@viu/emporix-sdk 4.0.1 → 4.2.0

package/dist/cart.d.ts

@@ -739,6 +739,54 @@ type CreatedCart = {
     cartId: string;
     yrn: Yrn;
 };
+type Discount = {
+    /**
+     * Discount unique identifier.
+     */
+    id?: string;
+    couponYrn?: Yrn;
+    /**
+     * Discount code generated when a discount coupon is created through the Coupon Service.
+     */
+    code: string;
+    /**
+     * Three-letter currency code, compliant with the ISO 4217 standard.
+     */
+    currency?: string;
+    /**
+     * Discount expressed as fixed amount.
+     */
+    amount?: number;
+    /**
+     * Discount displayed name.
+     */
+    name?: string;
+    /**
+     * Discount expressed as a percentage of the price.
+     */
+    discountRate?: number;
+    /**
+     * Determines whether the coupon is applied to the total or subtotal value of the order.
+     */
+    discountCalculationType?: 'SUBTOTAL' | 'TOTAL';
+    /**
+     * Links to Coupon Service endpoints used to validate and redeem the discount.
+     */
+    links?: Array<Link>;
+    /**
+     * Calculation type specifies how the discount should be calculated. It can be set to one of the following:
+     * * `ApplyDiscountBeforeTax`
+     * * `ApplyDiscountAfterTax`
+     *
+     * The field is **deprecated** and is not used in calculatedPrice fields. The calculated price takes into account site's settings
+     * where:
+     * * `includesTax=true` results in `ApplyDiscountAfterTax`
+     * * `includesTax=false` results in `ApplyDiscountBeforeTax`
+     *
+     * @deprecated
+     */
+    calculationType?: 'ApplyDiscountBeforeTax' | 'ApplyDiscountAfterTax';
+};
 /**
  * Discount details.
  */
@@ -1287,6 +1335,186 @@ type CartItemsBatchUpdateRequest = Array<CartItemRequest & {
     [key: string]: unknown;
 }>;
 type BatchResponse = Array<SingleBatchResponse>;
+/**
+ * Body of `POST /cart/{tenant}/carts/{cartId}/execute`. Between 1 and 10 commands.
+ */
+type ExecuteRequest = {
+    /**
+     * Commands to run sequentially. Maximum 10. Request duration is approximately the sum of the chained commands.
+     *
+     * Each item needs `type`. `data` is the REST request body and is omitted for commands that have no body. The cart id is the path parameter. `options` holds remaining path and query equivalents (`itemId`, `partial`, `expandCalculation`, `zipCode`, `countryCode`, `resourceVersion`, `codes`, `discountIndex`).
+     *
+     */
+    commands: Array<ExecuteCommand>;
+};
+/**
+ * One operation in the execute chain. `type` selects the REST equivalent. `data` is that endpoint’s request body. The cart id is the execute path parameter. `options` fields are remaining path and query equivalents (`itemId`, `partial`, `expandCalculation`, `zipCode`, `countryCode`, `resourceVersion`, `codes`, `discountIndex`).
+ *
+ * Session and legal-entity identity are request headers, not command fields.
+ *
+ */
+type ExecuteCommand = {
+    /**
+     * Operation to run.
+     *
+     * Possible values:
+     * * `AddCartItem`
+     * * `UpdateCartItem`
+     * * `DeleteCartItem`
+     * * `DeleteCartItems`
+     * * `GetCart`
+     * * `AddCartItemsBatch`
+     * * `UpdateCartItemsBatch`
+     * * `UpdateCart`
+     * * `ApplyCartDiscount`
+     * * `GetCartDiscounts`
+     * * `DeleteCartDiscounts`
+     * * `DeleteCartDiscount`
+     * * `RefreshCart`
+     * * `ValidateCart`
+     *
+     */
+    type: 'AddCartItem' | 'UpdateCartItem' | 'DeleteCartItem' | 'DeleteCartItems' | 'GetCart' | 'AddCartItemsBatch' | 'UpdateCartItemsBatch' | 'UpdateCart' | 'ApplyCartDiscount' | 'GetCartDiscounts' | 'DeleteCartDiscounts' | 'DeleteCartDiscount' | 'RefreshCart' | 'ValidateCart';
+    /**
+     * Request body of the equivalent REST operation.
+     *
+     * * `AddCartItem` – cart item body
+     * * `UpdateCartItem` – cart item update body
+     * * `AddCartItemsBatch` – list of cart item bodies
+     * * `UpdateCartItemsBatch` – list of cart item updates (maximum 50)
+     * * `UpdateCart` – cart update body
+     * * `ApplyCartDiscount` – discount body
+     *
+     * Omit `data` for `GetCart`, `RefreshCart`, `ValidateCart`, deletes, `GetCartDiscounts`, `DeleteCartDiscounts`, and `DeleteCartDiscount`.
+     *
+     * The service selects the body type from `type`. A single item body is an object. Batch commands send an array.
+     *
+     */
+    data?: {
+        [key: string]: unknown;
+    } | Array<{
+        [key: string]: unknown;
+    }>;
+    options?: ExecuteCommandOptions;
+};
+/**
+ * Remaining path and query equivalents for the command. Required fields depend on `type`. The cart id is the execute path parameter, not an option.
+ */
+type ExecuteCommandOptions = {
+    /**
+     * Cart item unique identifier generated when the product is added to the cart.
+     *
+     * Required for `UpdateCartItem` and `DeleteCartItem`.
+     *
+     */
+    itemId?: string;
+    /**
+     * When `true`, only the provided item or batch fields are updated. Same default as the REST `partial` query parameter (`false`).
+     *
+     * Used by `UpdateCartItem` and `UpdateCartItemsBatch`.
+     *
+     */
+    partial?: boolean;
+    /**
+     * When `true`, `GetCart` returns a fully calculated cart. Same default as the REST `expandCalculation` query parameter (`true`).
+     *
+     * Used by `GetCart`.
+     *
+     */
+    expandCalculation?: boolean;
+    /**
+     * Zip code of the shipping address, used for tax calculations, shipping cost estimations, and pricing. Provide together with `countryCode` if either is specified.
+     *
+     * Used by `GetCart`.
+     *
+     */
+    zipCode?: string;
+    /**
+     * Two-letter country code of the shipping address. Provide together with `zipCode` if either is specified.
+     *
+     * Used by `GetCart`.
+     *
+     */
+    countryCode?: string;
+    /**
+     * Cart resource version used as If-Match for participating writes (`AddCartItem`, `UpdateCartItem`, `UpdateCart`, `ApplyCartDiscount`).
+     *
+     * * `versioning=skip` – ignored
+     * * `versioning=explicit` – required on every participating command (whole-request preflight)
+     * * `versioning=follow` – required to seed the first participating write; omit on later writes
+     *
+     * Extra `resourceVersion` on `GetCart`, `ValidateCart`, `RefreshCart`, deletes, and itemsBatch is ignored.
+     *
+     */
+    resourceVersion?: number;
+    /**
+     * Discount codes to remove. If omitted, `DeleteCartDiscounts` removes all discounts. Same meaning as the REST `codes` query parameter.
+     *
+     * Used by `DeleteCartDiscounts`.
+     *
+     */
+    codes?: Array<string>;
+    /**
+     * Index of the discount in the cart discounts array.
+     *
+     * Required for `DeleteCartDiscount`.
+     *
+     */
+    discountIndex?: string;
+};
+/**
+ * Body of a 207 execute response. Present only when the chain was accepted and executed.
+ */
+type ExecuteResponse = {
+    /**
+     * Ordered results for commands that ran. With `onError=fail`, the array stops after the first non-2xx command.
+     *
+     */
+    results: Array<ExecuteCommandResult>;
+};
+/**
+ * Result of one command in the execute chain. `data` matches the REST response body for that command.
+ */
+type ExecuteCommandResult = {
+    /**
+     * Zero-based index of the command in the request `commands` array.
+     */
+    index: number;
+    /**
+     * Command type that produced this result.
+     */
+    type: string;
+    /**
+     * HTTP status code of the equivalent REST operation.
+     */
+    code: number;
+    /**
+     * HTTP reason phrase that matches `code`.
+     */
+    status: string;
+    /**
+     * Response body of the equivalent REST operation. Omitted when that endpoint returns 204.
+     *
+     * A single-object body (`AddCartItem`, `GetCart`, `ApplyCartDiscount`, `ValidateCart`, or an error) is an object. `GetCartDiscounts`, `AddCartItemsBatch`, and `UpdateCartItemsBatch` return an array. Failures use the same error shape as REST (`code`, `status`, `message`).
+     *
+     */
+    data?: {
+        [key: string]: unknown;
+    } | Array<{
+        [key: string]: unknown;
+    }> | null;
+    /**
+     * Response headers for this command.
+     *
+     * When a participating write applied If-Match, this object contains `hybris-resource-version` set to the version after the write. `versioning=skip` does not send If-Match, so the header is absent.
+     *
+     * `AddCartItemsBatch` does not use this object for item locations. Each created item's `data[].headers.location` uses the same location as REST `POST .../itemsBatch`.
+     *
+     */
+    headers?: {
+        [key: string]: string;
+    };
+};
 /**
  * YRN
  *
@@ -1916,6 +2144,60 @@ type ValidationError = {
      */
     field?: string;
 };
+type PostCartExecuteData = {
+    body: ExecuteRequest;
+    headers?: {
+        /**
+         * Anonymous customer unique session identifier. Shared by every command in the chain. Commands cannot override this header.
+         *
+         */
+        'session-id'?: string;
+        /**
+         * Legal entity of the shopper context. Shared by every command in the chain. Commands cannot override this header. To act as a different legal entity, send another request.
+         *
+         */
+        'legal-entity-id'?: string;
+    };
+    path: {
+        /**
+         * Cart unique identifier generated when a cart is created.
+         */
+        cartId: string;
+        /**
+         * Your Emporix tenant name.
+         *
+         * **Note**: The tenant should always be written in lowercase.
+         *
+         */
+        tenant: string;
+    };
+    query?: {
+        /**
+         * Controls whether the chain stops after the first non-2xx command.
+         *
+         * Possible values:
+         * * `fail` – Stop after the first non-2xx command. `results` contains only the commands that ran, including the failed one.
+         * * `resume` – Run every command. Later commands still see earlier successful mutations.
+         *
+         * An invalid value returns **400** for the whole request before any command runs.
+         *
+         */
+        onError?: 'fail' | 'resume';
+        /**
+         * If-Match strategy for participating writes (`AddCartItem`, `UpdateCartItem`, `UpdateCart`, `ApplyCartDiscount`).
+         *
+         * Possible values:
+         * * `skip` – Never pass a version. Ignore `options.resourceVersion` if present.
+         * * `explicit` – Every participating command must send `options.resourceVersion`. Missing version on any participating write returns **400** for the whole request (preflight). This is not `skip`.
+         * * `follow` – Seed from the first participating write, then use that cursor for later writes. After the cursor exists, a successful `RefreshCart`, delete, or itemsBatch also bumps it.
+         *
+         * An invalid value returns **400** for the whole request before any command runs.
+         *
+         */
+        versioning?: 'skip' | 'explicit' | 'follow';
+    };
+    url: '/cart/{tenant}/carts/{cartId}/execute';
+};
 
 /** A cart as returned by the Cart service (all generated fields). */
 type Cart = Cart$1;
@@ -1949,6 +2231,50 @@ type CartUpdateInput = UpdateCart;
 type CartDiscount = DiscountResponse;
 /** Lead-time and non-delivery-time restrictions for a cart (`GET …/dtRestrictions`). */
 type CartDeliveryRestrictions = CartDtRestrictions;
+/** Body for applying a discount (`POST /carts/{id}/discounts`, generated). */
+type CartDiscountInput = Discount;
+/**
+ * Request body per command type of {@link CartService.execute}. The spec states
+ * this only in prose — its `data` is an untyped object — so it is the one
+ * hand-written piece. A command type missing here (one Emporix adds after this
+ * was written) keeps the spec's untyped `data` and still works.
+ */
+interface CartCommandBodies {
+    AddCartItem: CartItemInput;
+    UpdateCartItem: CartItemUpdate;
+    AddCartItemsBatch: CartItemInput[];
+    UpdateCartItemsBatch: CartItemsBatchUpdateInput;
+    UpdateCart: CartUpdateInput;
+    ApplyCartDiscount: CartDiscountInput;
+}
+/**
+ * One command of a {@link CartService.execute} chain: `type` picks the REST
+ * operation, `data` is that operation's request body, `options` holds its
+ * remaining path and query parameters (`itemId`, `partial`, `expandCalculation`,
+ * `zipCode`, `countryCode`, `resourceVersion`, `codes`, `discountIndex`). The
+ * cart id is the `execute` path parameter, never a command field.
+ *
+ * `options` is the generated type, where every field is optional: `itemId`
+ * (`UpdateCartItem`, `DeleteCartItem`) and `discountIndex` (`DeleteCartDiscount`)
+ * are required by the server, which reports a missing one on that command.
+ */
+type CartCommand = {
+    [T in ExecuteCommand["type"]]: Omit<ExecuteCommand, "type" | "data"> & {
+        type: T;
+    } & (T extends keyof CartCommandBodies ? {
+        data: CartCommandBodies[T];
+    } : Pick<ExecuteCommand, "data">);
+}[ExecuteCommand["type"]];
+/** `onError` and `versioning` of {@link CartService.execute} — both query parameters (generated). */
+type CartExecuteOptions = NonNullable<PostCartExecuteData["query"]>;
+/** The `207` body of {@link CartService.execute}: one result per command that ran, in order (generated). */
+type CartExecuteResult = ExecuteResponse;
+/**
+ * One entry of {@link CartExecuteResult}`.results`: `code`/`status` of the
+ * equivalent REST call, and as `data` its response body — or its error body
+ * when `code` is not 2xx; absent for a 204 (generated).
+ */
+type CartCommandResult = ExecuteCommandResult;
 /** Cart operations. Every method requires an explicit customer/anonymous context. */
 declare class CartService {
     private readonly ctx;
@@ -2116,6 +2442,31 @@ declare class CartService {
     removeDiscountByIndex(cartId: string, discountIndex: string, auth: AuthContext): Promise<Cart>;
     /** Retrieves the cart's lead-time and non-delivery-time restrictions (`GET /carts/{cartId}/dtRestrictions`). */
     getDeliveryRestrictions(cartId: string, auth: AuthContext): Promise<CartDeliveryRestrictions>;
+    /**
+     * Runs up to 10 cart commands on this cart in one request, in order
+     * (`POST /carts/{cartId}/execute`). The typical chain is `AddCartItem` then
+     * `GetCart`: the calculated cart comes back without a second round trip.
+     *
+     * - `onError: "fail"` (default) stops at the first command that does not
+     *   answer 2xx and **throws the error that command's REST call would have
+     *   thrown** — an `EmporixNotFoundError` for a 404, … — with the command's
+     *   error body. The commands before it **have already been applied**.
+     * - `onError: "resume"` runs every command and resolves with all results;
+     *   check each `code`.
+     * - A `400` for the whole request (no commands or more than 10, an unknown
+     *   type, `versioning: "explicit"` without a `resourceVersion`) means no
+     *   command ran.
+     *
+     * The request takes about as long as its commands together — size the
+     * client's `timeouts.readMs` for long chains. It is never retried: a replay
+     * would apply the writes twice.
+     *
+     * `auth` is forwarded unguarded: a customer or anonymous token works on the
+     * shopper's own cart; a service token needs `cart.cart_manage`, plus
+     * `cart.cart_manage_external_prices` when a command carries an external
+     * price, product, fee or discount.
+     */
+    execute(cartId: string, commands: CartCommand[], auth: AuthContext, opts?: CartExecuteOptions): Promise<CartExecuteResult>;
 }
 
-export { type Cart, type CartAddress, type CartCreated, type CartDeliveryRestrictions, type CartDiscount, type CartItem, type CartItemBatchEntry, type CartItemInput, type CartItemUpdate, type CartItemsBatchResponse, type CartItemsBatchUpdateInput, type CartItemsBatchUpdateResult, type CartSearchInput, CartService, type CartSummary, type CartUpdateInput, type CartValidationResult, type CreateCartInput };
+export { type Cart, type CartAddress, type CartCommand, type CartCommandBodies, type CartCommandResult, type CartCreated, type CartDeliveryRestrictions, type CartDiscount, type CartDiscountInput, type CartExecuteOptions, type CartExecuteResult, type CartItem, type CartItemBatchEntry, type CartItemInput, type CartItemUpdate, type CartItemsBatchResponse, type CartItemsBatchUpdateInput, type CartItemsBatchUpdateResult, type CartSearchInput, CartService, type CartSummary, type CartUpdateInput, type CartValidationResult, type CreateCartInput };

package/dist/cart.js

@@ -1,4 +1,4 @@
-export { CartService } from './chunk-YVZ6GOLE.js';
+export { CartService } from './chunk-S2ERKGYL.js';
 import './chunk-UWGGF4MC.js';
 //# sourceMappingURL=cart.js.map
 //# sourceMappingURL=cart.js.map

package/dist/{chunk-QQMLN76U.js → chunk-2OTFVTG6.js}

@@ -1,3 +1,5 @@
+import { splitQuery, SEARCH_PAGING } from './chunk-ZWJUDXTK.js';
+
 // src/services/companies.ts
 var CompaniesService = class {
   constructor(ctx) {
@@ -57,14 +59,15 @@ var CompaniesService = class {
   }
   /**
    * Searches legal entities via `POST /legal-entities/search` with an Emporix
-   * `q`-syntax filter body. Requires the same read scope as {@link listMine}.
+   * `q`-syntax filter body; paging, sort and fields go in the query string.
+   * Requires the same read scope as {@link listMine}.
    */
   async search(query, auth) {
     return this.ctx.http.request({
       method: "POST",
       path: `${this.base()}/search`,
       auth,
-      body: query,
+      ...splitQuery(query, SEARCH_PAGING),
       idempotent: true
       // pure read over POST — safe to replay on 5xx/429
     });
@@ -83,5 +86,5 @@ var CompaniesService = class {
 };
 
 export { CompaniesService };
-//# sourceMappingURL=chunk-QQMLN76U.js.map
-//# sourceMappingURL=chunk-QQMLN76U.js.map
+//# sourceMappingURL=chunk-2OTFVTG6.js.map
+//# sourceMappingURL=chunk-2OTFVTG6.js.map

package/dist/chunk-2OTFVTG6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/companies.ts"],"names":[],"mappings":";;;AAoBO,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,qBAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,qBAAA,EAAwB,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,eAAA,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAA2C;AACxD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,aAAA,EAAuB,IAAA,EAAyC;AACxE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,KAAA,EAA0B,IAAA,EAA4C;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAA,CACJ,aAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAqB;AAAA,MACxC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,aAAA,EAAuB,IAAA,EAAkC;AACpE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,CAAO,KAAA,EAA+B,IAAA,EAA2C;AACrF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,OAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,GAAG,UAAA,CAAW,KAAA,EAAO,aAAa,CAAA;AAAA,MAClC,UAAA,EAAY;AAAA;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAA,CAAgB,aAAA,EAAuB,IAAA,EAA2C;AACtF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAuB;AAAA,MAC1C,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,aAAa,CAAA,iBAAA,CAAA;AAAA,MACrC;AAAA,KACD,CAAA;AAAA,EACH;AACF","file":"chunk-2OTFVTG6.js","sourcesContent":["import type { ClientContext } from \"../core/context\";\nimport type { AuthContext } from \"../core/auth\";\nimport { SEARCH_PAGING, splitQuery, type SearchPaging } from \"../core/search\";\nimport type {\n  LegalEntity,\n  LegalEntityCreate,\n  LegalEntityUpdate,\n} from \"../generated/customer-management\";\n\n/** Input for `companies.search`: an Emporix `q`-syntax filter (body) plus {@link SearchPaging} (query). */\nexport type LegalEntitySearchInput = { q?: string } & SearchPaging;\n\n/**\n * Storefront-customer access to Legal Entities.\n *\n * `listMine`/`get` require `customermanagement.legalentity_read_own` on the\n * customer token. `create`/`update`/`delete` require the corresponding\n * `_manage` scopes — typically only granted to Admin-group customers; a 403\n * surfaces as `EmporixInsufficientScopeError`.\n */\nexport class CompaniesService {\n  static readonly channel = \"customer-management\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/customer-management/${this.ctx.tenant}/legal-entities`;\n  }\n\n  /** Lists the legal entities the calling customer is assigned to. */\n  async listMine(auth: AuthContext): Promise<LegalEntity[]> {\n    return this.ctx.http.request<LegalEntity[]>({\n      method: \"GET\",\n      path: this.base(),\n      auth,\n    });\n  }\n\n  /** Fetches a single legal entity by id. */\n  async get(legalEntityId: string, auth: AuthContext): Promise<LegalEntity> {\n    return this.ctx.http.request<LegalEntity>({\n      method: \"GET\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n    });\n  }\n\n  /** Creates a legal entity. Requires `customermanagement.legalentity_manage`. */\n  async create(input: LegalEntityCreate, auth: AuthContext): Promise<{ id: string }> {\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input,\n    });\n  }\n\n  /**\n   * Updates a legal entity via `PUT …/legal-entities/{id}` (upsert / full\n   * replace). The live API rejects `PATCH` on this path with 405; send the\n   * complete entity, as the server replaces the resource. The body stays typed\n   * as a partial of `LegalEntityUpdate` for backward compatibility.\n   */\n  async update(\n    legalEntityId: string,\n    patch: Partial<LegalEntityUpdate>,\n    auth: AuthContext,\n  ): Promise<LegalEntity> {\n    return this.ctx.http.request<LegalEntity>({\n      method: \"PUT\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n      body: patch,\n    });\n  }\n\n  /** Deletes a legal entity (async cascade on the server). */\n  async delete(legalEntityId: string, auth: AuthContext): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${legalEntityId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Searches legal entities via `POST /legal-entities/search` with an Emporix\n   * `q`-syntax filter body; paging, sort and fields go in the query string.\n   * Requires the same read scope as {@link listMine}.\n   */\n  async search(query: LegalEntitySearchInput, auth: AuthContext): Promise<LegalEntity[]> {\n    return this.ctx.http.request<LegalEntity[]>({\n      method: \"POST\",\n      path: `${this.base()}/search`,\n      auth,\n      ...splitQuery(query, SEARCH_PAGING),\n      idempotent: true, // pure read over POST — safe to replay on 5xx/429\n    });\n  }\n\n  /**\n   * Retrieves a legal entity's chain of parent entities\n   * (`GET /legal-entities/{id}/parent-hierarchy`).\n   */\n  async parentHierarchy(legalEntityId: string, auth: AuthContext): Promise<LegalEntity[]> {\n    return this.ctx.http.request<LegalEntity[]>({\n      method: \"GET\",\n      path: `${this.base()}/${legalEntityId}/parent-hierarchy`,\n      auth,\n    });\n  }\n}\n"]}

package/dist/{chunk-CSYXGTOH.js → chunk-5MPL4XBD.js}

@@ -15,7 +15,10 @@ var MediaService = class {
   base() {
     return `/media/${this.ctx.tenant}/assets`;
   }
-  /** Create an asset. BLOB uploads via multipart; LINK via JSON. */
+  /**
+   * Create an asset. BLOB uploads via multipart (max 30 MB); LINK via JSON.
+   * {@link startUploadSession} sends the file straight to storage instead.
+   */
   async create(input, auth = SERVICE) {
     if (input.kind === "blob") {
       const fd = new FormData();
@@ -73,7 +76,7 @@ var MediaService = class {
    *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,
    *   or `url` changes.
    * - `{ kind: "blob", file, body }` — replaces the BLOB file content
-   *   (max 10MB) AND patches metadata in the same request. Sends
+   *   (max 30 MB) AND patches metadata in the same request. Sends
    *   `multipart/form-data`.
    *
    * `type` and `access` are immutable per Emporix — they must match the
@@ -147,6 +150,12 @@ var MediaService = class {
    *   an `ArrayBuffer` transparently; binary Content-Types are passed
    *   through verbatim.
    *
+   * Emporix recommends {@link getDownloadUrl} for every download: here the file
+   * passes through the Media API. A `413` means the asset's known size exceeds
+   * the streaming limit (30 MB by default) — only {@link getDownloadUrl} can
+   * serve it. A `409` means the asset is still `PENDING` from a direct upload
+   * whose file has not reached storage.
+   *
    * Implementation note: uses `redirect: "manual"` so the redirect-location
    * is observable. In Node.js this works; in a browser the redirect Location
    * is intentionally hidden by fetch — there, `PUBLIC` downloads will
@@ -202,6 +211,61 @@ var MediaService = class {
     }
     throw errorFromResponse(res.status, `GET ${path} \u2192 ${res.status}`, parsed);
   }
+  /**
+   * Get a URL that serves the stored file straight from storage
+   * (`GET /assets/{assetId}/download-url`). Emporix recommends it for every
+   * download: the file never passes through the Media API, there is no size
+   * limit, and the URL can be handed to a browser as it is.
+   *
+   * - `PRIVATE` BLOB → `provider: "GCS"`, a signed Google Cloud Storage URL that
+   *   works without an Emporix token until `expiresAt` (15 minutes by default).
+   * - `PUBLIC` BLOB → `provider: "CLOUDINARY"`, the permanent URL.
+   * - `LINK` → `provider: "LINK"`, the stored URL.
+   *
+   * `disposition` (`attachment` by default, or `inline`) affects private URLs
+   * only. Unlike {@link startUploadSession}, this works whether or not direct
+   * upload is enabled for the tenant. A `409` means a direct upload is still
+   * `PENDING` and its file has not reached storage; once it has, this call
+   * completes the asset before answering.
+   */
+  async getDownloadUrl(assetId, query = {}, auth = SERVICE) {
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${encodeURIComponent(assetId)}/download-url`,
+      auth,
+      query: { ...query }
+    });
+  }
+  /**
+   * Start a direct upload of a `BLOB` asset (`POST /assets/upload-session`,
+   * `201`). Emporix creates the asset as `PENDING` — `id` is its id — and
+   * returns where to send the file. **This method does not send it**:
+   *
+   * - `upload.method === "PUT"` (a `PRIVATE` asset, `uploadType: "put"` or
+   *   omitted): `PUT` the file to `upload.url` with every `upload.headers` entry.
+   * - `upload.method === "POST"` (every `PUBLIC` asset, or `uploadType: "form"`):
+   *   a multipart `POST` to `upload.url` with every `upload.fields` entry
+   *   unchanged and the file part last.
+   *
+   * That request goes to Google Cloud Storage or Cloudinary, not to Emporix, so
+   * it must not carry the Emporix token — which is also why a browser can make
+   * it. The asset turns `READY` once storage confirms; until then, calls that
+   * need the file answer `409`. The instruction is valid for 15 minutes (GCS) or
+   * an hour (Cloudinary), and an unused session expires at `expiresAt`.
+   *
+   * Direct upload is enabled per tenant by Emporix Support. Without it the call
+   * throws an `EmporixForbiddenError` whose `body.message` is `direct upload is
+   * not enabled for this tenant`, and nothing is created — the same status as a
+   * missing scope, so read the message.
+   */
+  async startUploadSession(input, auth = SERVICE) {
+    return this.ctx.http.request({
+      method: "POST",
+      path: `${this.base()}/upload-session`,
+      auth,
+      body: input
+    });
+  }
   /** Multipart upload sugar: builds `AssetCreateBlob` from input. */
   async uploadFile(input, auth = SERVICE) {
     const body = {
@@ -274,5 +338,5 @@ var MediaService = class {
 var _internalMedia = { isProductRef };
 
 export { MediaService, _internalMedia };
-//# sourceMappingURL=chunk-CSYXGTOH.js.map
-//# sourceMappingURL=chunk-CSYXGTOH.js.map
+//# sourceMappingURL=chunk-5MPL4XBD.js.map
+//# sourceMappingURL=chunk-5MPL4XBD.js.map

package/dist/chunk-5MPL4XBD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/media.ts"],"names":["text"],"mappings":";;;;AA6EA,IAAM,OAAA,GAAuB,EAAE,IAAA,EAAM,SAAA,EAAU;AAE/C,SAAS,YAAA,CAAa,GAAe,SAAA,EAA4B;AAC/D,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,EAAA,KAAO,SAAA;AAC1C;AAMO,IAAM,eAAN,MAAmB;AAAA,EAExB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,OAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,CACJ,KAAA,EAGA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAA,CACJ,KAAA,GAAyB,EAAC,EAC1B,OAAoB,OAAA,EACY;AAChC,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,EAAA;AAInC,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,KAAA;AAChC,IAAA,OAAO,WAAA;AAAA,MACL,KAAK,GAAA,CAAI,IAAA;AAAA,MACT;AAAA,QACE,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,YAAY,QAAA;AAAS,OACzC;AAAA,MACA,EAAE,UAAA,EAAY,QAAA,EAAU,GAAI,UAAA,KAAe,SAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAG,KAC9E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAyB;AACtE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,MAAA,CACJ,OAAA,EACA,KAAA,EAGA,OAAoB,OAAA,EACJ;AAChB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,QAC/B,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,KAAA,CAAM,OAAA,EAAiB,GAAA,EAAiB,OAAoB,OAAA,EAAwB;AACxF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,OAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MACnD,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAwB;AACxE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,QAAA,CACJ,OAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,SAAA,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,UAAA;AAAA,MAC9B,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAAA,MAC5B,EAAE,UAAU,QAAA;AAAS,KACvB;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,gBAAA,EAAmB,IAAI,MAAM,CAAA,mCAAA,CAAA;AAAA,UAC7B,GAAA,CAAI;AAAA,SACN;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAA,EAAI;AAAA,IACjC;AAGA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AACxC,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,MAAA;AACvD,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAIzC,QAAA,MAAMA,KAAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,MAAM,GAAA,GAAM,KAAKA,KAAI,CAAA;AACrB,QAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,QAAA,IAAA,GAAO,GAAA,CAAI,MAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,GAAO,MAAM,IAAI,WAAA,EAAY;AAAA,MAC/B;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA;AAAA,QACA,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB;AAAC,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,MAAA,GAAkB,MAAA;AACtB,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC1B,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,GAAS,IAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,MAAM,iBAAA,CAAkB,IAAI,MAAA,EAAQ,CAAA,IAAA,EAAO,IAAI,CAAA,QAAA,EAAM,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,cAAA,CACJ,OAAA,EACA,QAA+B,EAAC,EAChC,OAAoB,OAAA,EACO;AAC3B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA0B;AAAA,MAC7C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,kBAAA,CAAmB,OAAO,CAAC,CAAA,aAAA,CAAA;AAAA,MACnD,IAAA;AAAA,MACA,KAAA,EAAO,EAAE,GAAG,KAAA;AAAM,KACnB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAM,kBAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACS;AAC7B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA4B;AAAA,MAC/C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,eAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,KAAA,EAOA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,WAAA,CACJ,OAAA,EACA,KAAA,EAOA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,OAAA,KAAY,MAAA,GAClB,EAAE,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ,EAAE,GACvC;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,IAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD;AAAC,KACP;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,EAAE,MAAM,MAAA,EAAQ,IAAA,IAAQ,IAAI,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,eAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,KAAM,aAAa,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,OAAO,CAAA;AAC3D,IAAA,MAAM,IAAA,GAAqB,CAAC,GAAG,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,SAAA,EAAW,CAAA;AAGzE,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,iBAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,CAAA,EAAG,SAAS,CAAC,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAC1C,IAAA,MAAM,QAAQ,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,QAAQ,IAAA,EAAK;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAO,OAAA,EAAS,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAM,EAAG,IAAI,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,GAAoB,OAAA,EACY;AAChC,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,WAAA,EAAa,SAAA,IAAa,IAAI,CAAA;AAAA,EACnD;AACF;AAIO,IAAM,cAAA,GAAiB,EAAE,YAAA","file":"chunk-5MPL4XBD.js","sourcesContent":["import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport { requestPage } from \"../core/paged\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixError, errorFromResponse } from \"../core/errors\";\nimport type {\n  AssetCreateBlob,\n  AssetCreateLink,\n  AssetUpdateBlob,\n  AssetUpdateLink,\n  DownloadUrl,\n  GetAsset,\n  GetMediaRetrieveDownloadUrlData,\n  PatchOperation,\n  RefId,\n  UploadSession,\n  UploadSessionRequest,\n} from \"../generated/media\";\n\n/** Generated media types (caller sends the exact wire shape). */\nexport type AssetCreateBlobInput = AssetCreateBlob;\nexport type AssetCreateLinkInput = AssetCreateLink;\nexport type AssetUpdateBlobInput = AssetUpdateBlob;\nexport type AssetUpdateLinkInput = AssetUpdateLink;\nexport type AssetUpdateInput = AssetUpdateBlob | AssetUpdateLink;\nexport type Asset = GetAsset;\nexport type AssetRefId = RefId;\n/** Partial-update body (`PATCH /assets/{id}`) — an RFC-6902 JSON-Patch op-array. */\nexport type AssetPatch = PatchOperation[];\n/** Result of {@link MediaService.getDownloadUrl} — `{ provider, url, expiresAt? }`. */\nexport type AssetDownloadUrl = DownloadUrl;\n/** Query for {@link MediaService.getDownloadUrl} — `{ disposition? }`. */\nexport type AssetDownloadUrlQuery = NonNullable<GetMediaRetrieveDownloadUrlData[\"query\"]>;\n/** Body for {@link MediaService.startUploadSession}: a BLOB create payload plus `uploadType`. */\nexport type AssetUploadSessionInput = UploadSessionRequest;\n/** The storage instruction {@link MediaService.startUploadSession} returns. */\nexport type AssetUploadSession = UploadSession;\n\n/**\n * Filter / pagination options for {@link MediaService.list}. The explicit\n * fields are typed for autocomplete; the index signature stays open so\n * Emporix `q`-syntax filters like `\"refIds.id\"` can be passed verbatim.\n */\nexport interface ListAssetsQuery {\n  pageNumber?: number;\n  pageSize?: number;\n  /** Emporix sort syntax, e.g. `\"name,metadata.createdAt:desc\"`. */\n  sort?: string;\n  /** Emporix `q`-syntax filter, e.g. `\"name:hero\"`. */\n  q?: string;\n  /**\n   * Ask for `X-Total-Count`. An SDK-side flag, not an Emporix query parameter:\n   * it becomes a request header.\n   */\n  totalCount?: boolean;\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Result of {@link MediaService.download}. The endpoint's behaviour depends\n * on the asset's `access`:\n * - `PUBLIC` assets respond with a 30x redirect whose `Location` header\n *   carries the externally-cacheable storage URL — useful when the\n *   storefront wants to send the user there directly.\n * - `PRIVATE` assets respond with the raw bytes (plus an `ETag` header\n *   for caching). The file lives in Google Cloud Storage and is reachable\n *   without the service token only through a signed URL from\n *   {@link MediaService.getDownloadUrl}.\n */\nexport type DownloadResult =\n  | { kind: \"redirect\"; url: string }\n  | {\n      kind: \"bytes\";\n      data: ArrayBuffer;\n      etag?: string;\n      contentType?: string;\n    };\n\nconst SERVICE: AuthContext = { kind: \"service\" };\n\nfunction isProductRef(r: AssetRefId, productId: string): boolean {\n  return r.type === \"PRODUCT\" && r.id === productId;\n}\n\n/**\n * Media assets (BLOB/LINK). All endpoints require a backend-only scope\n * (`media.asset_manage` / `media.asset_read`) — default auth: service.\n */\nexport class MediaService {\n  static readonly channel = \"media\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/media/${this.ctx.tenant}/assets`;\n  }\n\n  /**\n   * Create an asset. BLOB uploads via multipart (max 30 MB); LINK via JSON.\n   * {@link startUploadSession} sends the file straight to storage instead.\n   */\n  async create(\n    input:\n      | { kind: \"blob\"; file: Blob; body: AssetCreateBlobInput }\n      | { kind: \"link\"; body: AssetCreateLinkInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<{ id: string }>({\n        method: \"POST\",\n        path: this.base(),\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input.body,\n    });\n  }\n\n  /**\n   * List assets, wrapped in the shared {@link PaginatedItems} envelope so\n   * callers can iterate over pages consistently with the rest of the SDK.\n   * `hasNextPage` is the standard SDK heuristic: `true` when the returned\n   * page is full (`items.length === requested pageSize`). Pagination\n   * defaults match Emporix's server defaults (`pageNumber: 1`,\n   * `pageSize: 60`) so an empty `query` produces stable expectations.\n   */\n  async list(\n    query: ListAssetsQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    const pageNumber = query.pageNumber ?? 1;\n    const pageSize = query.pageSize ?? 60;\n    // Destructured out because the rest of `query` is spread into the query\n    // string: `totalCount` is an SDK-side flag that becomes a request header,\n    // and would otherwise ride along as a stray `?totalCount=true`.\n    const { totalCount, ...rest } = query;\n    return requestPage<Asset>(\n      this.ctx.http,\n      {\n        method: \"GET\",\n        path: this.base(),\n        auth,\n        query: { ...rest, pageNumber, pageSize },\n      },\n      { pageNumber, pageSize, ...(totalCount === undefined ? {} : { totalCount }) },\n    );\n  }\n\n  /** Fetch an asset by id. */\n  async get(assetId: string, auth: AuthContext = SERVICE): Promise<Asset> {\n    return this.ctx.http.request<Asset>({\n      method: \"GET\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Update an asset. The input is a discriminated union mirroring\n   * {@link create}:\n   * - `{ kind: \"json\", body }` — metadata-only patch (BLOB or LINK).\n   *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,\n   *   or `url` changes.\n   * - `{ kind: \"blob\", file, body }` — replaces the BLOB file content\n   *   (max 30 MB) AND patches metadata in the same request. Sends\n   *   `multipart/form-data`.\n   *\n   * `type` and `access` are immutable per Emporix — they must match the\n   * existing asset's values. Optimistic-locking is via `body.metadata.version`;\n   * the server returns 409 Conflict on a stale version.\n   */\n  async update(\n    assetId: string,\n    input:\n      | { kind: \"json\"; body: AssetUpdateInput }\n      | { kind: \"blob\"; file: Blob; body: AssetUpdateBlobInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<Asset>({\n        method: \"PUT\",\n        path: `${this.base()}/${assetId}`,\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<Asset>({\n      method: \"PUT\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n      body: input.body,\n    });\n  }\n\n  /**\n   * Partially update an asset with an RFC-6902 JSON-Patch op-array\n   * (`PATCH /assets/{id}`, HTTP 204 — nothing is returned).\n   *\n   * This is the way to change one field without resending the whole asset, and\n   * the only way to touch a `BLOB` asset's metadata **without re-uploading the\n   * file** — {@link update} in `blob` mode always replaces the bytes.\n   *\n   * Append to an array with a path ending in `/-`, which preserves the existing\n   * entries:\n   *\n   * ```ts\n   * await client.media.patch(assetId, [\n   *   { op: \"add\", path: \"/refIds/-\", value: { id: \"product1\", type: \"PRODUCT\" } },\n   * ]);\n   * ```\n   *\n   * `type` and `access` are immutable here too, as with {@link update}. Only\n   * `add`, `remove` and `replace` are accepted, and optimistic locking still\n   * applies — a stale `metadata.version` gets a 409.\n   */\n  async patch(assetId: string, ops: AssetPatch, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"PATCH\",\n      path: `${this.base()}/${encodeURIComponent(assetId)}`,\n      auth,\n      body: ops,\n    });\n  }\n\n  /** Remove an asset. */\n  async remove(assetId: string, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Download an asset by id. Returns a discriminated union:\n   * - `{ kind: \"redirect\", url }` for `PUBLIC` assets (server-side 30x with\n   *   the storage URL in `Location`).\n   * - `{ kind: \"bytes\", data }` for `PRIVATE` assets (server-side 200 with\n   *   the asset bytes; `etag` + `contentType` headers are exposed for\n   *   caching). When the server reports `text/plain` Content-Type (the\n   *   OpenAPI-documented format), the SDK decodes the base64 stream into\n   *   an `ArrayBuffer` transparently; binary Content-Types are passed\n   *   through verbatim.\n   *\n   * Emporix recommends {@link getDownloadUrl} for every download: here the file\n   * passes through the Media API. A `413` means the asset's known size exceeds\n   * the streaming limit (30 MB by default) — only {@link getDownloadUrl} can\n   * serve it. A `409` means the asset is still `PENDING` from a direct upload\n   * whose file has not reached storage.\n   *\n   * Implementation note: uses `redirect: \"manual\"` so the redirect-location\n   * is observable. In Node.js this works; in a browser the redirect Location\n   * is intentionally hidden by fetch — there, `PUBLIC` downloads will\n   * surface as an opaque-redirect and the SDK throws. Browser code should\n   * use the asset's `url` field from `get()` for `LINK` assets, or the\n   * direct storage URL for `PUBLIC` `BLOB` assets (typically delivered via\n   * an `<img>` tag rather than `download()`).\n   */\n  async download(\n    assetId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<DownloadResult> {\n    const path = `${this.base()}/${assetId}/download`;\n    const res = await this.ctx.http.requestRaw(\n      { method: \"GET\", path, auth },\n      { redirect: \"manual\" },\n    );\n\n    // PUBLIC: server-side redirect — capture Location.\n    if (res.status >= 300 && res.status < 400) {\n      const url = res.headers.get(\"location\");\n      if (!url) {\n        throw new EmporixError(\n          `media.download: ${res.status} response without a Location header`,\n          res.status,\n        );\n      }\n      return { kind: \"redirect\", url };\n    }\n\n    // PRIVATE: bytes.\n    if (res.ok) {\n      const etag = res.headers.get(\"etag\") ?? undefined;\n      const contentType = res.headers.get(\"content-type\") ?? undefined;\n      let data: ArrayBuffer;\n      if (contentType?.startsWith(\"text/plain\")) {\n        // Per OpenAPI spec the server returns the byte stream as a\n        // base64-encoded text/plain body. Decode once into raw bytes\n        // so callers always see an ArrayBuffer.\n        const text = await res.text();\n        const bin = atob(text);\n        const arr = new Uint8Array(bin.length);\n        for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);\n        data = arr.buffer;\n      } else {\n        data = await res.arrayBuffer();\n      }\n      return {\n        kind: \"bytes\",\n        data,\n        ...(etag !== undefined ? { etag } : {}),\n        ...(contentType !== undefined ? { contentType } : {}),\n      };\n    }\n\n    // Error: surface via the standard EmporixError hierarchy.\n    const text = await res.text();\n    let parsed: unknown = undefined;\n    if (text) {\n      try {\n        parsed = JSON.parse(text);\n      } catch {\n        parsed = text;\n      }\n    }\n    throw errorFromResponse(res.status, `GET ${path} → ${res.status}`, parsed);\n  }\n\n  /**\n   * Get a URL that serves the stored file straight from storage\n   * (`GET /assets/{assetId}/download-url`). Emporix recommends it for every\n   * download: the file never passes through the Media API, there is no size\n   * limit, and the URL can be handed to a browser as it is.\n   *\n   * - `PRIVATE` BLOB → `provider: \"GCS\"`, a signed Google Cloud Storage URL that\n   *   works without an Emporix token until `expiresAt` (15 minutes by default).\n   * - `PUBLIC` BLOB → `provider: \"CLOUDINARY\"`, the permanent URL.\n   * - `LINK` → `provider: \"LINK\"`, the stored URL.\n   *\n   * `disposition` (`attachment` by default, or `inline`) affects private URLs\n   * only. Unlike {@link startUploadSession}, this works whether or not direct\n   * upload is enabled for the tenant. A `409` means a direct upload is still\n   * `PENDING` and its file has not reached storage; once it has, this call\n   * completes the asset before answering.\n   */\n  async getDownloadUrl(\n    assetId: string,\n    query: AssetDownloadUrlQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<AssetDownloadUrl> {\n    return this.ctx.http.request<AssetDownloadUrl>({\n      method: \"GET\",\n      path: `${this.base()}/${encodeURIComponent(assetId)}/download-url`,\n      auth,\n      query: { ...query },\n    });\n  }\n\n  /**\n   * Start a direct upload of a `BLOB` asset (`POST /assets/upload-session`,\n   * `201`). Emporix creates the asset as `PENDING` — `id` is its id — and\n   * returns where to send the file. **This method does not send it**:\n   *\n   * - `upload.method === \"PUT\"` (a `PRIVATE` asset, `uploadType: \"put\"` or\n   *   omitted): `PUT` the file to `upload.url` with every `upload.headers` entry.\n   * - `upload.method === \"POST\"` (every `PUBLIC` asset, or `uploadType: \"form\"`):\n   *   a multipart `POST` to `upload.url` with every `upload.fields` entry\n   *   unchanged and the file part last.\n   *\n   * That request goes to Google Cloud Storage or Cloudinary, not to Emporix, so\n   * it must not carry the Emporix token — which is also why a browser can make\n   * it. The asset turns `READY` once storage confirms; until then, calls that\n   * need the file answer `409`. The instruction is valid for 15 minutes (GCS) or\n   * an hour (Cloudinary), and an unused session expires at `expiresAt`.\n   *\n   * Direct upload is enabled per tenant by Emporix Support. Without it the call\n   * throws an `EmporixForbiddenError` whose `body.message` is `direct upload is\n   * not enabled for this tenant`, and nothing is created — the same status as a\n   * missing scope, so read the message.\n   */\n  async startUploadSession(\n    input: AssetUploadSessionInput,\n    auth: AuthContext = SERVICE,\n  ): Promise<AssetUploadSession> {\n    return this.ctx.http.request<AssetUploadSession>({\n      method: \"POST\",\n      path: `${this.base()}/upload-session`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Multipart upload sugar: builds `AssetCreateBlob` from input. */\n  async uploadFile(\n    input: {\n      file: Blob;\n      productId?: string;\n      filename?: string;\n      mimeType?: string;\n      access?: \"PUBLIC\" | \"PRIVATE\";\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateBlobInput = {\n      type: \"BLOB\",\n      access: input.access ?? \"PUBLIC\",\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n    };\n    return this.create({ kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /**\n   * Replace the file content of an existing BLOB asset. Sugar over\n   * {@link update} with `kind: \"blob\"`. `access` is required because the\n   * field is immutable and the server validates that the patch matches.\n   * Pass `version` from `asset.metadata.version` if you want optimistic\n   * locking (recommended when concurrent writers are possible).\n   */\n  async replaceFile(\n    assetId: string,\n    input: {\n      file: Blob;\n      access: \"PUBLIC\" | \"PRIVATE\";\n      filename?: string;\n      mimeType?: string;\n      version?: number;\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const body: AssetUpdateBlobInput = {\n      type: \"BLOB\",\n      access: input.access,\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n      ...(input.version !== undefined\n        ? { metadata: { version: input.version } }\n        : {}),\n    };\n    return this.update(assetId, { kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /** External-URL sugar: builds `AssetCreateLink`. */\n  async link(\n    input: { url: string; productId?: string; access?: \"PUBLIC\" | \"PRIVATE\" },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateLinkInput = {\n      type: \"LINK\",\n      access: input.access ?? \"PUBLIC\",\n      url: input.url,\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n    };\n    return this.create({ kind: \"link\", body }, auth);\n  }\n\n  /** Idempotently add a PRODUCT refId to an asset. */\n  async attachToProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    if (refIds.some((r) => isProductRef(r, productId))) return a;\n    const next: AssetRefId[] = [...refIds, { type: \"PRODUCT\", id: productId }];\n    // Preserve the asset's type discriminator so the update body satisfies\n    // the AssetUpdateBlob | AssetUpdateLink union.\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Remove a PRODUCT refId from an asset (no-op if absent). */\n  async detachFromProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    const next = refIds.filter((r) => !isProductRef(r, productId));\n    if (next.length === refIds.length) return a;\n    const patch = { type: a.type, refIds: next } as unknown as AssetUpdateInput;\n    return this.update(assetId, { kind: \"json\", body: patch }, auth);\n  }\n\n  /** Convenience: list assets attached to a product (server-side filter). */\n  async listForProduct(\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    return this.list({ \"refIds.id\": productId }, auth);\n  }\n}\n\n// Re-export so consumers can `import { isProductRef } from \"@viu/emporix-sdk/media\"`?\n// Internal helper — kept module-private; convenience methods in Task 4 use it.\nexport const _internalMedia = { isProductRef };\n"]}

package/dist/{chunk-P3RANRGB.js → chunk-IYNT5BQW.js}

@@ -60,6 +60,20 @@ var OrdersService = class {
       ...headers ? { headers } : {}
     });
   }
+  /**
+   * The status transitions the customer may trigger on one of their orders
+   * (`GET /orders/{orderId}/transitions`) — for example whether it can still be
+   * cancelled, before offering {@link cancel}.
+   */
+  async listTransitions(orderId, auth, opts = {}) {
+    const headers = this.saasHeader(opts.saasToken);
+    return this.ctx.http.request({
+      method: "GET",
+      path: `${this.base()}/${encodeURIComponent(orderId)}/transitions`,
+      auth,
+      ...headers ? { headers } : {}
+    });
+  }
   /** Transitions an order to a new status. Server enforces legal transitions. */
   async transition(orderId, status, auth, opts = {}) {
     const body = { status };
@@ -282,5 +296,5 @@ var SalesOrdersService = class {
 };
 
 export { OrdersService, SalesOrdersService };
-//# sourceMappingURL=chunk-P3RANRGB.js.map
-//# sourceMappingURL=chunk-P3RANRGB.js.map
+//# sourceMappingURL=chunk-IYNT5BQW.js.map
+//# sourceMappingURL=chunk-IYNT5BQW.js.map