@viu/emporix-sdk 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @viu/emporix-sdk
 
+## 2.6.0
+
+### Minor Changes
+
+- [#92](https://github.com/viuteam/emporix-sdk/pull/92) [`45a2bd8`](https://github.com/viuteam/emporix-sdk/commit/45a2bd8d83cb46d775301790cb2efc60805efc90) Thanks [@amnael1](https://github.com/amnael1)! - Add opt-in reactive customer-token auto-refresh.
+
+  Core: `EmporixClient.setCustomerTokenRefresher(refresher)` registers a
+  single-flight `CustomerTokenRefresher`; on a `customer`-kind 401 the HTTP layer
+  refreshes once and retries. Off by default — the customer token stays
+  caller-owned.
+
+  React: `EmporixProvider` gains `autoRefreshCustomerToken` and
+  `onCustomerSessionExpired`. When enabled, a customer 401 is transparently
+  refreshed via the stored refresh token (anonymous-authorized
+  `GET /refreshauthtoken`) and the request is retried; B2B `legalEntityId` is
+  preserved.
+
 ## 2.5.0
 
 ### Minor Changes

package/dist/availability.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 
 type DistributionChannel = 'ASSORTMENT' | 'HOME_DELIVERY' | 'PICKUP';
 type Availability$1 = {

package/dist/availability.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 
 type DistributionChannel = 'ASSORTMENT' | 'HOME_DELIVERY' | 'PICKUP';
 type Availability$1 = {

package/dist/cart.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 
 /**
  * Access control identifier that determines who can view or manage the cart.

package/dist/cart.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 
 /**
  * Access control identifier that determines who can view or manage the cart.

package/dist/category.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-DJDTlhLW.cjs';
 import { Product } from './product.cjs';
 
 /**

package/dist/category.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-DJDTlhLW.js';
 import { Product } from './product.js';
 
 /**

package/dist/checkout.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 
 /**
  * Information about the customer's address.

package/dist/checkout.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 
 /**
  * Information about the customer's address.

package/dist/companies.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 import { L as LegalEntity, f as LegalEntityCreate, h as LegalEntityUpdate } from './types.gen-D1QuqPLs.cjs';
 export { A as AccountLimit, e as CustomerGroupRef, g as LegalEntityType, i as LegalInfo } from './types.gen-D1QuqPLs.cjs';
 

package/dist/companies.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 import { L as LegalEntity, f as LegalEntityCreate, h as LegalEntityUpdate } from './types.gen-D1QuqPLs.js';
 export { A as AccountLimit, e as CustomerGroupRef, g as LegalEntityType, i as LegalInfo } from './types.gen-D1QuqPLs.js';
 

package/dist/contacts.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 import { C as ContactAssignment, a as ContactAssignmentCreate, c as ContactAssignmentUpdate } from './types.gen-D1QuqPLs.cjs';
 export { b as ContactAssignmentType } from './types.gen-D1QuqPLs.cjs';
 

package/dist/contacts.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 import { C as ContactAssignment, a as ContactAssignmentCreate, c as ContactAssignmentUpdate } from './types.gen-D1QuqPLs.js';
 export { b as ContactAssignmentType } from './types.gen-D1QuqPLs.js';
 

package/dist/{context-CgUWXqEt.d.cts → context-DJDTlhLW.d.cts}

@@ -161,6 +161,19 @@ type AuthContext = {
     kind: "raw";
     token: string;
 };
+/**
+ * Supplies a fresh customer token when a `customer`-kind request 401s. The host
+ * (e.g. EmporixProvider) implements this; the SDK never refreshes the
+ * caller-owned customer token unless a refresher is registered.
+ */
+interface CustomerTokenRefresher {
+    /**
+     * Called on a `customer`-kind 401. Receives the token that just failed;
+     * returns a fresh customer token to retry with, or `null` to give up (the
+     * 401 then propagates as EmporixAuthError).
+     */
+    refresh(expiredToken: string): Promise<string | null>;
+}
 /** An obtained anonymous storefront session. */
 interface AnonymousSession {
     accessToken: string;
@@ -232,6 +245,20 @@ declare const auth: {
 };
 /** Resolves an {@link AuthContext} to a concrete bearer token. */
 declare function resolveToken(ctx: AuthContext, provider: TokenProvider): Promise<string>;
+/**
+ * Late-bindable, single-flight holder for an optional
+ * {@link CustomerTokenRefresher}. Single-flight is required because Emporix
+ * rotates the refresh token on each refresh — concurrent refreshes would
+ * invalidate each other. Off (returns `null`) until a refresher is set.
+ */
+declare class CustomerRefreshRegistry {
+    private refresher;
+    private inflight;
+    set(refresher: CustomerTokenRefresher | null): void;
+    get enabled(): boolean;
+    /** Concurrent callers share one in-flight refresh. */
+    refresh(expiredToken: string): Promise<string | null>;
+}
 /** SDK-owned token provider: client-credentials service tokens + anonymous session. */
 declare class DefaultTokenProvider implements TokenProvider {
     private readonly cfg;
@@ -290,6 +317,8 @@ interface HttpClientOptions {
     };
     /** Override the retry backoff delay (ms → Promise). Defaults to a real timer. */
     sleep?: (ms: number) => Promise<void>;
+    /** Opt-in customer-token refresher registry (off unless a refresher is set). */
+    customerRefresh?: CustomerRefreshRegistry;
 }
 /** Fetch wrapper: auth resolution, JSON parsing, typed error mapping, logging. */
 declare class HttpClient {
@@ -341,4 +370,4 @@ interface PaginatedItems<T> {
  */
 declare function iterateAll<T>(fetchPage: (pageNumber: number) => Promise<PaginatedItems<T>>, start?: number): AsyncIterable<T>;
 
-export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, DefaultTokenProvider as d, type HttpClientOptions as e, LevelResolver as f, type LogFields as g, type LogLevel as h, type Logger as i, type LoggerConfig as j, type LoggerObjectConfig as k, type ResolvedConfig as l, type ServiceName as m, type StorefrontCredentials as n, auth as o, createConsoleLogger as p, createNoopLogger as q, iterateAll as r, redact as s, resolveToken as t, validateConfig as v };
+export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type HttpClientOptions as g, LevelResolver as h, type LogFields as i, type LogLevel as j, type Logger as k, type LoggerConfig as l, type LoggerObjectConfig as m, type ResolvedConfig as n, type ServiceName as o, type StorefrontCredentials as p, auth as q, createConsoleLogger as r, createNoopLogger as s, iterateAll as t, redact as u, resolveToken as v, validateConfig as w };

package/dist/{context-CgUWXqEt.d.ts → context-DJDTlhLW.d.ts}

@@ -161,6 +161,19 @@ type AuthContext = {
     kind: "raw";
     token: string;
 };
+/**
+ * Supplies a fresh customer token when a `customer`-kind request 401s. The host
+ * (e.g. EmporixProvider) implements this; the SDK never refreshes the
+ * caller-owned customer token unless a refresher is registered.
+ */
+interface CustomerTokenRefresher {
+    /**
+     * Called on a `customer`-kind 401. Receives the token that just failed;
+     * returns a fresh customer token to retry with, or `null` to give up (the
+     * 401 then propagates as EmporixAuthError).
+     */
+    refresh(expiredToken: string): Promise<string | null>;
+}
 /** An obtained anonymous storefront session. */
 interface AnonymousSession {
     accessToken: string;
@@ -232,6 +245,20 @@ declare const auth: {
 };
 /** Resolves an {@link AuthContext} to a concrete bearer token. */
 declare function resolveToken(ctx: AuthContext, provider: TokenProvider): Promise<string>;
+/**
+ * Late-bindable, single-flight holder for an optional
+ * {@link CustomerTokenRefresher}. Single-flight is required because Emporix
+ * rotates the refresh token on each refresh — concurrent refreshes would
+ * invalidate each other. Off (returns `null`) until a refresher is set.
+ */
+declare class CustomerRefreshRegistry {
+    private refresher;
+    private inflight;
+    set(refresher: CustomerTokenRefresher | null): void;
+    get enabled(): boolean;
+    /** Concurrent callers share one in-flight refresh. */
+    refresh(expiredToken: string): Promise<string | null>;
+}
 /** SDK-owned token provider: client-credentials service tokens + anonymous session. */
 declare class DefaultTokenProvider implements TokenProvider {
     private readonly cfg;
@@ -290,6 +317,8 @@ interface HttpClientOptions {
     };
     /** Override the retry backoff delay (ms → Promise). Defaults to a real timer. */
     sleep?: (ms: number) => Promise<void>;
+    /** Opt-in customer-token refresher registry (off unless a refresher is set). */
+    customerRefresh?: CustomerRefreshRegistry;
 }
 /** Fetch wrapper: auth resolution, JSON parsing, typed error mapping, logging. */
 declare class HttpClient {
@@ -341,4 +370,4 @@ interface PaginatedItems<T> {
  */
 declare function iterateAll<T>(fetchPage: (pageNumber: number) => Promise<PaginatedItems<T>>, start?: number): AsyncIterable<T>;
 
-export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, DefaultTokenProvider as d, type HttpClientOptions as e, LevelResolver as f, type LogFields as g, type LogLevel as h, type Logger as i, type LoggerConfig as j, type LoggerObjectConfig as k, type ResolvedConfig as l, type ServiceName as m, type StorefrontCredentials as n, auth as o, createConsoleLogger as p, createNoopLogger as q, iterateAll as r, redact as s, resolveToken as t, validateConfig as v };
+export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type HttpClientOptions as g, LevelResolver as h, type LogFields as i, type LogLevel as j, type Logger as k, type LoggerConfig as l, type LoggerObjectConfig as m, type ResolvedConfig as n, type ServiceName as o, type StorefrontCredentials as p, auth as q, createConsoleLogger as r, createNoopLogger as s, iterateAll as t, redact as u, resolveToken as v, validateConfig as w };

package/dist/customer-groups.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.cjs';
 
 /**
  * Hand-written mirror of the minimal IAM Service group shape needed for

package/dist/customer-groups.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, b as AuthContext } from './context-DJDTlhLW.js';
 
 /**
  * Hand-written mirror of the minimal IAM Service group shape needed for

package/dist/customer.d.cts

@@ -1,4 +1,4 @@
-import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-CgUWXqEt.cjs';
+import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-DJDTlhLW.cjs';
 
 type AccountId = {
     /**

package/dist/customer.d.ts

@@ -1,4 +1,4 @@
-import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-CgUWXqEt.js';
+import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-DJDTlhLW.js';
 
 type AccountId = {
     /**

package/dist/index.cjs

@@ -366,6 +366,26 @@ async function resolveToken(ctx, provider) {
       return ctx.token;
   }
 }
+var CustomerRefreshRegistry = class {
+  refresher = null;
+  inflight = null;
+  set(refresher) {
+    this.refresher = refresher;
+  }
+  get enabled() {
+    return this.refresher !== null;
+  }
+  /** Concurrent callers share one in-flight refresh. */
+  refresh(expiredToken) {
+    if (!this.refresher) return Promise.resolve(null);
+    if (this.inflight) return this.inflight;
+    const p = Promise.resolve(this.refresher.refresh(expiredToken)).finally(() => {
+      this.inflight = null;
+    });
+    this.inflight = p;
+    return p;
+  }
+};
 var DefaultTokenProvider = class {
   constructor(cfg) {
     this.cfg = cfg;
@@ -567,8 +587,10 @@ var HttpClient = class {
     const sdkManaged = o.auth.kind === "service" || o.auth.kind === "anonymous";
     const maxAttempts = this.opts.retry.maxAttempts;
     let reauthed = false;
+    let customerToken = o.auth.kind === "customer" ? o.auth.token : void 0;
+    let customerReauthed = false;
     for (let attempt = 1; ; attempt++) {
-      const token = await resolveToken(o.auth, this.opts.provider);
+      const token = customerToken ?? await resolveToken(o.auth, this.opts.provider);
       log.debug("http request", {
         authKind: o.auth.kind,
         method: o.method,
@@ -620,6 +642,15 @@ var HttpClient = class {
           log.warn("sdk-managed 401, re-authing once", { authKind: o.auth.kind });
           continue;
         }
+        if (o.auth.kind === "customer" && !customerReauthed && this.opts.customerRefresh?.enabled) {
+          customerReauthed = true;
+          const fresh = await this.opts.customerRefresh.refresh(customerToken);
+          if (fresh) {
+            customerToken = fresh;
+            log.warn("customer 401, refreshed once", { authKind: o.auth.kind });
+            continue;
+          }
+        }
         throw errorFromResponse(res.status, `${o.method} ${o.path} \u2192 401`, parsed);
       }
       const retryable = res.status >= 500 || res.status === 429;
@@ -4942,7 +4973,7 @@ var ApprovalService = class {
 };
 
 // package.json
-var version = "2.5.0";
+var version = "2.6.0";
 
 // src/version.ts
 var SDK_VERSION = version;
@@ -5009,6 +5040,7 @@ var EmporixClient = class {
    */
   config;
   resolver;
+  customerRefresh;
   constructor(config) {
     const cfg = validateConfig(config);
     this.tenant = cfg.tenant;
@@ -5030,6 +5062,8 @@ var EmporixClient = class {
     });
     const tokenProvider = cfg.tokenProvider ?? new DefaultTokenProvider(cfg);
     this.tokenProvider = tokenProvider;
+    const customerRefresh = new CustomerRefreshRegistry();
+    this.customerRefresh = customerRefresh;
     const mk = (service) => ({
       tenant: cfg.tenant,
       tokenProvider,
@@ -5039,7 +5073,8 @@ var EmporixClient = class {
         provider: tokenProvider,
         logger: root.child({ service: "http" }),
         retry: cfg.retry,
-        timeouts: cfg.timeouts
+        timeouts: cfg.timeouts,
+        customerRefresh
       })
     });
     this.customers = new CustomerService(mk("customer"));
@@ -5098,6 +5133,15 @@ var EmporixClient = class {
   getLogLevel(service) {
     return this.resolver.get(service);
   }
+  /**
+   * Registers (or clears with `null`) a customer-token refresher. When set, a
+   * `customer`-kind 401 triggers one refresh-and-retry. Off by default — the
+   * customer token stays caller-owned. The React `EmporixProvider` wires this
+   * automatically via `autoRefreshCustomerToken`.
+   */
+  setCustomerTokenRefresher(refresher) {
+    this.customerRefresh.set(refresher);
+  }
 };
 
 exports.AiService = AiService;
@@ -5116,6 +5160,7 @@ exports.CouponService = CouponService;
 exports.CurrencyService = CurrencyService;
 exports.CustomerAdminService = CustomerAdminService;
 exports.CustomerGroupsService = CustomerGroupsService;
+exports.CustomerRefreshRegistry = CustomerRefreshRegistry;
 exports.CustomerService = CustomerService;
 exports.DEFAULT_HOST = DEFAULT_HOST;
 exports.DefaultTokenProvider = DefaultTokenProvider;