContext = opts.anonymousToken\n      ? { kind: \"raw\", token: opts.anonymousToken }\n      : auth;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/login`,\n      auth: effective,\n      body: creds,\n    });\n    return toSession(\"login\", wire);\n  }\n\n  /**\n   * Refreshes an authenticated customer session via its refresh token,\n   * preserving the same `sessionId`. Calls\n   * `GET /customer/{tenant}/refreshauthtoken?refreshToken=…`, which **must be\n   * authorized with an anonymous token** (default auth: anonymous) — not the\n   * expired customer token. The refresh response does **not** include a\n   * `saas_token`; pass the original `saasToken` to carry it forward (it has\n   * its own, independent lifetime).\n   */\n  async refresh(\n    input: { refreshToken: string; saasToken?: string; legalEntityId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { refreshToken: input.refreshToken };\n    if (input.legalEntityId) query.legalEntityId = input.legalEntityId;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/refreshauthtoken`,\n      query,\n      auth,\n    });\n    // Refresh does not return a saas_token — carry the original forward.\n    return toSession(\n      \"refresh\",\n      wire,\n      input.saasToken !== undefined ? { carrySaasToken: input.saasToken } : {},\n    );\n  }\n\n  /**\n   * Logs the customer out server-side: `GET /customer/{tenant}/logout?\n   * accessToken=…` authorized with the customer token. Invalidates the\n   * access token (204 No Content). Requires customer/raw auth — the token is\n   * sent both as the bearer and the `accessToken` query param (per Emporix).\n   */\n  async logout(auth?: AuthContext): Promise<void> {\n    const ctx = requireCustomer(auth);\n    const token = (ctx as { token: string }).token;\n    await this.ctx.http.request<void>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/logout`,\n      query: { accessToken: token },\n      auth: ctx,\n    });\n  }\n\n  /**\n   * Authorization-Code SSO: exchanges the IdP `code` for an Emporix customer\n   * session via `POST /customer/{tenant}/socialLogin`. The browser performs\n   * the IdP redirect itself; the SDK only does this Emporix exchange.\n   * Default auth: anonymous (Emporix requires an anonymous Bearer). The\n   * response has no `session_id` and returns `expires_in` as a string —\n   * normalized to a number here.\n   */\n  async socialLogin(\n    input: { code: string; redirectUri: string; codeVerifier?: string; sessionId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = {\n      code: input.code,\n      redirect_uri: input.redirectUri,\n    };\n    if (input.codeVerifier) query.code_verifier = input.codeVerifier;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/socialLogin`,\n      query,\n      auth,\n      ...(input.sessionId ? { headers: { \"session-id\": input.sessionId } } : {}),\n    });\n    return toSession(\"socialLogin\", wire);\n  }\n\n  /**\n   * RFC 8693 token exchange: exchanges an external IdP JWT for an Emporix\n   * customer session via `POST /customer/{tenant}/exchangeauthtoken`.\n   * Emporix uses a proprietary query-param wire (not the RFC form body).\n   * Default auth: anonymous. `config` selects a site-specific IdP config\n   * (multi-site); omit for the tenant default. Returns `session_id` and a\n   * fresh `saas_token`; `expires_in` is an integer (normalized anyway).\n   */\n  async exchangeToken(\n    input: { subjectToken: string; config?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { subjectAccessToken: input.subjectToken };\n    if (input.config) query.config = input.config;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/exchangeauthtoken`,\n      query,\n      auth,\n    });\n    return toSession(\"exchangeToken\", wire);\n  }\n\n  /** Returns the authenticated customer. Requires customer/raw auth. */\n  async me(auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /**\n   * Validates a customer token and returns what the tenant knows about it —\n   * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`\n   * (`GET /validateauthtoken`). Requires customer/raw auth.\n   *\n   * An invalid or expired token answers `401`, which surfaces as\n   * {@link EmporixAuthError} rather than a falsy result: this is a check, not a\n   * predicate. Reach for it when you hold a token from elsewhere — an SSO\n   * exchange, a Managed Dashboard host — and need its scopes before deciding\n   * what to render, instead of discovering them from a failed call.\n   */\n  async validateToken(auth?: AuthContext): Promise<CustomerTokenValidation> {\n    return this.ctx.http.request<CustomerTokenValidation>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/validateauthtoken`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /** Updates the authenticated customer. Requires customer/raw auth. */\n  async update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"PUT\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n      body: patch,\n    });\n  }\n\n  /** Changes the password. Requires customer/raw auth. */\n  async changePassword(input: PasswordChangeInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Requests a password reset email. Default auth: anonymous. */\n  async requestPasswordReset(\n    input: PasswordResetRequestInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Confirms a password reset. Default auth: anonymous. */\n  async confirmPasswordReset(\n    input: PasswordResetConfirmInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset/update`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Completes double opt-in signup with the emailed token, creating the account\n   * and returning a logged-in {@link CustomerSession}. Default auth: anonymous.\n   */\n  async confirmSignup(\n    token: string,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/${encodeURIComponent(token)}`,\n      auth,\n    });\n    return toSession(\"confirmSignup\", wire);\n  }\n\n  /** Resends the double opt-in activation link. Default auth: anonymous. */\n  async resendActivation(\n    input: ResendActivationInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/refresh_token`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Requests a login-email change (emails a confirmation token). Requires customer/raw auth. */\n  async changeEmail(input: ChangeEmailInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Confirms a login-email change with the emailed token. Default auth: anonymous. */\n  async confirmEmailChange(\n    input: ConfirmEmailChangeInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change/confirm`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Address sub-resource. All operations require customer/raw auth. */\n  readonly addresses = {\n    list: async (auth?: AuthContext): Promise<Address[]> =>\n      this.ctx.http.request<Address[]>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n      }),\n    add: async (address: AddressCreateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n        body: address,\n      }),\n    update: async (id: string, patch: AddressUpdateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"PUT\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n        body: patch,\n      }),\n    remove: async (id: string, auth?: AuthContext): Promise<void> =>\n      this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    get: async (id: string, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    addTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n    removeTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n  };\n}\n"]}

package/dist/companies.d.cts

@@ -1,6 +1,6 @@
 import { C as ClientContext, b as AuthContext } from './context-DK8jg6y5.cjs';
-import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-C_wOXYZB.cjs';
-export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-C_wOXYZB.cjs';
+import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-fWB4nrso.cjs';
+export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-fWB4nrso.cjs';
 
 /** Body for `companies.search` — an Emporix `q`-syntax filter. */
 type LegalEntitySearchInput = {

package/dist/companies.d.ts

@@ -1,6 +1,6 @@
 import { C as ClientContext, b as AuthContext } from './context-DK8jg6y5.js';
-import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-C_wOXYZB.js';
-export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-C_wOXYZB.js';
+import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-fWB4nrso.js';
+export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-fWB4nrso.js';
 
 /** Body for `companies.search` — an Emporix `q`-syntax filter. */
 type LegalEntitySearchInput = {

package/dist/contacts.d.cts

@@ -1,5 +1,5 @@
 import { C as ClientContext, b as AuthContext } from './context-DK8jg6y5.cjs';
-import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-C_wOXYZB.cjs';
+import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-fWB4nrso.cjs';
 
 /**
  * Manages contact assignments linking customers to legal entities.

package/dist/contacts.d.ts

@@ -1,5 +1,5 @@
 import { C as ClientContext, b as AuthContext } from './context-DK8jg6y5.js';
-import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-C_wOXYZB.js';
+import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-fWB4nrso.js';
 
 /**
  * Manages contact assignments linking customers to legal entities.

package/dist/{customer-groups-D0OCm8kJ.d.cts → customer-groups-BfHDqExS.d.cts}

@@ -27,11 +27,13 @@ type AccessControlQueryDocument = {
     id?: string;
     /**
      * Role unique identifier associated with this access control.
+     *
      * @deprecated
      */
     roleId?: string;
     /**
      * Resource unique identifier associated with this access control.
+     *
      * @deprecated
      */
     resourceId?: string;

package/dist/{customer-groups-WSt4aT62.d.ts → customer-groups-Cs6-Cwzg.d.ts}

@@ -27,11 +27,13 @@ type AccessControlQueryDocument = {
     id?: string;
     /**
      * Role unique identifier associated with this access control.
+     *
      * @deprecated
      */
     roleId?: string;
     /**
      * Resource unique identifier associated with this access control.
+     *
      * @deprecated
      */
     resourceId?: string;

package/dist/customer-groups.cjs

@@ -53,6 +53,17 @@ var IamService = class {
       path: `${this.base()}/users/${userId}/groups`,
       auth
     }),
+    /**
+     * Reads one of a user's groups (`GET /users/{userId}/groups/{groupId}`).
+     * The collection read above returns the same shape per entry; this exists
+     * because Emporix exposes the item separately and a caller holding both ids
+     * should not have to page the collection to resolve one group.
+     */
+    getGroup: async (userId, groupId, auth) => this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/users/${encodeURIComponent(userId)}/groups/${encodeURIComponent(groupId)}`,
+      auth
+    }),
     getScopes: async (userId, auth) => this.ctx.http.request({
       method: "GET",
       path: `${this.base()}/users/${userId}/scopes`,