@viu/emporix-sdk 2.36.0 → 2.37.0

package/dist/customer-groups.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/services/iam.ts","../src/services/customer-groups.ts"],"names":[],"mappings":";;;AA+BO,IAAM,aAAN,MAAiB;AAAA,EAEtB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,EAChC;AAAA,EAES,KAAA,GAAQ;AAAA,IACf,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAsB,SACnC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAwB;AAAA,MACpC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,MAAA,EAAgB,SAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,OAAO,OAAO,IAAA,KACZ,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,SAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,MAAA,EAAgB,KAAA,EAAsB,IAAA,KAAqC;AACxF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,MAAA,EAAgB,IAAA,KAAqC;AAClE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,aAAa,OAAO,IAAA,KAClB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,mBAAmB,OAAO,MAAA,EAAgB,SACxC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,gBAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,qBAAqB,OAAO,IAAA,KAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,yBAAA,CAAA;AAAA,MACpB;AAAA,KACD;AAAA,GACL;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAuB,SACpC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,OAAA,EAAiB,KAAA,EAAuB,IAAA,KAAqC;AAC1F,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACnE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,OAAA,EAAiB,SACjC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,OACP,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,UAAA,EAAY,OACV,OAAA,EACA,QAAA,EACA,MAAA,EACA,OACA,IAAA,KAEA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAAA,MAClE,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,cAAA,EAAgB,OAAO,OAAA,EAAiB,IAAA,KAAqC;AAC3E,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,oBAAoB,OAAO,OAAA,EAAiB,SAC1C,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,gBAAA,CAAA;AAAA,MACtC;AAAA,KACD;AAAA,GACL;AAAA,EAES,cAAA,GAAiB;AAAA,IACxB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA0B;AAAA,MACtC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OACN,EAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiC;AAAA,MAC7C,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,IAAA,KAAqC;AAC9D,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,QAC1C;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,YAAA,EAAc,OACZ,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,YAAA,EAAc,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACzE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AACF,CAAA;;;ACrPO,IAAM,wBAAN,MAA4B;AAAA,EAGjC,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAC3B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,UAAA,CAAW,GAAG,CAAA;AAAA,EAC/B;AAAA,EAF6B,GAAA;AAAA,EAF7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EACT,GAAA;AAAA;AAAA,EAMjB,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAmD;AAC7F,IAAA,OAAO,IAAA,CAAK,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,mBAAA,EAAqB,eAAe,CAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,OAAA,EACA,MAAA,EACA,IAAA,EACyB;AAIzB,IAAA,OAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,OAAO,OAAA,CAAQ,OAAA,EAAS,QAAQ,IAAI,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAA,CAAa,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAkC;AACpF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,QAAA,EAAW,OAAO,UAAU,MAAM,CAAA,CAAA;AAAA,MAC/D;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"customer-groups.cjs","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  IamUser,\n  IamUserDetail,\n  IamUserCreate,\n  IamUserUpdate,\n  IamUserScopes,\n  IamUserCreated,\n  IamGroup,\n  IamGroupCreate,\n  IamGroupUpdate,\n  IamGroupCreated,\n  IamGroupMemberInput,\n  IamGroupMemberCreated,\n  IamAccessControl,\n  IamAccessControlUpsert,\n  IamAccessControlCreated,\n  IamScope,\n  IamScopeUpsert,\n  IamScopeCreated,\n} from \"./iam-types\";\n\nexport type * from \"./iam-types\";\n\n/**\n * IAM admin CRUD: users, user-groups, access-controls, scopes. Every method\n * requires an explicit `auth` (admin/service token; `getMe*` take the caller's\n * customer token). The deprecated legacy-RBAC model (roles/permissions/\n * resources/templates) is intentionally not wrapped.\n */\nexport class IamService {\n  static readonly channel = \"iam\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/iam/${this.ctx.tenant}`;\n  }\n\n  readonly users = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/users`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamUserCreate, auth: AuthContext): Promise<IamUserCreated> =>\n      this.ctx.http.request<IamUserCreated>({\n        method: \"POST\",\n        path: `${this.base()}/users`,\n        auth,\n        body: input,\n      }),\n    get: async (userId: string, auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      }),\n    getMe: async (auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/me`,\n        auth,\n      }),\n    update: async (userId: string, input: IamUserUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (userId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      });\n    },\n    getGroups: async (userId: string, auth: AuthContext): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/groups`,\n        auth,\n      }),\n    getScopes: async (userId: string, auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/scopes`,\n        auth,\n      }),\n    getMyScopes: async (auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/scopes`,\n        auth,\n      }),\n    getAccessControls: async (userId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/access-controls`,\n        auth,\n      }),\n    getMyAccessControls: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly groups = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamGroupCreate, auth: AuthContext): Promise<IamGroupCreated> =>\n      this.ctx.http.request<IamGroupCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups`,\n        auth,\n        body: input,\n      }),\n    get: async (groupId: string, auth: AuthContext): Promise<IamGroup> =>\n      this.ctx.http.request<IamGroup>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      }),\n    update: async (groupId: string, input: IamGroupUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      });\n    },\n    listUsers: async (groupId: string, auth: AuthContext): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      }),\n    addUser: async (\n      groupId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n        body: input,\n      }),\n    updateUser: async (\n      groupId: string,\n      userType: string,\n      userId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}/users/${userType}/${userId}`,\n        auth,\n        body: input,\n      }),\n    removeAllUsers: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      });\n    },\n    listAccessControls: async (groupId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly accessControls = {\n    list: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls`,\n        auth,\n      }),\n    get: async (id: string, auth: AuthContext): Promise<IamAccessControl> =>\n      this.ctx.http.request<IamAccessControl>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      }),\n    upsert: async (\n      id: string,\n      input: IamAccessControlUpsert,\n      auth: AuthContext,\n    ): Promise<IamAccessControlCreated> =>\n      this.ctx.http.request<IamAccessControlCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n        body: input,\n      }),\n    delete: async (id: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      });\n    },\n  };\n\n  readonly scopes = {\n    list: async (auth: AuthContext): Promise<IamScope[]> =>\n      this.ctx.http.request<IamScope[]>({\n        method: \"GET\",\n        path: `${this.base()}/scopes`,\n        auth,\n      }),\n    get: async (scopeId: string, auth: AuthContext): Promise<IamScope> =>\n      this.ctx.http.request<IamScope>({\n        method: \"GET\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      }),\n    upsertCustom: async (\n      scopeId: string,\n      input: IamScopeUpsert,\n      auth: AuthContext,\n    ): Promise<IamScopeCreated> =>\n      this.ctx.http.request<IamScopeCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n        body: input,\n      }),\n    deleteCustom: async (scopeId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      });\n    },\n  };\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type { GroupsQueryDocument, AssignmentCreateRequest } from \"../generated/iam\";\nimport { IamService } from \"./iam\";\n\n/**\n * Access to IAM customer groups for a legal entity. Thin B2B-friendly wrapper\n * over {@link IamService.groups}; kept for backward compatibility.\n *\n * `listForCompany` requires `iam.group_read`; the member mutations\n * (`addMember`/`removeMember`) require `iam.group_manage` — typically only\n * granted to Admin-group customers; a 403 surfaces as\n * `EmporixInsufficientScopeError`.\n */\nexport class CustomerGroupsService {\n  static readonly channel = \"iam\" as const;\n  private readonly iam: IamService;\n  constructor(private readonly ctx: ClientContext) {\n    this.iam = new IamService(ctx);\n  }\n\n  /** Lists customer groups belonging to one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<GroupsQueryDocument[]> {\n    return this.iam.groups.list(auth, { \"b2b.legalEntityId\": legalEntityId });\n  }\n\n  /** Adds a user (customer or employee) to a group. */\n  async addMember(\n    groupId: string,\n    member: AssignmentCreateRequest,\n    auth: AuthContext,\n  ): Promise<{ id: string }> {\n    // `addUser` returns `AssignmentIdResponse` (id optional); the original public\n    // contract is `{ id: string }` (the old `request<{id:string}>` asserted the\n    // same). Cast to preserve that contract — the wire body is identical.\n    return (await this.iam.groups.addUser(groupId, member, auth)) as { id: string };\n  }\n\n  /**\n   * Removes a user from a group. Uses `DELETE …/groups/{groupId}/users/{userId}`\n   * directly — this endpoint is deprecated upstream and intentionally not\n   * exposed on {@link IamService}, so it is not delegated. No non-deprecated\n   * single-user removal exists.\n   */\n  async removeMember(groupId: string, userId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `/iam/${this.ctx.tenant}/groups/${groupId}/users/${userId}`,\n      auth,\n    });\n  }\n}\n"]}
+{"version":3,"sources":["../src/services/iam.ts","../src/services/customer-groups.ts"],"names":[],"mappings":";;;AA+BO,IAAM,aAAN,MAAiB;AAAA,EAEtB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,EAChC;AAAA,EAES,KAAA,GAAQ;AAAA,IACf,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAsB,SACnC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAwB;AAAA,MACpC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,MAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,MAAA,EAAgB,SAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,OAAO,OAAO,IAAA,KACZ,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,SAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,MAAA,EAAgB,KAAA,EAAsB,IAAA,KAAqC;AACxF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,MAAA,EAAgB,IAAA,KAAqC;AAClE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,CAAA;AAAA,QACpC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOH,QAAA,EAAU,OAAO,MAAA,EAAgB,OAAA,EAAiB,SAChD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,EAAU,kBAAA,CAAmB,MAAM,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MAC9F;AAAA,KACD,CAAA;AAAA,IACH,WAAW,OAAO,MAAA,EAAgB,SAChC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,OAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,aAAa,OAAO,IAAA,KAClB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAuB;AAAA,MACnC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,mBAAmB,OAAO,MAAA,EAAgB,SACxC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,UAAU,MAAM,CAAA,gBAAA,CAAA;AAAA,MACpC;AAAA,KACD,CAAA;AAAA,IACH,qBAAqB,OAAO,IAAA,KAC1B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,yBAAA,CAAA;AAAA,MACpB;AAAA,KACD;AAAA,GACL;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,EAAmB,UAC9B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,KAC1B,CAAA;AAAA,IACH,QAAQ,OAAO,KAAA,EAAuB,SACpC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,OAAA,EAAiB,KAAA,EAAuB,IAAA,KAAqC;AAC1F,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACnE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,WAAW,OAAO,OAAA,EAAiB,SACjC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,OAAA,EAAS,OACP,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,UAAA,EAAY,OACV,OAAA,EACA,QAAA,EACA,MAAA,EACA,OACA,IAAA,KAEA,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA+B;AAAA,MAC3C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,OAAA,EAAU,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAAA,MAClE,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,cAAA,EAAgB,OAAO,OAAA,EAAiB,IAAA,KAAqC;AAC3E,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,MAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,oBAAoB,OAAO,OAAA,EAAiB,SAC1C,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,gBAAA,CAAA;AAAA,MACtC;AAAA,KACD;AAAA,GACL;AAAA,EAES,cAAA,GAAiB;AAAA,IACxB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA4B;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,gBAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAA0B;AAAA,MACtC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C;AAAA,KACD,CAAA;AAAA,IACH,MAAA,EAAQ,OACN,EAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiC;AAAA,MAC7C,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,MAC1C,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,IAAA,KAAqC;AAC9D,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,oBAAoB,EAAE,CAAA,CAAA;AAAA,QAC1C;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AAAA,EAES,MAAA,GAAS;AAAA,IAChB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAoB;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB;AAAA,KACD,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAAiB,SAC3B,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAkB;AAAA,MAC9B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC;AAAA,KACD,CAAA;AAAA,IACH,YAAA,EAAc,OACZ,OAAA,EACA,KAAA,EACA,SAEA,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAyB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,YAAA,EAAc,OAAO,OAAA,EAAiB,IAAA,KAAqC;AACzE,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,WAAW,OAAO,CAAA,CAAA;AAAA,QACtC;AAAA,OACD,CAAA;AAAA,IACH;AAAA,GACF;AACF,CAAA;;;ACjQO,IAAM,wBAAN,MAA4B;AAAA,EAGjC,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAC3B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,UAAA,CAAW,GAAG,CAAA;AAAA,EAC/B;AAAA,EAF6B,GAAA;AAAA,EAF7B,OAAgB,OAAA,GAAU,KAAA;AAAA,EACT,GAAA;AAAA;AAAA,EAMjB,MAAM,cAAA,CAAe,aAAA,EAAuB,IAAA,EAAmD;AAC7F,IAAA,OAAO,IAAA,CAAK,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,mBAAA,EAAqB,eAAe,CAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,SAAA,CACJ,OAAA,EACA,MAAA,EACA,IAAA,EACyB;AAIzB,IAAA,OAAQ,MAAM,IAAA,CAAK,GAAA,CAAI,OAAO,OAAA,CAAQ,OAAA,EAAS,QAAQ,IAAI,CAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAA,CAAa,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAkC;AACpF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,IAAA,EAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,QAAA,EAAW,OAAO,UAAU,MAAM,CAAA,CAAA;AAAA,MAC/D;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"customer-groups.cjs","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type {\n  IamUser,\n  IamUserDetail,\n  IamUserCreate,\n  IamUserUpdate,\n  IamUserScopes,\n  IamUserCreated,\n  IamGroup,\n  IamGroupCreate,\n  IamGroupUpdate,\n  IamGroupCreated,\n  IamGroupMemberInput,\n  IamGroupMemberCreated,\n  IamAccessControl,\n  IamAccessControlUpsert,\n  IamAccessControlCreated,\n  IamScope,\n  IamScopeUpsert,\n  IamScopeCreated,\n} from \"./iam-types\";\n\nexport type * from \"./iam-types\";\n\n/**\n * IAM admin CRUD: users, user-groups, access-controls, scopes. Every method\n * requires an explicit `auth` (admin/service token; `getMe*` take the caller's\n * customer token). The deprecated legacy-RBAC model (roles/permissions/\n * resources/templates) is intentionally not wrapped.\n */\nexport class IamService {\n  static readonly channel = \"iam\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/iam/${this.ctx.tenant}`;\n  }\n\n  readonly users = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/users`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamUserCreate, auth: AuthContext): Promise<IamUserCreated> =>\n      this.ctx.http.request<IamUserCreated>({\n        method: \"POST\",\n        path: `${this.base()}/users`,\n        auth,\n        body: input,\n      }),\n    get: async (userId: string, auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      }),\n    getMe: async (auth: AuthContext): Promise<IamUserDetail> =>\n      this.ctx.http.request<IamUserDetail>({\n        method: \"GET\",\n        path: `${this.base()}/users/me`,\n        auth,\n      }),\n    update: async (userId: string, input: IamUserUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (userId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/users/${userId}`,\n        auth,\n      });\n    },\n    getGroups: async (userId: string, auth: AuthContext): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/groups`,\n        auth,\n      }),\n    /**\n     * Reads one of a user's groups (`GET /users/{userId}/groups/{groupId}`).\n     * The collection read above returns the same shape per entry; this exists\n     * because Emporix exposes the item separately and a caller holding both ids\n     * should not have to page the collection to resolve one group.\n     */\n    getGroup: async (userId: string, groupId: string, auth: AuthContext): Promise<IamGroup> =>\n      this.ctx.http.request<IamGroup>({\n        method: \"GET\",\n        path: `${this.base()}/users/${encodeURIComponent(userId)}/groups/${encodeURIComponent(groupId)}`,\n        auth,\n      }),\n    getScopes: async (userId: string, auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/scopes`,\n        auth,\n      }),\n    getMyScopes: async (auth: AuthContext): Promise<IamUserScopes> =>\n      this.ctx.http.request<IamUserScopes>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/scopes`,\n        auth,\n      }),\n    getAccessControls: async (userId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/${userId}/access-controls`,\n        auth,\n      }),\n    getMyAccessControls: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/users/me/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly groups = {\n    list: async (auth: AuthContext, query?: Record<string, string | number>): Promise<IamGroup[]> =>\n      this.ctx.http.request<IamGroup[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups`,\n        auth,\n        ...(query ? { query } : {}),\n      }),\n    create: async (input: IamGroupCreate, auth: AuthContext): Promise<IamGroupCreated> =>\n      this.ctx.http.request<IamGroupCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups`,\n        auth,\n        body: input,\n      }),\n    get: async (groupId: string, auth: AuthContext): Promise<IamGroup> =>\n      this.ctx.http.request<IamGroup>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      }),\n    update: async (groupId: string, input: IamGroupUpdate, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n        body: input,\n      });\n    },\n    delete: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}`,\n        auth,\n      });\n    },\n    listUsers: async (groupId: string, auth: AuthContext): Promise<IamUser[]> =>\n      this.ctx.http.request<IamUser[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      }),\n    addUser: async (\n      groupId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"POST\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n        body: input,\n      }),\n    updateUser: async (\n      groupId: string,\n      userType: string,\n      userId: string,\n      input: IamGroupMemberInput,\n      auth: AuthContext,\n    ): Promise<IamGroupMemberCreated> =>\n      this.ctx.http.request<IamGroupMemberCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/groups/${groupId}/users/${userType}/${userId}`,\n        auth,\n        body: input,\n      }),\n    removeAllUsers: async (groupId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/groups/${groupId}/users`,\n        auth,\n      });\n    },\n    listAccessControls: async (groupId: string, auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/groups/${groupId}/access-controls`,\n        auth,\n      }),\n  };\n\n  readonly accessControls = {\n    list: async (auth: AuthContext): Promise<IamAccessControl[]> =>\n      this.ctx.http.request<IamAccessControl[]>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls`,\n        auth,\n      }),\n    get: async (id: string, auth: AuthContext): Promise<IamAccessControl> =>\n      this.ctx.http.request<IamAccessControl>({\n        method: \"GET\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      }),\n    upsert: async (\n      id: string,\n      input: IamAccessControlUpsert,\n      auth: AuthContext,\n    ): Promise<IamAccessControlCreated> =>\n      this.ctx.http.request<IamAccessControlCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n        body: input,\n      }),\n    delete: async (id: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/access-controls/${id}`,\n        auth,\n      });\n    },\n  };\n\n  readonly scopes = {\n    list: async (auth: AuthContext): Promise<IamScope[]> =>\n      this.ctx.http.request<IamScope[]>({\n        method: \"GET\",\n        path: `${this.base()}/scopes`,\n        auth,\n      }),\n    get: async (scopeId: string, auth: AuthContext): Promise<IamScope> =>\n      this.ctx.http.request<IamScope>({\n        method: \"GET\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      }),\n    upsertCustom: async (\n      scopeId: string,\n      input: IamScopeUpsert,\n      auth: AuthContext,\n    ): Promise<IamScopeCreated> =>\n      this.ctx.http.request<IamScopeCreated>({\n        method: \"PUT\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n        body: input,\n      }),\n    deleteCustom: async (scopeId: string, auth: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `${this.base()}/scopes/${scopeId}`,\n        auth,\n      });\n    },\n  };\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport type { GroupsQueryDocument, AssignmentCreateRequest } from \"../generated/iam\";\nimport { IamService } from \"./iam\";\n\n/**\n * Access to IAM customer groups for a legal entity. Thin B2B-friendly wrapper\n * over {@link IamService.groups}; kept for backward compatibility.\n *\n * `listForCompany` requires `iam.group_read`; the member mutations\n * (`addMember`/`removeMember`) require `iam.group_manage` — typically only\n * granted to Admin-group customers; a 403 surfaces as\n * `EmporixInsufficientScopeError`.\n */\nexport class CustomerGroupsService {\n  static readonly channel = \"iam\" as const;\n  private readonly iam: IamService;\n  constructor(private readonly ctx: ClientContext) {\n    this.iam = new IamService(ctx);\n  }\n\n  /** Lists customer groups belonging to one legal entity. */\n  async listForCompany(legalEntityId: string, auth: AuthContext): Promise<GroupsQueryDocument[]> {\n    return this.iam.groups.list(auth, { \"b2b.legalEntityId\": legalEntityId });\n  }\n\n  /** Adds a user (customer or employee) to a group. */\n  async addMember(\n    groupId: string,\n    member: AssignmentCreateRequest,\n    auth: AuthContext,\n  ): Promise<{ id: string }> {\n    // `addUser` returns `AssignmentIdResponse` (id optional); the original public\n    // contract is `{ id: string }` (the old `request<{id:string}>` asserted the\n    // same). Cast to preserve that contract — the wire body is identical.\n    return (await this.iam.groups.addUser(groupId, member, auth)) as { id: string };\n  }\n\n  /**\n   * Removes a user from a group. Uses `DELETE …/groups/{groupId}/users/{userId}`\n   * directly — this endpoint is deprecated upstream and intentionally not\n   * exposed on {@link IamService}, so it is not delegated. No non-deprecated\n   * single-user removal exists.\n   */\n  async removeMember(groupId: string, userId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `/iam/${this.ctx.tenant}/groups/${groupId}/users/${userId}`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/customer-groups.d.cts

@@ -1,2 +1,2 @@
-export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-D0OCm8kJ.cjs';
+export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-BfHDqExS.cjs';
 import './context-DK8jg6y5.cjs';

package/dist/customer-groups.d.ts

@@ -1,2 +1,2 @@
-export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-WSt4aT62.js';
+export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-Cs6-Cwzg.js';
 import './context-DK8jg6y5.js';

package/dist/customer-groups.js

@@ -1,3 +1,3 @@
-export { CustomerGroupsService } from './chunk-LQFRJSVT.js';
+export { CustomerGroupsService } from './chunk-5XZ6MSXW.js';
 //# sourceMappingURL=customer-groups.js.map
 //# sourceMappingURL=customer-groups.js.map

package/dist/customer.cjs

@@ -187,6 +187,24 @@ var CustomerService = class {
       auth: requireCustomer(auth)
     });
   }
+  /**
+   * Validates a customer token and returns what the tenant knows about it —
+   * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`
+   * (`GET /validateauthtoken`). Requires customer/raw auth.
+   *
+   * An invalid or expired token answers `401`, which surfaces as
+   * {@link EmporixAuthError} rather than a falsy result: this is a check, not a
+   * predicate. Reach for it when you hold a token from elsewhere — an SSO
+   * exchange, a Managed Dashboard host — and need its scopes before deciding
+   * what to render, instead of discovering them from a failed call.
+   */
+  async validateToken(auth) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/validateauthtoken`,
+      auth: requireCustomer(auth)
+    });
+  }
   /** Updates the authenticated customer. Requires customer/raw auth. */
   async update(patch, auth) {
     return this.ctx.http.request({

package/dist/customer.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/errors.ts","../src/core/require-customer.ts","../src/services/customer.ts"],"names":[],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;;;AC3B7C,SAAS,gBAAgB,IAAA,EAA4C;AAC1E,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,QAAQ,OAAO,IAAA;AACtE,EAAA,MAAM,IAAI,iBAAiB,uDAAuD,CAAA;AACpF;;;ACiEA,SAAS,SAAA,CACP,QAAA,EACA,IAAA,EACA,IAAA,GAAoC,EAAC,EACpB;AACjB,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,WAAA;AAChD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,gBAAA,CAAiB,CAAA,EAAG,QAAQ,CAAA,+BAAA,CAAA,EAAmC,QAAW,IAAI,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO;AAAA,IACL,aAAA;AAAA,IACA,WAAW,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,SAAA,IAAa,KAAK,cAAA,IAAkB,EAAA;AAAA,IACvE,YAAA,EAAc,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA,IAAgB,EAAA;AAAA,IACzD,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,WAAW,IAAA,CAAK,UAAA,IAAc,OAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AAAA,IAC/D,GAAI,KAAK,mBAAA,GAAsB,EAAE,mBAAmB,IAAA,CAAK,mBAAA,KAAwB,EAAC;AAAA,IAClF,GAAI,KAAK,eAAA,GAAkB,EAAE,eAAe,IAAA,CAAK,eAAA,KAAoB;AAAC,GACxE;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAE3B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,UAAA;AAAA;AAAA,EAI1B,MAAM,SAAA,GAAuC;AAC3C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,iBAAA,EAAkB;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACrB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CACJ,KAAA,EACA,IAAA,GAAoC,IACpC,IAAA,GAAoB,EAAE,IAAA,EAAM,WAAA,EAAY,EACd;AAC1B,IAAA,MAAM,SAAA,GAAyB,KAAK,cAAA,GAChC,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAe,GAC1C,IAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAClC,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,YAAA,EAAc,KAAA,CAAM,YAAA,EAAa;AACzE,IAAA,IAAI,KAAA,CAAM,aAAA,EAAe,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,aAAA;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,SAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA,CAAM,cAAc,MAAA,GAAY,EAAE,gBAAgB,KAAA,CAAM,SAAA,KAAc;AAAC,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,IAAA,EAAmC;AAC9C,IAAA,MAAM,GAAA,GAAM,gBAAgB,IAAI,CAAA;AAChC,IAAA,MAAM,QAAS,GAAA,CAA0B,KAAA;AACzC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,MAC5B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC;AAAA,MACpC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,YAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,KAAA,CAAM,SAAA,GAAY,EAAE,OAAA,EAAS,EAAE,YAAA,EAAc,KAAA,CAAM,SAAA,EAAU,EAAE,GAAI;AAAC,KACzE,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,eAAe,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,kBAAA,EAAoB,KAAA,CAAM,YAAA,EAAa;AAC/E,IAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAA;AACvC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,GAAG,IAAA,EAAuC;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA4B,IAAA,EAAuC;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,KAAA,EAA4B,IAAA,EAAmC;AAClF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,aAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5E;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,gBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,KAAA,EAAyB,IAAA,EAAmC;AAC5E,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kCAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,0CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGS,SAAA,GAAY;AAAA,IACnB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAA6B,SACvC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,KAAA,EAA2B,SACpD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,QAAQ,OAAO,EAAA,EAAY,SACzB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAc;AAAA,MAC1B,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AAChF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,MAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,CAAA;AAAA,IACA,UAAA,EAAY,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AACnF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH;AAAA,GACF;AACF","file":"customer.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { AuthContext } from \"./auth\";\nimport { EmporixAuthError } from \"./errors\";\n\n/**\n * Enforces a caller-owned customer or raw token. Throws `EmporixAuthError`\n * for any other `AuthContext` kind (or when `auth` is missing). Shared by\n * services whose endpoints require a customer scope (`/me`, payments,\n * customer-segments…).\n */\nexport function requireCustomer(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"raw\")) return auth;\n  throw new EmporixAuthError(\"This operation requires a customer or raw AuthContext\");\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext, AnonymousSession } from \"../core/auth\";\nimport { EmporixAuthError } from \"../core/errors\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  Customer as GeneratedCustomer,\n  Address as GeneratedAddress,\n  CustomerSignup,\n  CustomerUpdateDto,\n  PasswordChangeDto,\n  PasswordResetRequestDto,\n  PasswordUpdate,\n  AddressCreateDto,\n  AddressUpdateDto,\n  ChangeEmailRequestDto,\n  UpdateEmail,\n  RefreshToken,\n} from \"../generated/customer\";\n\n/**\n * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to\n * idiomatic names: `access_token` → `customerToken`, `saas_token` →\n * `saasToken`. `saasToken` is a JWT required for the checkout (`saas-token`\n * header). The wire's `*_token` (snake_case) fields are canonical; the\n * camelCase variants are deprecated in the Emporix spec.\n */\nexport interface CustomerSession {\n  customerToken: string;\n  /** JWT required for completing checkout (sent as the `saas-token` header). */\n  saasToken: string;\n  refreshToken: string;\n  /** Same session as the anonymous token — preserves the cart across login. */\n  sessionId: string | undefined;\n  /** Customer access-token lifetime in seconds. */\n  expiresIn: number | undefined;\n  /** Only set by `socialLogin`: the IdP access token echoed by Emporix. */\n  socialAccessToken?: string;\n  /** Only set by `socialLogin`: the IdP ID token echoed by Emporix. */\n  socialIdToken?: string;\n}\n\n/** Customer profile as returned by the Customer service (all generated fields). */\nexport type Customer = GeneratedCustomer;\n\n/** A customer address as returned by the Customer service (all generated fields). */\nexport type Address = GeneratedAddress;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CustomerSignupInput = CustomerSignup;\nexport type CustomerUpdateInput = CustomerUpdateDto;\nexport type PasswordChangeInput = PasswordChangeDto;\nexport type PasswordResetRequestInput = PasswordResetRequestDto;\nexport type PasswordResetConfirmInput = PasswordUpdate;\nexport type AddressCreateInput = AddressCreateDto;\nexport type AddressUpdateInput = AddressUpdateDto;\nexport type ChangeEmailInput = ChangeEmailRequestDto;\nexport type ConfirmEmailChangeInput = UpdateEmail;\nexport type ResendActivationInput = RefreshToken;\n\n/** Union of the wire shapes the four session endpoints return. snake_case is\n * canonical; camelCase is the deprecated fallback (vendored spec, design §2). */\ninterface WireSession {\n  access_token?: string;\n  saas_token?: string;\n  refresh_token?: string;\n  session_id?: string;\n  expires_in?: string | number;\n  accessToken?: string;\n  saasToken?: string;\n  refreshToken?: string;\n  social_access_token?: string;\n  social_id_token?: string;\n}\n\n/** Wire→facade mapping shared by login/refresh/socialLogin/exchangeToken.\n * Throws instead of fabricating an empty session: `customerToken: \"\"` would\n * read as authenticated downstream and 401-loop every subsequent call. */\nfunction toSession(\n  endpoint: string,\n  wire: WireSession,\n  opts: { carrySaasToken?: string } = {},\n): CustomerSession {\n  const customerToken = wire.access_token ?? wire.accessToken;\n  if (!customerToken) {\n    throw new EmporixAuthError(`${endpoint}: response missing access_token`, undefined, wire);\n  }\n  return {\n    customerToken,\n    saasToken: wire.saas_token ?? wire.saasToken ?? opts.carrySaasToken ?? \"\",\n    refreshToken: wire.refresh_token ?? wire.refreshToken ?? \"\",\n    sessionId: wire.session_id,\n    expiresIn: wire.expires_in != null ? Number(wire.expires_in) : undefined,\n    ...(wire.social_access_token ? { socialAccessToken: wire.social_access_token } : {}),\n    ...(wire.social_id_token ? { socialIdToken: wire.social_id_token } : {}),\n  };\n}\n\n/** Customer signup, session, profile and addresses. */\nexport class CustomerService {\n  static readonly channel = \"customer\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  /** Obtains an anonymous storefront session (accessToken + sessionId + refreshToken). */\n  async anonymous(): Promise<AnonymousSession> {\n    return this.ctx.tokenProvider.getAnonymousToken();\n  }\n\n  /** Registers a customer. Default auth: anonymous. */\n  async signup(\n    input: CustomerSignupInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Logs a customer in. Threads the anonymous token so the session (and its\n   * cart) survives — losing it silently creates a new session per Emporix docs.\n   * Wire `accessToken` is mapped to `customerToken`.\n   */\n  async login(\n    creds: { email: string; password: string },\n    opts: { anonymousToken?: string } = {},\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const effective: AuthContext = opts.anonymousToken\n      ? { kind: \"raw\", token: opts.anonymousToken }\n      : auth;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/login`,\n      auth: effective,\n      body: creds,\n    });\n    return toSession(\"login\", wire);\n  }\n\n  /**\n   * Refreshes an authenticated customer session via its refresh token,\n   * preserving the same `sessionId`. Calls\n   * `GET /customer/{tenant}/refreshauthtoken?refreshToken=…`, which **must be\n   * authorized with an anonymous token** (default auth: anonymous) — not the\n   * expired customer token. The refresh response does **not** include a\n   * `saas_token`; pass the original `saasToken` to carry it forward (it has\n   * its own, independent lifetime).\n   */\n  async refresh(\n    input: { refreshToken: string; saasToken?: string; legalEntityId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { refreshToken: input.refreshToken };\n    if (input.legalEntityId) query.legalEntityId = input.legalEntityId;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/refreshauthtoken`,\n      query,\n      auth,\n    });\n    // Refresh does not return a saas_token — carry the original forward.\n    return toSession(\n      \"refresh\",\n      wire,\n      input.saasToken !== undefined ? { carrySaasToken: input.saasToken } : {},\n    );\n  }\n\n  /**\n   * Logs the customer out server-side: `GET /customer/{tenant}/logout?\n   * accessToken=…` authorized with the customer token. Invalidates the\n   * access token (204 No Content). Requires customer/raw auth — the token is\n   * sent both as the bearer and the `accessToken` query param (per Emporix).\n   */\n  async logout(auth?: AuthContext): Promise<void> {\n    const ctx = requireCustomer(auth);\n    const token = (ctx as { token: string }).token;\n    await this.ctx.http.request<void>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/logout`,\n      query: { accessToken: token },\n      auth: ctx,\n    });\n  }\n\n  /**\n   * Authorization-Code SSO: exchanges the IdP `code` for an Emporix customer\n   * session via `POST /customer/{tenant}/socialLogin`. The browser performs\n   * the IdP redirect itself; the SDK only does this Emporix exchange.\n   * Default auth: anonymous (Emporix requires an anonymous Bearer). The\n   * response has no `session_id` and returns `expires_in` as a string —\n   * normalized to a number here.\n   */\n  async socialLogin(\n    input: { code: string; redirectUri: string; codeVerifier?: string; sessionId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = {\n      code: input.code,\n      redirect_uri: input.redirectUri,\n    };\n    if (input.codeVerifier) query.code_verifier = input.codeVerifier;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/socialLogin`,\n      query,\n      auth,\n      ...(input.sessionId ? { headers: { \"session-id\": input.sessionId } } : {}),\n    });\n    return toSession(\"socialLogin\", wire);\n  }\n\n  /**\n   * RFC 8693 token exchange: exchanges an external IdP JWT for an Emporix\n   * customer session via `POST /customer/{tenant}/exchangeauthtoken`.\n   * Emporix uses a proprietary query-param wire (not the RFC form body).\n   * Default auth: anonymous. `config` selects a site-specific IdP config\n   * (multi-site); omit for the tenant default. Returns `session_id` and a\n   * fresh `saas_token`; `expires_in` is an integer (normalized anyway).\n   */\n  async exchangeToken(\n    input: { subjectToken: string; config?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { subjectAccessToken: input.subjectToken };\n    if (input.config) query.config = input.config;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/exchangeauthtoken`,\n      query,\n      auth,\n    });\n    return toSession(\"exchangeToken\", wire);\n  }\n\n  /** Returns the authenticated customer. Requires customer/raw auth. */\n  async me(auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /** Updates the authenticated customer. Requires customer/raw auth. */\n  async update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"PUT\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n      body: patch,\n    });\n  }\n\n  /** Changes the password. Requires customer/raw auth. */\n  async changePassword(input: PasswordChangeInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Requests a password reset email. Default auth: anonymous. */\n  async requestPasswordReset(\n    input: PasswordResetRequestInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Confirms a password reset. Default auth: anonymous. */\n  async confirmPasswordReset(\n    input: PasswordResetConfirmInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset/update`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Completes double opt-in signup with the emailed token, creating the account\n   * and returning a logged-in {@link CustomerSession}. Default auth: anonymous.\n   */\n  async confirmSignup(\n    token: string,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/${encodeURIComponent(token)}`,\n      auth,\n    });\n    return toSession(\"confirmSignup\", wire);\n  }\n\n  /** Resends the double opt-in activation link. Default auth: anonymous. */\n  async resendActivation(\n    input: ResendActivationInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/refresh_token`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Requests a login-email change (emails a confirmation token). Requires customer/raw auth. */\n  async changeEmail(input: ChangeEmailInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Confirms a login-email change with the emailed token. Default auth: anonymous. */\n  async confirmEmailChange(\n    input: ConfirmEmailChangeInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change/confirm`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Address sub-resource. All operations require customer/raw auth. */\n  readonly addresses = {\n    list: async (auth?: AuthContext): Promise<Address[]> =>\n      this.ctx.http.request<Address[]>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n      }),\n    add: async (address: AddressCreateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n        body: address,\n      }),\n    update: async (id: string, patch: AddressUpdateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"PUT\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n        body: patch,\n      }),\n    remove: async (id: string, auth?: AuthContext): Promise<void> =>\n      this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    get: async (id: string, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    addTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n    removeTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/core/errors.ts","../src/core/require-customer.ts","../src/services/customer.ts"],"names":[],"mappings":";;;AACA,IAAM,kBAAA,uBAAyB,GAAA,CAAI;AAAA,EACjC,cAAA;AAAA,EAAgB,eAAA;AAAA,EAAiB,OAAA;AAAA,EAAS,eAAA;AAAA,EAAiB,WAAA;AAAA,EAC3D,QAAA;AAAA,EAAU,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAC9C,CAAC,CAAA;AAED,SAAS,MAAM,IAAA,EAAwB;AACrC,EAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AACpE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAA,GAAI,gBAAA,GAAmB,KAAA,CAAM,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,MAAA;AAAA,EACA,IAAA;AAAA,EACT,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAiB,IAAA,EAAgB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAEA,MAAA,GAAkC;AAChC,IAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC/F;AACF,CAAA;AAGO,IAAM,gBAAA,GAAN,cAA+B,YAAA,CAAa;AAAC,CAAA;;;AC3B7C,SAAS,gBAAgB,IAAA,EAA4C;AAC1E,EAAA,IAAI,SAAS,IAAA,CAAK,IAAA,KAAS,cAAc,IAAA,CAAK,IAAA,KAAS,QAAQ,OAAO,IAAA;AACtE,EAAA,MAAM,IAAI,iBAAiB,uDAAuD,CAAA;AACpF;;;ACwEA,SAAS,SAAA,CACP,QAAA,EACA,IAAA,EACA,IAAA,GAAoC,EAAC,EACpB;AACjB,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,WAAA;AAChD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,gBAAA,CAAiB,CAAA,EAAG,QAAQ,CAAA,+BAAA,CAAA,EAAmC,QAAW,IAAI,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO;AAAA,IACL,aAAA;AAAA,IACA,WAAW,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,SAAA,IAAa,KAAK,cAAA,IAAkB,EAAA;AAAA,IACvE,YAAA,EAAc,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA,IAAgB,EAAA;AAAA,IACzD,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,WAAW,IAAA,CAAK,UAAA,IAAc,OAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AAAA,IAC/D,GAAI,KAAK,mBAAA,GAAsB,EAAE,mBAAmB,IAAA,CAAK,mBAAA,KAAwB,EAAC;AAAA,IAClF,GAAI,KAAK,eAAA,GAAkB,EAAE,eAAe,IAAA,CAAK,eAAA,KAAoB;AAAC,GACxE;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAE3B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,UAAA;AAAA;AAAA,EAI1B,MAAM,SAAA,GAAuC;AAC3C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,aAAA,CAAc,iBAAA,EAAkB;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,MAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACrB;AACnB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CACJ,KAAA,EACA,IAAA,GAAoC,IACpC,IAAA,GAAoB,EAAE,IAAA,EAAM,WAAA,EAAY,EACd;AAC1B,IAAA,MAAM,SAAA,GAAyB,KAAK,cAAA,GAChC,EAAE,MAAM,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAe,GAC1C,IAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,MAAA,CAAA;AAAA,MAClC,IAAA,EAAM,SAAA;AAAA,MACN,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,YAAA,EAAc,KAAA,CAAM,YAAA,EAAa;AACzE,IAAA,IAAI,KAAA,CAAM,aAAA,EAAe,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,aAAA;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,iBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,OAAO,SAAA;AAAA,MACL,SAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA,CAAM,cAAc,MAAA,GAAY,EAAE,gBAAgB,KAAA,CAAM,SAAA,KAAc;AAAC,KACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,IAAA,EAAmC;AAC9C,IAAA,MAAM,GAAA,GAAM,gBAAgB,IAAI,CAAA;AAChC,IAAA,MAAM,QAAS,GAAA,CAA0B,KAAA;AACzC,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,MAClC,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,MAC5B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC;AAAA,MACpC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,KAAA,CAAM,aAAA,GAAgB,KAAA,CAAM,YAAA;AACpD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,YAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,GAAI,KAAA,CAAM,SAAA,GAAY,EAAE,OAAA,EAAS,EAAE,YAAA,EAAc,KAAA,CAAM,SAAA,EAAU,EAAE,GAAI;AAAC,KACzE,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,eAAe,IAAI,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,KAAA,GAAgC,EAAE,kBAAA,EAAoB,KAAA,CAAM,YAAA,EAAa;AAC/E,IAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,MAAA,GAAS,KAAA,CAAM,MAAA;AACvC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,GAAG,IAAA,EAAuC;AAC9C,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,cAAc,IAAA,EAAsD;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAiC;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA4B,IAAA,EAAuC;AAC9E,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAkB;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,GAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,cAAA,CAAe,KAAA,EAA4B,IAAA,EAAmC;AAClF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,gBAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,oBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,sBAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACd;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAqB;AAAA,MACpD,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,aAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,cAAA,EAAiB,kBAAA,CAAmB,KAAK,CAAC,CAAA,CAAA;AAAA,MAC5E;AAAA,KACD,CAAA;AACD,IAAA,OAAO,SAAA,CAAU,iBAAiB,IAAI,CAAA;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,gBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,2BAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAA,CAAY,KAAA,EAAyB,IAAA,EAAmC;AAC5E,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,kCAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAoB,EAAE,IAAA,EAAM,aAAY,EACzB;AACf,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,0CAAA,CAAA;AAAA,MAClC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGS,SAAA,GAAY;AAAA,IACnB,MAAM,OAAO,IAAA,KACX,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAmB;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,OAAA,EAA6B,SACvC,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,aAAA,CAAA;AAAA,MAClC,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,MAAA,EAAQ,OAAO,EAAA,EAAY,KAAA,EAA2B,SACpD,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI,CAAA;AAAA,MAC1B,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,IACH,QAAQ,OAAO,EAAA,EAAY,SACzB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAc;AAAA,MAC1B,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,KAAK,OAAO,EAAA,EAAY,SACtB,IAAA,CAAK,GAAA,CAAI,KAAK,OAAA,CAAiB;AAAA,MAC7B,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,CAAA;AAAA,MACrD,IAAA,EAAM,gBAAgB,IAAI;AAAA,KAC3B,CAAA;AAAA,IACH,OAAA,EAAS,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AAChF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,MAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH,CAAA;AAAA,IACA,UAAA,EAAY,OAAO,EAAA,EAAY,IAAA,EAAgB,IAAA,KAAsC;AACnF,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,QAChC,MAAA,EAAQ,QAAA;AAAA,QACR,MAAM,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,CAAI,MAAM,iBAAiB,EAAE,CAAA,KAAA,CAAA;AAAA,QACrD,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,EAAE;AAAA,QAC9B,IAAA,EAAM,gBAAgB,IAAI;AAAA,OAC3B,CAAA;AAAA,IACH;AAAA,GACF;AACF","file":"customer.cjs","sourcesContent":["/** Keys whose values are stripped from any serialised error body. */\nconst REDACTED_BODY_KEYS = new Set([\n  \"access_token\", \"refresh_token\", \"token\", \"customertoken\", \"saastoken\",\n  \"secret\", \"client_secret\", \"authorization\", \"password\",\n]);\n\nfunction scrub(body: unknown): unknown {\n  if (Array.isArray(body)) return body.map(scrub);\n  if (body && typeof body === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(body as Record<string, unknown>)) {\n      out[k] = REDACTED_BODY_KEYS.has(k.toLowerCase()) ? \"***redacted***\" : scrub(v);\n    }\n    return out;\n  }\n  return body;\n}\n\n/** Base class for every error thrown by the SDK. */\nexport class EmporixError extends Error {\n  readonly status: number | undefined;\n  readonly body: unknown;\n  constructor(message: string, status?: number, body?: unknown) {\n    super(message);\n    this.name = new.target.name;\n    this.status = status;\n    this.body = body;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n  /** Safe serialisation — token-like body fields are redacted. */\n  toJSON(): Record<string, unknown> {\n    return { name: this.name, message: this.message, status: this.status, body: scrub(this.body) };\n  }\n}\n\n/** 401 — authentication failed or token expired. */\nexport class EmporixAuthError extends EmporixError {}\n/** 403 — authenticated but not permitted. */\nexport class EmporixForbiddenError extends EmporixError {}\n/** 404 — resource not found. */\nexport class EmporixNotFoundError extends EmporixError {}\n/** 400/422 — request validation failed. */\nexport class EmporixValidationError extends EmporixError {}\n/** 5xx — server-side failure. */\nexport class EmporixServerError extends EmporixError {}\n/** Request aborted by the configured connect/read timeout. No HTTP status. */\nexport class EmporixTimeoutError extends EmporixError {}\n/** DNS/TLS/connection-level failure before or during the exchange. No HTTP status. */\nexport class EmporixNetworkError extends EmporixError {}\n\n/**\n * 403 with a `missing scope: <name>` hint in the body's `details` array.\n * Subclasses {@link EmporixForbiddenError} so existing 403 catches still work.\n */\nexport class EmporixInsufficientScopeError extends EmporixForbiddenError {\n  readonly requiredScope: string | undefined;\n  constructor(message: string, status: number, body: unknown, requiredScope?: string) {\n    super(message, status, body);\n    this.requiredScope = requiredScope;\n  }\n}\n\nconst SCOPE_HINT_RE = /missing scope[: ]+([a-z0-9._-]+)/i;\n\nfunction extractRequiredScope(body: unknown): string | undefined {\n  if (body && typeof body === \"object\" && \"details\" in body) {\n    const details = (body as { details?: unknown }).details;\n    if (Array.isArray(details)) {\n      for (const d of details) {\n        if (typeof d === \"string\") {\n          const m = d.match(SCOPE_HINT_RE);\n          if (m) return m[1];\n        }\n      }\n    }\n  }\n  return undefined;\n}\n\n/** Maps an HTTP status to the matching {@link EmporixError} subclass. */\nexport function errorFromResponse(status: number, message: string, body: unknown): EmporixError {\n  if (status === 401) return new EmporixAuthError(message, status, body);\n  if (status === 403) {\n    const scope = extractRequiredScope(body);\n    if (scope) return new EmporixInsufficientScopeError(message, status, body, scope);\n    return new EmporixForbiddenError(message, status, body);\n  }\n  if (status === 404) return new EmporixNotFoundError(message, status, body);\n  if (status === 400 || status === 422) return new EmporixValidationError(message, status, body);\n  if (status >= 500) return new EmporixServerError(message, status, body);\n  return new EmporixError(message, status, body);\n}\n","import type { AuthContext } from \"./auth\";\nimport { EmporixAuthError } from \"./errors\";\n\n/**\n * Enforces a caller-owned customer or raw token. Throws `EmporixAuthError`\n * for any other `AuthContext` kind (or when `auth` is missing). Shared by\n * services whose endpoints require a customer scope (`/me`, payments,\n * customer-segments…).\n */\nexport function requireCustomer(auth: AuthContext | undefined): AuthContext {\n  if (auth && (auth.kind === \"customer\" || auth.kind === \"raw\")) return auth;\n  throw new EmporixAuthError(\"This operation requires a customer or raw AuthContext\");\n}\n","import type { ClientContext } from \"../core/context\";\nimport type { AuthContext, AnonymousSession } from \"../core/auth\";\nimport { EmporixAuthError } from \"../core/errors\";\nimport { requireCustomer } from \"../core/require-customer\";\nimport type {\n  Customer as GeneratedCustomer,\n  Address as GeneratedAddress,\n  CustomerSignup,\n  CustomerUpdateDto,\n  PasswordChangeDto,\n  PasswordResetRequestDto,\n  PasswordUpdate,\n  AddressCreateDto,\n  AddressUpdateDto,\n  ChangeEmailRequestDto,\n  UpdateEmail,\n  RefreshToken,\n  ValidateTokenResponse,\n} from \"../generated/customer\";\n\n/**\n * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to\n * idiomatic names: `access_token` → `customerToken`, `saas_token` →\n * `saasToken`. `saasToken` is a JWT required for the checkout (`saas-token`\n * header). The wire's `*_token` (snake_case) fields are canonical; the\n * camelCase variants are deprecated in the Emporix spec.\n */\nexport interface CustomerSession {\n  customerToken: string;\n  /** JWT required for completing checkout (sent as the `saas-token` header). */\n  saasToken: string;\n  refreshToken: string;\n  /** Same session as the anonymous token — preserves the cart across login. */\n  sessionId: string | undefined;\n  /** Customer access-token lifetime in seconds. */\n  expiresIn: number | undefined;\n  /** Only set by `socialLogin`: the IdP access token echoed by Emporix. */\n  socialAccessToken?: string;\n  /** Only set by `socialLogin`: the IdP ID token echoed by Emporix. */\n  socialIdToken?: string;\n}\n\n/** Customer profile as returned by the Customer service (all generated fields). */\nexport type Customer = GeneratedCustomer;\n\n/** A customer address as returned by the Customer service (all generated fields). */\nexport type Address = GeneratedAddress;\n\n/** Generated request bodies (caller sends the exact wire shape). */\nexport type CustomerSignupInput = CustomerSignup;\nexport type CustomerUpdateInput = CustomerUpdateDto;\nexport type PasswordChangeInput = PasswordChangeDto;\nexport type PasswordResetRequestInput = PasswordResetRequestDto;\nexport type PasswordResetConfirmInput = PasswordUpdate;\nexport type AddressCreateInput = AddressCreateDto;\nexport type AddressUpdateInput = AddressUpdateDto;\nexport type ChangeEmailInput = ChangeEmailRequestDto;\nexport type ConfirmEmailChangeInput = UpdateEmail;\nexport type ResendActivationInput = RefreshToken;\n/**\n * What `validateToken` reports about a customer token: `scope` is the\n * space-separated scope list, plus `sessionId`, `email`, `legalEntityId` and\n * `expires_in`. Every field is optional upstream.\n */\nexport type CustomerTokenValidation = ValidateTokenResponse;\n\n/** Union of the wire shapes the four session endpoints return. snake_case is\n * canonical; camelCase is the deprecated fallback (vendored spec, design §2). */\ninterface WireSession {\n  access_token?: string;\n  saas_token?: string;\n  refresh_token?: string;\n  session_id?: string;\n  expires_in?: string | number;\n  accessToken?: string;\n  saasToken?: string;\n  refreshToken?: string;\n  social_access_token?: string;\n  social_id_token?: string;\n}\n\n/** Wire→facade mapping shared by login/refresh/socialLogin/exchangeToken.\n * Throws instead of fabricating an empty session: `customerToken: \"\"` would\n * read as authenticated downstream and 401-loop every subsequent call. */\nfunction toSession(\n  endpoint: string,\n  wire: WireSession,\n  opts: { carrySaasToken?: string } = {},\n): CustomerSession {\n  const customerToken = wire.access_token ?? wire.accessToken;\n  if (!customerToken) {\n    throw new EmporixAuthError(`${endpoint}: response missing access_token`, undefined, wire);\n  }\n  return {\n    customerToken,\n    saasToken: wire.saas_token ?? wire.saasToken ?? opts.carrySaasToken ?? \"\",\n    refreshToken: wire.refresh_token ?? wire.refreshToken ?? \"\",\n    sessionId: wire.session_id,\n    expiresIn: wire.expires_in != null ? Number(wire.expires_in) : undefined,\n    ...(wire.social_access_token ? { socialAccessToken: wire.social_access_token } : {}),\n    ...(wire.social_id_token ? { socialIdToken: wire.social_id_token } : {}),\n  };\n}\n\n/** Customer signup, session, profile and addresses. */\nexport class CustomerService {\n  static readonly channel = \"customer\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  /** Obtains an anonymous storefront session (accessToken + sessionId + refreshToken). */\n  async anonymous(): Promise<AnonymousSession> {\n    return this.ctx.tokenProvider.getAnonymousToken();\n  }\n\n  /** Registers a customer. Default auth: anonymous. */\n  async signup(\n    input: CustomerSignupInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Logs a customer in. Threads the anonymous token so the session (and its\n   * cart) survives — losing it silently creates a new session per Emporix docs.\n   * Wire `accessToken` is mapped to `customerToken`.\n   */\n  async login(\n    creds: { email: string; password: string },\n    opts: { anonymousToken?: string } = {},\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const effective: AuthContext = opts.anonymousToken\n      ? { kind: \"raw\", token: opts.anonymousToken }\n      : auth;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/login`,\n      auth: effective,\n      body: creds,\n    });\n    return toSession(\"login\", wire);\n  }\n\n  /**\n   * Refreshes an authenticated customer session via its refresh token,\n   * preserving the same `sessionId`. Calls\n   * `GET /customer/{tenant}/refreshauthtoken?refreshToken=…`, which **must be\n   * authorized with an anonymous token** (default auth: anonymous) — not the\n   * expired customer token. The refresh response does **not** include a\n   * `saas_token`; pass the original `saasToken` to carry it forward (it has\n   * its own, independent lifetime).\n   */\n  async refresh(\n    input: { refreshToken: string; saasToken?: string; legalEntityId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { refreshToken: input.refreshToken };\n    if (input.legalEntityId) query.legalEntityId = input.legalEntityId;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/refreshauthtoken`,\n      query,\n      auth,\n    });\n    // Refresh does not return a saas_token — carry the original forward.\n    return toSession(\n      \"refresh\",\n      wire,\n      input.saasToken !== undefined ? { carrySaasToken: input.saasToken } : {},\n    );\n  }\n\n  /**\n   * Logs the customer out server-side: `GET /customer/{tenant}/logout?\n   * accessToken=…` authorized with the customer token. Invalidates the\n   * access token (204 No Content). Requires customer/raw auth — the token is\n   * sent both as the bearer and the `accessToken` query param (per Emporix).\n   */\n  async logout(auth?: AuthContext): Promise<void> {\n    const ctx = requireCustomer(auth);\n    const token = (ctx as { token: string }).token;\n    await this.ctx.http.request<void>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/logout`,\n      query: { accessToken: token },\n      auth: ctx,\n    });\n  }\n\n  /**\n   * Authorization-Code SSO: exchanges the IdP `code` for an Emporix customer\n   * session via `POST /customer/{tenant}/socialLogin`. The browser performs\n   * the IdP redirect itself; the SDK only does this Emporix exchange.\n   * Default auth: anonymous (Emporix requires an anonymous Bearer). The\n   * response has no `session_id` and returns `expires_in` as a string —\n   * normalized to a number here.\n   */\n  async socialLogin(\n    input: { code: string; redirectUri: string; codeVerifier?: string; sessionId?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = {\n      code: input.code,\n      redirect_uri: input.redirectUri,\n    };\n    if (input.codeVerifier) query.code_verifier = input.codeVerifier;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/socialLogin`,\n      query,\n      auth,\n      ...(input.sessionId ? { headers: { \"session-id\": input.sessionId } } : {}),\n    });\n    return toSession(\"socialLogin\", wire);\n  }\n\n  /**\n   * RFC 8693 token exchange: exchanges an external IdP JWT for an Emporix\n   * customer session via `POST /customer/{tenant}/exchangeauthtoken`.\n   * Emporix uses a proprietary query-param wire (not the RFC form body).\n   * Default auth: anonymous. `config` selects a site-specific IdP config\n   * (multi-site); omit for the tenant default. Returns `session_id` and a\n   * fresh `saas_token`; `expires_in` is an integer (normalized anyway).\n   */\n  async exchangeToken(\n    input: { subjectToken: string; config?: string },\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const query: Record<string, string> = { subjectAccessToken: input.subjectToken };\n    if (input.config) query.config = input.config;\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/exchangeauthtoken`,\n      query,\n      auth,\n    });\n    return toSession(\"exchangeToken\", wire);\n  }\n\n  /** Returns the authenticated customer. Requires customer/raw auth. */\n  async me(auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /**\n   * Validates a customer token and returns what the tenant knows about it —\n   * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`\n   * (`GET /validateauthtoken`). Requires customer/raw auth.\n   *\n   * An invalid or expired token answers `401`, which surfaces as\n   * {@link EmporixAuthError} rather than a falsy result: this is a check, not a\n   * predicate. Reach for it when you hold a token from elsewhere — an SSO\n   * exchange, a Managed Dashboard host — and need its scopes before deciding\n   * what to render, instead of discovering them from a failed call.\n   */\n  async validateToken(auth?: AuthContext): Promise<CustomerTokenValidation> {\n    return this.ctx.http.request<CustomerTokenValidation>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/validateauthtoken`,\n      auth: requireCustomer(auth),\n    });\n  }\n\n  /** Updates the authenticated customer. Requires customer/raw auth. */\n  async update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer> {\n    return this.ctx.http.request<Customer>({\n      method: \"PUT\",\n      path: `/customer/${this.ctx.tenant}/me`,\n      auth: requireCustomer(auth),\n      body: patch,\n    });\n  }\n\n  /** Changes the password. Requires customer/raw auth. */\n  async changePassword(input: PasswordChangeInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Requests a password reset email. Default auth: anonymous. */\n  async requestPasswordReset(\n    input: PasswordResetRequestInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Confirms a password reset. Default auth: anonymous. */\n  async confirmPasswordReset(\n    input: PasswordResetConfirmInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/password/reset/update`,\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Completes double opt-in signup with the emailed token, creating the account\n   * and returning a logged-in {@link CustomerSession}. Default auth: anonymous.\n   */\n  async confirmSignup(\n    token: string,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<CustomerSession> {\n    const wire = await this.ctx.http.request<WireSession>({\n      method: \"GET\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/${encodeURIComponent(token)}`,\n      auth,\n    });\n    return toSession(\"confirmSignup\", wire);\n  }\n\n  /** Resends the double opt-in activation link. Default auth: anonymous. */\n  async resendActivation(\n    input: ResendActivationInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/signup/optin/refresh_token`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Requests a login-email change (emails a confirmation token). Requires customer/raw auth. */\n  async changeEmail(input: ChangeEmailInput, auth?: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change`,\n      auth: requireCustomer(auth),\n      body: input,\n    });\n  }\n\n  /** Confirms a login-email change with the emailed token. Default auth: anonymous. */\n  async confirmEmailChange(\n    input: ConfirmEmailChangeInput,\n    auth: AuthContext = { kind: \"anonymous\" },\n  ): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"POST\",\n      path: `/customer/${this.ctx.tenant}/me/accounts/internal/email/change/confirm`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Address sub-resource. All operations require customer/raw auth. */\n  readonly addresses = {\n    list: async (auth?: AuthContext): Promise<Address[]> =>\n      this.ctx.http.request<Address[]>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n      }),\n    add: async (address: AddressCreateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses`,\n        auth: requireCustomer(auth),\n        body: address,\n      }),\n    update: async (id: string, patch: AddressUpdateInput, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"PUT\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n        body: patch,\n      }),\n    remove: async (id: string, auth?: AuthContext): Promise<void> =>\n      this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    get: async (id: string, auth?: AuthContext): Promise<Address> =>\n      this.ctx.http.request<Address>({\n        method: \"GET\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}`,\n        auth: requireCustomer(auth),\n      }),\n    addTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"POST\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n    removeTags: async (id: string, tags: string[], auth?: AuthContext): Promise<void> => {\n      await this.ctx.http.request<void>({\n        method: \"DELETE\",\n        path: `/customer/${this.ctx.tenant}/me/addresses/${id}/tags`,\n        query: { tags: tags.join(\",\") },\n        auth: requireCustomer(auth),\n      });\n    },\n  };\n}\n"]}

package/dist/customer.d.cts

@@ -47,9 +47,15 @@ type Address$1 = {
         [key: string]: unknown;
     };
 };
+/**
+ * AddressCommonDto
+ */
 type AddressCommonDto = AddressCreateDto & {
     metadata?: DefaultDtoMetadata;
 };
+/**
+ * AddressCommonDto
+ */
 type AddressCreateDto = {
     contactName?: string;
     companyName?: string;
@@ -80,6 +86,9 @@ type AddressUpdateDto = AddressCommonDto & {
      */
     isDefault?: boolean;
 };
+/**
+ * ChangeEmailRequestDto
+ */
 type ChangeEmailRequestDto = {
     /**
      * Customer email address currently used for logging in.
@@ -155,6 +164,9 @@ type Customer$1 = {
      */
     lastLogin?: string;
 };
+/**
+ * CustomerCommonDto
+ */
 type CustomerCommonDto = {
     title?: string;
     firstName?: string;
@@ -232,6 +244,8 @@ type CustomerUpdateDto = CustomerCommonDto & {
     contactEmail?: string;
 };
 /**
+ * DefaultDtoMetadata
+ *
  * Links to mixin schemas.
  */
 type BasicMetadataDto = {
@@ -239,6 +253,9 @@ type BasicMetadataDto = {
         [key: string]: unknown;
     };
 };
+/**
+ * DefaultDtoMetadata
+ */
 type DefaultDtoMetadata = BasicMetadataDto & {
     version?: number;
 };
@@ -288,12 +305,41 @@ type RefreshToken = {
      */
     email: string;
 };
+/**
+ * UpdateEmail
+ */
 type UpdateEmail = {
     /**
      * Token received by the customer through email.
      */
     token?: string;
 };
+type ValidateTokenResponse = {
+    /**
+     * Type of the token. Usually it's `Bearer`.
+     */
+    token_type?: string;
+    /**
+     * Specifies the token's expiration time, represented in seconds.
+     */
+    expires_in?: number;
+    /**
+     * A list of scopes assigned to the user.
+     */
+    scope?: string;
+    /**
+     * Identifier of the user session.
+     */
+    sessionId?: string;
+    /**
+     * Customer email used to login (generate the token).
+     */
+    email?: string;
+    /**
+     * Legal Entity ID.
+     */
+    legalEntityId?: string;
+};
 
 /**
  * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to
@@ -331,6 +377,12 @@ type AddressUpdateInput = AddressUpdateDto;
 type ChangeEmailInput = ChangeEmailRequestDto;
 type ConfirmEmailChangeInput = UpdateEmail;
 type ResendActivationInput = RefreshToken;
+/**
+ * What `validateToken` reports about a customer token: `scope` is the
+ * space-separated scope list, plus `sessionId`, `email`, `legalEntityId` and
+ * `expires_in`. Every field is optional upstream.
+ */
+type CustomerTokenValidation = ValidateTokenResponse;
 /** Customer signup, session, profile and addresses. */
 declare class CustomerService {
     private readonly ctx;
@@ -400,6 +452,18 @@ declare class CustomerService {
     }, auth?: AuthContext): Promise<CustomerSession>;
     /** Returns the authenticated customer. Requires customer/raw auth. */
     me(auth?: AuthContext): Promise<Customer>;
+    /**
+     * Validates a customer token and returns what the tenant knows about it —
+     * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`
+     * (`GET /validateauthtoken`). Requires customer/raw auth.
+     *
+     * An invalid or expired token answers `401`, which surfaces as
+     * {@link EmporixAuthError} rather than a falsy result: this is a check, not a
+     * predicate. Reach for it when you hold a token from elsewhere — an SSO
+     * exchange, a Managed Dashboard host — and need its scopes before deciding
+     * what to render, instead of discovering them from a failed call.
+     */
+    validateToken(auth?: AuthContext): Promise<CustomerTokenValidation>;
     /** Updates the authenticated customer. Requires customer/raw auth. */
     update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer>;
     /** Changes the password. Requires customer/raw auth. */
@@ -431,4 +495,4 @@ declare class CustomerService {
     };
 }
 
-export { type Address, type AddressCreateInput, type AddressUpdateInput, type ChangeEmailInput, type ConfirmEmailChangeInput, type Customer, CustomerService, type CustomerSession, type CustomerSignupInput, type CustomerUpdateInput, type PasswordChangeInput, type PasswordResetConfirmInput, type PasswordResetRequestInput, type ResendActivationInput };
+export { type Address, type AddressCreateInput, type AddressUpdateInput, type ChangeEmailInput, type ConfirmEmailChangeInput, type Customer, CustomerService, type CustomerSession, type CustomerSignupInput, type CustomerTokenValidation, type CustomerUpdateInput, type PasswordChangeInput, type PasswordResetConfirmInput, type PasswordResetRequestInput, type ResendActivationInput };

package/dist/customer.d.ts

@@ -47,9 +47,15 @@ type Address$1 = {
         [key: string]: unknown;
     };
 };
+/**
+ * AddressCommonDto
+ */
 type AddressCommonDto = AddressCreateDto & {
     metadata?: DefaultDtoMetadata;
 };
+/**
+ * AddressCommonDto
+ */
 type AddressCreateDto = {
     contactName?: string;
     companyName?: string;
@@ -80,6 +86,9 @@ type AddressUpdateDto = AddressCommonDto & {
      */
     isDefault?: boolean;
 };
+/**
+ * ChangeEmailRequestDto
+ */
 type ChangeEmailRequestDto = {
     /**
      * Customer email address currently used for logging in.
@@ -155,6 +164,9 @@ type Customer$1 = {
      */
     lastLogin?: string;
 };
+/**
+ * CustomerCommonDto
+ */
 type CustomerCommonDto = {
     title?: string;
     firstName?: string;
@@ -232,6 +244,8 @@ type CustomerUpdateDto = CustomerCommonDto & {
     contactEmail?: string;
 };
 /**
+ * DefaultDtoMetadata
+ *
  * Links to mixin schemas.
  */
 type BasicMetadataDto = {
@@ -239,6 +253,9 @@ type BasicMetadataDto = {
         [key: string]: unknown;
     };
 };
+/**
+ * DefaultDtoMetadata
+ */
 type DefaultDtoMetadata = BasicMetadataDto & {
     version?: number;
 };
@@ -288,12 +305,41 @@ type RefreshToken = {
      */
     email: string;
 };
+/**
+ * UpdateEmail
+ */
 type UpdateEmail = {
     /**
      * Token received by the customer through email.
      */
     token?: string;
 };
+type ValidateTokenResponse = {
+    /**
+     * Type of the token. Usually it's `Bearer`.
+     */
+    token_type?: string;
+    /**
+     * Specifies the token's expiration time, represented in seconds.
+     */
+    expires_in?: number;
+    /**
+     * A list of scopes assigned to the user.
+     */
+    scope?: string;
+    /**
+     * Identifier of the user session.
+     */
+    sessionId?: string;
+    /**
+     * Customer email used to login (generate the token).
+     */
+    email?: string;
+    /**
+     * Legal Entity ID.
+     */
+    legalEntityId?: string;
+};
 
 /**
  * Caller-owned customer session. Maps the Emporix `CustomerToken` wire shape to
@@ -331,6 +377,12 @@ type AddressUpdateInput = AddressUpdateDto;
 type ChangeEmailInput = ChangeEmailRequestDto;
 type ConfirmEmailChangeInput = UpdateEmail;
 type ResendActivationInput = RefreshToken;
+/**
+ * What `validateToken` reports about a customer token: `scope` is the
+ * space-separated scope list, plus `sessionId`, `email`, `legalEntityId` and
+ * `expires_in`. Every field is optional upstream.
+ */
+type CustomerTokenValidation = ValidateTokenResponse;
 /** Customer signup, session, profile and addresses. */
 declare class CustomerService {
     private readonly ctx;
@@ -400,6 +452,18 @@ declare class CustomerService {
     }, auth?: AuthContext): Promise<CustomerSession>;
     /** Returns the authenticated customer. Requires customer/raw auth. */
     me(auth?: AuthContext): Promise<Customer>;
+    /**
+     * Validates a customer token and returns what the tenant knows about it —
+     * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`
+     * (`GET /validateauthtoken`). Requires customer/raw auth.
+     *
+     * An invalid or expired token answers `401`, which surfaces as
+     * {@link EmporixAuthError} rather than a falsy result: this is a check, not a
+     * predicate. Reach for it when you hold a token from elsewhere — an SSO
+     * exchange, a Managed Dashboard host — and need its scopes before deciding
+     * what to render, instead of discovering them from a failed call.
+     */
+    validateToken(auth?: AuthContext): Promise<CustomerTokenValidation>;
     /** Updates the authenticated customer. Requires customer/raw auth. */
     update(patch: CustomerUpdateInput, auth?: AuthContext): Promise<Customer>;
     /** Changes the password. Requires customer/raw auth. */
@@ -431,4 +495,4 @@ declare class CustomerService {
     };
 }
 
-export { type Address, type AddressCreateInput, type AddressUpdateInput, type ChangeEmailInput, type ConfirmEmailChangeInput, type Customer, CustomerService, type CustomerSession, type CustomerSignupInput, type CustomerUpdateInput, type PasswordChangeInput, type PasswordResetConfirmInput, type PasswordResetRequestInput, type ResendActivationInput };
+export { type Address, type AddressCreateInput, type AddressUpdateInput, type ChangeEmailInput, type ConfirmEmailChangeInput, type Customer, CustomerService, type CustomerSession, type CustomerSignupInput, type CustomerTokenValidation, type CustomerUpdateInput, type PasswordChangeInput, type PasswordResetConfirmInput, type PasswordResetRequestInput, type ResendActivationInput };

package/dist/customer.js

@@ -1,4 +1,4 @@
-export { CustomerService } from './chunk-PRN3T6TY.js';
+export { CustomerService } from './chunk-UA4BM6OP.js';
 import './chunk-3BDDYX3V.js';
 import './chunk-UWGGF4MC.js';
 //# sourceMappingURL=customer.js.map

package/dist/index.cjs

@@ -995,7 +995,7 @@ var HttpClient = class {
 };
 
 // package.json
-var version = "2.36.0";
+var version = "2.37.0";
 
 // src/version.ts
 var SDK_VERSION = version;
@@ -1212,6 +1212,24 @@ var CustomerService = class {
       auth: requireCustomer(auth2)
     });
   }
+  /**
+   * Validates a customer token and returns what the tenant knows about it —
+   * `scope`, `sessionId`, `email`, `legalEntityId`, `expires_in`
+   * (`GET /validateauthtoken`). Requires customer/raw auth.
+   *
+   * An invalid or expired token answers `401`, which surfaces as
+   * {@link EmporixAuthError} rather than a falsy result: this is a check, not a
+   * predicate. Reach for it when you hold a token from elsewhere — an SSO
+   * exchange, a Managed Dashboard host — and need its scopes before deciding
+   * what to render, instead of discovering them from a failed call.
+   */
+  async validateToken(auth2) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `/customer/${this.ctx.tenant}/validateauthtoken`,
+      auth: requireCustomer(auth2)
+    });
+  }
   /** Updates the authenticated customer. Requires customer/raw auth. */
   async update(patch, auth2) {
     return this.ctx.http.request({
@@ -4142,6 +4160,17 @@ var IamService = class {
       path: `${this.base()}/users/${userId}/groups`,
       auth: auth2
     }),
+    /**
+     * Reads one of a user's groups (`GET /users/{userId}/groups/{groupId}`).
+     * The collection read above returns the same shape per entry; this exists
+     * because Emporix exposes the item separately and a caller holding both ids
+     * should not have to page the collection to resolve one group.
+     */
+    getGroup: async (userId, groupId, auth2) => this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/users/${encodeURIComponent(userId)}/groups/${encodeURIComponent(groupId)}`,
+      auth: auth2
+    }),
     getScopes: async (userId, auth2) => this.ctx.http.request({
       method: "GET",
       path: `${this.base()}/users/${userId}/scopes`,