@viu/emporix-sdk 4.10.0 → 4.11.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/CHANGELOG.md +27 -0
  2. package/README.md +2 -1
  3. package/dist/availability.d.cts +1 -1
  4. package/dist/availability.d.ts +1 -1
  5. package/dist/cart.d.cts +1 -1
  6. package/dist/cart.d.ts +1 -1
  7. package/dist/category.d.cts +1 -1
  8. package/dist/category.d.ts +1 -1
  9. package/dist/checkout.d.cts +1 -1
  10. package/dist/checkout.d.ts +1 -1
  11. package/dist/companies.d.cts +1 -1
  12. package/dist/companies.d.ts +1 -1
  13. package/dist/contacts.d.cts +1 -1
  14. package/dist/contacts.d.ts +1 -1
  15. package/dist/{context-BJeomwxV.d.cts → context-BqSLYN2q.d.cts} +68 -1
  16. package/dist/{context-BJeomwxV.d.ts → context-BqSLYN2q.d.ts} +68 -1
  17. package/dist/{customer-groups-ZlnnZrX_.d.cts → customer-groups-B3jlWR4O.d.cts} +1 -1
  18. package/dist/{customer-groups-ByyBHCBH.d.ts → customer-groups-oJ9YcjDe.d.ts} +1 -1
  19. package/dist/customer-groups.d.cts +2 -2
  20. package/dist/customer-groups.d.ts +2 -2
  21. package/dist/customer.d.cts +1 -1
  22. package/dist/customer.d.ts +1 -1
  23. package/dist/index.cjs +458 -291
  24. package/dist/index.cjs.map +1 -1
  25. package/dist/index.d.cts +208 -33
  26. package/dist/index.d.ts +208 -33
  27. package/dist/index.js +457 -293
  28. package/dist/index.js.map +1 -1
  29. package/dist/locations.d.cts +1 -1
  30. package/dist/locations.d.ts +1 -1
  31. package/dist/media.d.cts +1 -1
  32. package/dist/media.d.ts +1 -1
  33. package/dist/orders.d.cts +1 -1
  34. package/dist/orders.d.ts +1 -1
  35. package/dist/payment.d.cts +1 -1
  36. package/dist/payment.d.ts +1 -1
  37. package/dist/price.d.cts +1 -1
  38. package/dist/price.d.ts +1 -1
  39. package/dist/product.d.cts +1 -1
  40. package/dist/product.d.ts +1 -1
  41. package/dist/segment.d.cts +1 -1
  42. package/dist/segment.d.ts +1 -1
  43. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,32 @@
1
1
  # @viu/emporix-sdk
2
2
 
3
+ ## 4.11.1
4
+
5
+ ### Patch Changes
6
+
7
+ - [#452](https://github.com/viuteam/emporix-sdk/pull/452) [`00cf421`](https://github.com/viuteam/emporix-sdk/commit/00cf4212331dee47021110a02815e4909c6112fd) Thanks [@viu-release-bot](https://github.com/apps/viu-release-bot)! - chore(sdk): sync generated types with upstream Emporix API specs
8
+
9
+ Updated services: brand-service,import-service,indexing-service,product,site-settings-service
10
+
11
+ ## 4.11.0
12
+
13
+ ### Minor Changes
14
+
15
+ - [#450](https://github.com/viuteam/emporix-sdk/pull/450) [`6d08594`](https://github.com/viuteam/emporix-sdk/commit/6d08594adcb4b8924d2fd867ce63eed452baa637) Thanks [@amnael1](https://github.com/amnael1)! - feat(sdk): add a proxy mode for a Backend for Frontend that holds the tokens
16
+
17
+ `EmporixConfig.proxy` (`{ headers?, credentials?, onUnauthorized? }`) runs the client behind a same-origin Backend for Frontend (BFF), the architecture of RFC 10017 (OAuth 2.0 for Browser-Based Applications). The browser then holds no token at all.
18
+
19
+ With it set, the client:
20
+
21
+ - requests no token: no anonymous login or refresh, no client credentials, no customer refresh;
22
+ - sends no `Authorization` header on any request — JSON calls, raw responses and server-sent event streams alike;
23
+ - sends `proxy.headers` (for example `{ "X-CSRF": "1" }`) and `fetch`'s `credentials` (default `"same-origin"`) on all three;
24
+ - answers a 401 by calling `proxy.onUnauthorized` and every listener registered with the new `client.onUnauthorized(listener)`, then throwing `EmporixAuthError`, without a retry.
25
+
26
+ `auth.customer()` and `auth.anonymous()` are still accepted but decide nothing on the wire. `auth.service()` throws before any request is made. `tokenProvider`, `credentials.backend` and `credentials.custom` throw at construction. `host` may now be a path such as `/emporix`, resolved against `location.origin` per request.
27
+
28
+ Also new: `createProxySessionStorage` and `PROXY_CUSTOMER_TOKEN`, the storage view the React and Angular bindings use, and `createProxyModeTokenProvider`. Without `proxy` nothing changes. See `docs/bff.md`.
29
+
3
30
  ## 4.10.0
4
31
 
5
32
  ### Minor Changes
package/README.md CHANGED
@@ -100,7 +100,7 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
100
100
  | `credentials.backend` | — | `{ clientId, secret, scope? }` — service token |
101
101
  | `credentials.storefront` | — | `{ clientId, context? }` — anonymous token (no secret). `context` holds `currency` / `siteCode` / `targetLocation`, bound to the anonymous token and needed by `prices.matchByContext`, plus `language` (`Accept-Language`); `sdk.setStorefrontContext()` switches it at runtime |
102
102
  | `credentials.custom` | — | `Record<name, { clientId, secret, scope? }>` |
103
- | `host` | `https://api.emporix.io` | |
103
+ | `host` | `https://api.emporix.io` | a path such as `/emporix` resolves against `location.origin` (for a same-origin proxy) |
104
104
  | `timeouts` | `{ connectMs: 10000, readMs: 60000 }` | |
105
105
  | `retry` | `{ maxAttempts: 3 }` | 5xx/429 backoff + jitter for idempotent methods (GET/PUT/DELETE; POST/PATCH opt in via `idempotent: true`); numeric `Retry-After` honoured, capped at 8s |
106
106
  | `cache` | `{ expirationBufferSeconds: 60, maxLifetimeSeconds: 3600 }` | token cache |
@@ -108,6 +108,7 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
108
108
  | `tokenProvider` | built-in | inject for SSO/token-exchange |
109
109
  | `fetch` | global `fetch` | replaces `fetch` for API requests; token requests and SSE streams keep the global one |
110
110
  | `contentLanguage` | — (no header) | `Content-Language` on every request with a body: `"*"` when localized fields are maps of translations, a language code when they are plain strings. Product and category writes override it per call — see [`../../docs/products.md`](../../docs/products.md#localized-writes) |
111
+ | `proxy` | — | `{ headers?, credentials?, onUnauthorized? }`: Backend-for-Frontend mode. No token requests, no `Authorization` header, a 401 goes to `onUnauthorized` — see [`../../docs/bff.md`](../../docs/bff.md) |
111
112
 
112
113
  `credentials: {}` is legal: a client that never mints its own token, for when the
113
114
  token comes from outside. The Managed Dashboard module in
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BqSLYN2q.cjs';
2
2
 
3
3
  type AvailabilityDto = {
4
4
  /**
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BqSLYN2q.js';
2
2
 
3
3
  type AvailabilityDto = {
4
4
  /**
package/dist/cart.d.cts CHANGED
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
 
3
3
  /**
4
4
  * Access control identifier that determines who can view or manage the cart.
package/dist/cart.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.js';
2
2
 
3
3
  /**
4
4
  * Access control identifier that determines who can view or manage the cart.
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BqSLYN2q.cjs';
2
2
  import { a as QueryFor } from './query-mLQs2WFr.cjs';
3
3
  import { Product } from './product.cjs';
4
4
 
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext, P as PaginatedItems } from './context-BqSLYN2q.js';
2
2
  import { a as QueryFor } from './query-mLQs2WFr.js';
3
3
  import { Product } from './product.js';
4
4
 
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
 
3
3
  /**
4
4
  * Information about the customer's address.
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.js';
2
2
 
3
3
  /**
4
4
  * Information about the customer's address.
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
  import { S as SearchPaging } from './search-DU6tE356.cjs';
3
3
  import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-fWB4nrso.cjs';
4
4
  export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-fWB4nrso.cjs';
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.js';
2
2
  import { S as SearchPaging } from './search-DU6tE356.js';
3
3
  import { L as LegalEntity, e as LegalEntityCreate, f as LegalEntityUpdate } from './types.gen-fWB4nrso.js';
4
4
  export { A as AccountLimit, d as CustomerGroup, g as LegalInfo } from './types.gen-fWB4nrso.js';
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
  import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-fWB4nrso.cjs';
3
3
 
4
4
  /**
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.js';
2
2
  import { C as ContactAssignment, a as ContactAssignmentCreate, b as ContactAssignmentUpdate } from './types.gen-fWB4nrso.js';
3
3
 
4
4
  /**
@@ -96,9 +96,44 @@ interface StorefrontCredentials {
96
96
  language?: string;
97
97
  };
98
98
  }
99
+ /** What {@link EmporixProxyConfig.onUnauthorized} learns about the request a proxy answered with 401. */
100
+ interface EmporixUnauthorizedInfo {
101
+ method: string;
102
+ /** The API path, without host and query, e.g. `/customer/acme/me`. */
103
+ path: string;
104
+ }
105
+ /**
106
+ * Proxy mode, for a Backend for Frontend (BFF) that holds the Emporix tokens.
107
+ *
108
+ * With it set, the SDK requests no token and sends no `Authorization` header:
109
+ * every request goes to `host` — usually a same-origin path such as `/emporix` —
110
+ * with the session cookie and `headers`, and the proxy attaches the bearer token
111
+ * itself. A `customer` or `anonymous` {@link AuthContext} is still accepted but
112
+ * no longer decides anything on the wire; `auth.service()` throws. A 401 is never
113
+ * retried or refreshed: `onUnauthorized` runs, then `EmporixAuthError` is thrown.
114
+ *
115
+ * See `docs/bff.md` for what the proxy has to do.
116
+ */
117
+ interface EmporixProxyConfig {
118
+ /** Sent with every request, e.g. `{ "X-CSRF": "1" }` for the proxy's CSRF check. */
119
+ headers?: Record<string, string>;
120
+ /** `fetch`'s `credentials`. Default `"same-origin"`, which sends the session cookie to the same origin. */
121
+ credentials?: RequestInit["credentials"];
122
+ /**
123
+ * Called on every 401, before the `EmporixAuthError` is thrown — typically to
124
+ * send the browser to the proxy's login. Parallel requests call it once each.
125
+ */
126
+ onUnauthorized?: (info: EmporixUnauthorizedInfo) => void;
127
+ }
99
128
  /** User-supplied SDK configuration. */
100
129
  interface EmporixConfig {
101
130
  tenant: string;
131
+ /**
132
+ * API host. Default `https://api.emporix.io`. A path such as `/emporix` is
133
+ * resolved against `globalThis.location.origin` per request — what a
134
+ * same-origin proxy needs (see {@link EmporixProxyConfig}); without a
135
+ * `location` (on a server) such a request throws.
136
+ */
102
137
  host?: string;
103
138
  credentials: {
104
139
  /**
@@ -151,6 +186,18 @@ interface EmporixConfig {
151
186
  * can override it per call with `contentLanguage` in their write options.
152
187
  */
153
188
  contentLanguage?: string;
189
+ /**
190
+ * Proxy (BFF) mode — see {@link EmporixProxyConfig}. Excludes `tokenProvider`
191
+ * and `credentials.backend` / `credentials.custom`: in proxy mode the SDK
192
+ * requests no tokens, so neither could ever be used.
193
+ */
194
+ proxy?: EmporixProxyConfig;
195
+ }
196
+ /** {@link EmporixProxyConfig} with defaults applied. */
197
+ interface ResolvedProxyConfig {
198
+ headers: Record<string, string>;
199
+ credentials: NonNullable<RequestInit["credentials"]>;
200
+ onUnauthorized: ((info: EmporixUnauthorizedInfo) => void) | undefined;
154
201
  }
155
202
  /** Fully-resolved configuration with defaults applied. */
156
203
  interface ResolvedConfig {
@@ -172,6 +219,8 @@ interface ResolvedConfig {
172
219
  logger: LoggerConfig | undefined;
173
220
  fetch: typeof globalThis.fetch | undefined;
174
221
  contentLanguage: string | undefined;
222
+ /** Set exactly when the client runs in proxy mode. */
223
+ proxy: ResolvedProxyConfig | undefined;
175
224
  }
176
225
  /** Validates user config and applies defaults. Throws on invalid tenant/credentials. */
177
226
  declare function validateConfig(input: EmporixConfig): ResolvedConfig;
@@ -446,6 +495,12 @@ interface HttpClientOptions {
446
495
  * (`core/auth.ts`) or by {@link HttpClient.stream} — see `EmporixConfig.fetch`.
447
496
  */
448
497
  fetch?: typeof globalThis.fetch;
498
+ /**
499
+ * Proxy mode — see `EmporixConfig.proxy`. No token is resolved and no
500
+ * `Authorization` header is sent; `headers` and `credentials` go on every
501
+ * request, the stream included; a 401 calls `onUnauthorized` and throws.
502
+ */
503
+ proxy?: ResolvedProxyConfig;
449
504
  }
450
505
  /** Fetch wrapper: auth resolution, JSON parsing, typed error mapping, logging. */
451
506
  declare class HttpClient {
@@ -454,7 +509,19 @@ declare class HttpClient {
454
509
  /** Resolved request fetch. The arrow keeps `globalThis.fetch` correctly bound. */
455
510
  private readonly doFetch;
456
511
  constructor(opts: HttpClientOptions);
512
+ /**
513
+ * `null` in proxy mode, where no token is resolved at all — the provider is
514
+ * never asked, so no token request can happen. A service context is refused
515
+ * there rather than sent anonymously through the proxy.
516
+ */
517
+ private tokenFor;
518
+ /** `host + path` plus query. A relative host (`/emporix`) resolves against the page origin. */
519
+ private urlFor;
520
+ /** Proxy mode: report the 401 before it is thrown. A throwing callback must not mask it. */
521
+ private reportUnauthorized;
457
522
  private buildHeaders;
523
+ /** `fetch`'s `credentials` — set only in proxy mode, where the session cookie must go along. */
524
+ private credentialsInit;
458
525
  /**
459
526
  * Issues a request and returns the parsed body. Retries 5xx/429 on idempotent
460
527
  * methods and re-auths once on a 401 — see {@link send}.
@@ -540,4 +607,4 @@ interface PaginatedItems<T> {
540
607
  */
541
608
  declare function iterateAll<T>(fetchPage: (pageNumber: number) => Promise<PaginatedItems<T>>, start?: number): AsyncIterable<T>;
542
609
 
543
- export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type HttpClientOptions as g, type HttpResult as h, LevelResolver as i, type LogFields as j, type LogLevel as k, type Logger as l, type LoggerConfig as m, type LoggerObjectConfig as n, type ResolvedConfig as o, type ServiceName as p, type StoredAnonymousSession as q, type StorefrontCredentials as r, auth as s, createConsoleLogger as t, createNoopLogger as u, iterateAll as v, redact as w, resolveToken as x, validateConfig as y };
610
+ export { type AnonymousSession as A, resolveToken as B, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, validateConfig as F, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type EmporixProxyConfig as g, type EmporixUnauthorizedInfo as h, type HttpClientOptions as i, type HttpResult as j, LevelResolver as k, type LogFields as l, type LogLevel as m, type Logger as n, type LoggerConfig as o, type LoggerObjectConfig as p, type ResolvedConfig as q, type ResolvedProxyConfig as r, type ServiceName as s, type StoredAnonymousSession as t, type StorefrontCredentials as u, auth as v, createConsoleLogger as w, createNoopLogger as x, iterateAll as y, redact as z };
@@ -96,9 +96,44 @@ interface StorefrontCredentials {
96
96
  language?: string;
97
97
  };
98
98
  }
99
+ /** What {@link EmporixProxyConfig.onUnauthorized} learns about the request a proxy answered with 401. */
100
+ interface EmporixUnauthorizedInfo {
101
+ method: string;
102
+ /** The API path, without host and query, e.g. `/customer/acme/me`. */
103
+ path: string;
104
+ }
105
+ /**
106
+ * Proxy mode, for a Backend for Frontend (BFF) that holds the Emporix tokens.
107
+ *
108
+ * With it set, the SDK requests no token and sends no `Authorization` header:
109
+ * every request goes to `host` — usually a same-origin path such as `/emporix` —
110
+ * with the session cookie and `headers`, and the proxy attaches the bearer token
111
+ * itself. A `customer` or `anonymous` {@link AuthContext} is still accepted but
112
+ * no longer decides anything on the wire; `auth.service()` throws. A 401 is never
113
+ * retried or refreshed: `onUnauthorized` runs, then `EmporixAuthError` is thrown.
114
+ *
115
+ * See `docs/bff.md` for what the proxy has to do.
116
+ */
117
+ interface EmporixProxyConfig {
118
+ /** Sent with every request, e.g. `{ "X-CSRF": "1" }` for the proxy's CSRF check. */
119
+ headers?: Record<string, string>;
120
+ /** `fetch`'s `credentials`. Default `"same-origin"`, which sends the session cookie to the same origin. */
121
+ credentials?: RequestInit["credentials"];
122
+ /**
123
+ * Called on every 401, before the `EmporixAuthError` is thrown — typically to
124
+ * send the browser to the proxy's login. Parallel requests call it once each.
125
+ */
126
+ onUnauthorized?: (info: EmporixUnauthorizedInfo) => void;
127
+ }
99
128
  /** User-supplied SDK configuration. */
100
129
  interface EmporixConfig {
101
130
  tenant: string;
131
+ /**
132
+ * API host. Default `https://api.emporix.io`. A path such as `/emporix` is
133
+ * resolved against `globalThis.location.origin` per request — what a
134
+ * same-origin proxy needs (see {@link EmporixProxyConfig}); without a
135
+ * `location` (on a server) such a request throws.
136
+ */
102
137
  host?: string;
103
138
  credentials: {
104
139
  /**
@@ -151,6 +186,18 @@ interface EmporixConfig {
151
186
  * can override it per call with `contentLanguage` in their write options.
152
187
  */
153
188
  contentLanguage?: string;
189
+ /**
190
+ * Proxy (BFF) mode — see {@link EmporixProxyConfig}. Excludes `tokenProvider`
191
+ * and `credentials.backend` / `credentials.custom`: in proxy mode the SDK
192
+ * requests no tokens, so neither could ever be used.
193
+ */
194
+ proxy?: EmporixProxyConfig;
195
+ }
196
+ /** {@link EmporixProxyConfig} with defaults applied. */
197
+ interface ResolvedProxyConfig {
198
+ headers: Record<string, string>;
199
+ credentials: NonNullable<RequestInit["credentials"]>;
200
+ onUnauthorized: ((info: EmporixUnauthorizedInfo) => void) | undefined;
154
201
  }
155
202
  /** Fully-resolved configuration with defaults applied. */
156
203
  interface ResolvedConfig {
@@ -172,6 +219,8 @@ interface ResolvedConfig {
172
219
  logger: LoggerConfig | undefined;
173
220
  fetch: typeof globalThis.fetch | undefined;
174
221
  contentLanguage: string | undefined;
222
+ /** Set exactly when the client runs in proxy mode. */
223
+ proxy: ResolvedProxyConfig | undefined;
175
224
  }
176
225
  /** Validates user config and applies defaults. Throws on invalid tenant/credentials. */
177
226
  declare function validateConfig(input: EmporixConfig): ResolvedConfig;
@@ -446,6 +495,12 @@ interface HttpClientOptions {
446
495
  * (`core/auth.ts`) or by {@link HttpClient.stream} — see `EmporixConfig.fetch`.
447
496
  */
448
497
  fetch?: typeof globalThis.fetch;
498
+ /**
499
+ * Proxy mode — see `EmporixConfig.proxy`. No token is resolved and no
500
+ * `Authorization` header is sent; `headers` and `credentials` go on every
501
+ * request, the stream included; a 401 calls `onUnauthorized` and throws.
502
+ */
503
+ proxy?: ResolvedProxyConfig;
449
504
  }
450
505
  /** Fetch wrapper: auth resolution, JSON parsing, typed error mapping, logging. */
451
506
  declare class HttpClient {
@@ -454,7 +509,19 @@ declare class HttpClient {
454
509
  /** Resolved request fetch. The arrow keeps `globalThis.fetch` correctly bound. */
455
510
  private readonly doFetch;
456
511
  constructor(opts: HttpClientOptions);
512
+ /**
513
+ * `null` in proxy mode, where no token is resolved at all — the provider is
514
+ * never asked, so no token request can happen. A service context is refused
515
+ * there rather than sent anonymously through the proxy.
516
+ */
517
+ private tokenFor;
518
+ /** `host + path` plus query. A relative host (`/emporix`) resolves against the page origin. */
519
+ private urlFor;
520
+ /** Proxy mode: report the 401 before it is thrown. A throwing callback must not mask it. */
521
+ private reportUnauthorized;
457
522
  private buildHeaders;
523
+ /** `fetch`'s `credentials` — set only in proxy mode, where the session cookie must go along. */
524
+ private credentialsInit;
458
525
  /**
459
526
  * Issues a request and returns the parsed body. Retries 5xx/429 on idempotent
460
527
  * methods and re-auths once on a 401 — see {@link send}.
@@ -540,4 +607,4 @@ interface PaginatedItems<T> {
540
607
  */
541
608
  declare function iterateAll<T>(fetchPage: (pageNumber: number) => Promise<PaginatedItems<T>>, start?: number): AsyncIterable<T>;
542
609
 
543
- export { type AnonymousSession as A, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type HttpClientOptions as g, type HttpResult as h, LevelResolver as i, type LogFields as j, type LogLevel as k, type Logger as l, type LoggerConfig as m, type LoggerObjectConfig as n, type ResolvedConfig as o, type ServiceName as p, type StoredAnonymousSession as q, type StorefrontCredentials as r, auth as s, createConsoleLogger as t, createNoopLogger as u, iterateAll as v, redact as w, resolveToken as x, validateConfig as y };
610
+ export { type AnonymousSession as A, resolveToken as B, type ClientContext as C, DEFAULT_HOST as D, type EmporixConfig as E, validateConfig as F, HttpClient as H, LEVEL as L, type PaginatedItems as P, type RequestOptions as R, type ServiceCredentials as S, type TokenProvider as T, type AnonymousSessionStore as a, type AuthContext as b, type AuthKind as c, CustomerRefreshRegistry as d, type CustomerTokenRefresher as e, DefaultTokenProvider as f, type EmporixProxyConfig as g, type EmporixUnauthorizedInfo as h, type HttpClientOptions as i, type HttpResult as j, LevelResolver as k, type LogFields as l, type LogLevel as m, type Logger as n, type LoggerConfig as o, type LoggerObjectConfig as p, type ResolvedConfig as q, type ResolvedProxyConfig as r, type ServiceName as s, type StoredAnonymousSession as t, type StorefrontCredentials as u, auth as v, createConsoleLogger as w, createNoopLogger as x, iterateAll as y, redact as z };
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
 
3
3
  /**
4
4
  * Access control metadata.
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, b as AuthContext } from './context-BqSLYN2q.js';
2
2
 
3
3
  /**
4
4
  * Access control metadata.
@@ -1,2 +1,2 @@
1
- export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-ZlnnZrX_.cjs';
2
- import './context-BJeomwxV.cjs';
1
+ export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-B3jlWR4O.cjs';
2
+ import './context-BqSLYN2q.cjs';
@@ -1,2 +1,2 @@
1
- export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-ByyBHCBH.js';
2
- import './context-BJeomwxV.js';
1
+ export { g as CustomerGroupsService, j as IamGroup, c as IamGroupMemberAssignment } from './customer-groups-oJ9YcjDe.js';
2
+ import './context-BqSLYN2q.js';
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-BJeomwxV.cjs';
1
+ import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-BqSLYN2q.cjs';
2
2
 
3
3
  type AccountId = {
4
4
  /**
@@ -1,4 +1,4 @@
1
- import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-BJeomwxV.js';
1
+ import { C as ClientContext, A as AnonymousSession, b as AuthContext } from './context-BqSLYN2q.js';
2
2
 
3
3
  type AccountId = {
4
4
  /**