@viu/emporix-sdk 4.10.0 → 4.11.1

package/dist/index.js

@@ -34,7 +34,7 @@ export { CustomerGroupsService, IamService } from './chunk-VXORPTMP.js';
 import { CustomerService } from './chunk-EQE5WGME.js';
 export { CustomerService } from './chunk-EQE5WGME.js';
 import './chunk-ZVIEFW3X.js';
-import { EmporixTimeoutError, EmporixNetworkError, errorFromResponse, EmporixNotFoundError, EmporixError } from './chunk-4Q76UV4J.js';
+import { EmporixAuthError, EmporixError, EmporixTimeoutError, EmporixNetworkError, errorFromResponse, EmporixNotFoundError } from './chunk-4Q76UV4J.js';
 export { EmporixAuthError, EmporixConflictError, EmporixError, EmporixForbiddenError, EmporixInsufficientScopeError, EmporixNetworkError, EmporixNotFoundError, EmporixServerError, EmporixTimeoutError, EmporixValidationError, errorFromResponse } from './chunk-4Q76UV4J.js';
 
 // src/core/config.ts
@@ -61,6 +61,17 @@ function validateConfig(input) {
     throw new Error("credentials is required (provide at least one of backend/storefront/custom)");
   }
   warnOnMisplacedContext(input);
+  const proxy = input.proxy;
+  if (proxy) {
+    if (input.tokenProvider) {
+      throw new Error("proxy and tokenProvider are mutually exclusive: in proxy mode the SDK requests no tokens");
+    }
+    if (input.credentials.backend || input.credentials.custom) {
+      throw new Error(
+        "credentials.backend and credentials.custom cannot be used in proxy mode: the proxy attaches the token, and service credentials never belong in a browser"
+      );
+    }
+  }
   return {
     tenant: input.tenant,
     host: input.host ?? DEFAULT_HOST,
@@ -77,239 +88,13 @@ function validateConfig(input) {
     },
     logger: input.logger,
     fetch: input.fetch,
-    contentLanguage: input.contentLanguage
-  };
-}
-
-// src/core/logger.ts
-var LEVEL = {
-  trace: 10,
-  debug: 20,
-  info: 30,
-  warn: 40,
-  error: 50,
-  silent: 60
-};
-function isValidLevel(v) {
-  return v !== void 0 && v in LEVEL;
-}
-function readEnv(name) {
-  try {
-    return typeof process !== "undefined" && process.env ? process.env[name] : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var LevelResolver = class {
-  constructor(cfg, warn = () => {
-  }) {
-    this.warn = warn;
-    this.cfgLevel = cfg.level ?? "warn";
-    this.cfgServices = { ...cfg.services };
-  }
-  warn;
-  cfgLevel;
-  cfgServices;
-  forcedServices = {};
-  forcedGlobal;
-  warned = false;
-  envFor(svc) {
-    const raw = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`);
-    if (raw === void 0) return void 0;
-    if (isValidLevel(raw)) return raw;
-    if (!this.warned) {
-      this.warned = true;
-      this.warn(`Invalid EMPORIX_LOG_LEVEL_${svc.toUpperCase()}="${raw}" ignored`);
-    }
-    return void 0;
-  }
-  envGlobal() {
-    const raw = readEnv("EMPORIX_LOG_LEVEL");
-    if (raw === void 0) return void 0;
-    if (isValidLevel(raw)) return raw;
-    if (!this.warned) {
-      this.warned = true;
-      this.warn(`Invalid EMPORIX_LOG_LEVEL="${raw}" ignored`);
-    }
-    return void 0;
-  }
-  /**
-   * Effective level for a service. Forced overrides (from `set(..., force)`)
-   * take precedence over env vars; otherwise env > programmatic config.
-   */
-  get(svc) {
-    return this.forcedServices[svc] ?? this.envFor(svc) ?? this.forcedGlobal ?? this.envGlobal() ?? this.cfgServices[svc] ?? this.cfgLevel ?? "warn";
-  }
-  /** Numeric effective level for a service. */
-  numericLevel(svc) {
-    return LEVEL[this.get(svc)];
-  }
-  /** True if `svc`'s effective level allows emitting at `at`. */
-  isAtLeast(svc, at) {
-    return this.numericLevel(svc) <= LEVEL[at];
-  }
-  /** Mutates programmatic level (global or one service). Env-set levels are sticky unless `force`. */
-  set(level, svc, force = false) {
-    if (svc) {
-      const envBound = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`) !== void 0;
-      if (envBound && !force) {
-        this.warn(`Level for "${svc}" is env-controlled; pass force to override`);
-        return;
-      }
-      if (force) this.forcedServices[svc] = level;
-      else this.cfgServices[svc] = level;
-    } else {
-      const envBound = readEnv("EMPORIX_LOG_LEVEL") !== void 0;
-      if (envBound && !force) {
-        this.warn("Global level is env-controlled; pass force to override");
-        return;
-      }
-      if (force) this.forcedGlobal = level;
-      else this.cfgLevel = level;
-    }
-  }
-};
-var DEFAULT_REDACT = /* @__PURE__ */ new Set([
-  "authorization",
-  "password",
-  "oldpassword",
-  "newpassword",
-  "clientsecret",
-  "secret",
-  "access_token",
-  "refresh_token",
-  "customertoken",
-  "saastoken",
-  "saas-token",
-  "bearertoken",
-  "apikey",
-  "token"
-]);
-function redact(value, extra = []) {
-  const keys = new Set(DEFAULT_REDACT);
-  for (const k of extra) keys.add(k.toLowerCase());
-  const walk = (v) => {
-    if (Array.isArray(v)) return v.map(walk);
-    if (v && typeof v === "object") {
-      const src = v;
-      if (typeof src.kind === "string" && "token" in src) return { kind: src.kind };
-      const out = {};
-      for (const [k, val] of Object.entries(src)) {
-        if (keys.has(k.toLowerCase())) {
-          out[k] = k.toLowerCase() === "authorization" && typeof val === "string" ? "Bearer ***redacted***" : "***redacted***";
-        } else {
-          out[k] = walk(val);
-        }
-      }
-      return out;
-    }
-    return v;
-  };
-  return walk(value);
-}
-var EMIT = {
-  trace: LEVEL.trace,
-  debug: LEVEL.debug,
-  info: LEVEL.info,
-  warn: LEVEL.warn,
-  error: LEVEL.error
-};
-var BaseLogger = class {
-  constructor(resolver, bindings, extraRedact) {
-    this.resolver = resolver;
-    this.bindings = bindings;
-    this.extraRedact = extraRedact;
-  }
-  resolver;
-  bindings;
-  extraRedact;
-  svc() {
-    return this.bindings.service ?? "http";
-  }
-  get level() {
-    return this.resolver.get(this.svc());
-  }
-  isLevelEnabled(level) {
-    return this.resolver.isAtLeast(this.svc(), level);
-  }
-  at(level, msg, fields) {
-    if (this.resolver.numericLevel(this.svc()) > EMIT[level]) return;
-    const merged = { ...this.bindings, ...fields ?? {} };
-    this.emit(level, msg, redact(merged, this.extraRedact));
-  }
-  trace(m, f) {
-    this.at("trace", m, f);
-  }
-  debug(m, f) {
-    this.at("debug", m, f);
-  }
-  info(m, f) {
-    this.at("info", m, f);
-  }
-  warn(m, f) {
-    this.at("warn", m, f);
-  }
-  error(m, f) {
-    this.at("error", m, f);
-  }
-};
-var ConsoleLogger = class _ConsoleLogger extends BaseLogger {
-  constructor(resolver, bindings, extra, sink, pretty) {
-    super(resolver, bindings, extra);
-    this.sink = sink;
-    this.pretty = pretty;
-  }
-  sink;
-  pretty;
-  emit(level, msg, fields) {
-    if (this.pretty) {
-      const fn = level === "error" ? this.sink.error : level === "warn" ? this.sink.warn : level === "info" ? this.sink.info : this.sink.log;
-      fn(`[${level}] ${msg}`, fields);
-    } else {
-      this.sink.log(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg, ...fields }));
-    }
-  }
-  child(bindings) {
-    return new _ConsoleLogger(
-      this.resolver,
-      { ...this.bindings, ...bindings },
-      this.extraRedact,
-      this.sink,
-      this.pretty
-    );
-  }
-};
-var NoopLogger = class {
-  level = "silent";
-  isLevelEnabled() {
-    return false;
-  }
-  trace() {
-  }
-  debug() {
-  }
-  info() {
-  }
-  warn() {
-  }
-  error() {
-  }
-  child() {
-    return this;
-  }
-};
-function createConsoleLogger(resolver, bindings = {}, opts = {}) {
-  const pretty = opts.pretty ?? readEnv("NODE_ENV") !== "production";
-  const sink = opts.sink ?? {
-    log: console.log,
-    info: console.info,
-    warn: console.warn,
-    error: console.error
+    contentLanguage: input.contentLanguage,
+    proxy: proxy ? {
+      headers: proxy.headers ?? {},
+      credentials: proxy.credentials ?? "same-origin",
+      onUnauthorized: proxy.onUnauthorized
+    } : void 0
   };
-  return new ConsoleLogger(resolver, bindings, opts.redact ?? [], sink, pretty);
-}
-function createNoopLogger() {
-  return new NoopLogger();
 }
 
 // src/core/session-keys.ts
@@ -534,46 +319,343 @@ function createLocalStorage(opts = {}) {
     console.warn("[emporix] localStorage unavailable; falling back to in-memory storage");
     return createMemoryStorage();
   }
-  return fromWebStorage(store, opts);
-}
-var createLocalStorageStorage = createLocalStorage;
-function createSessionStorage(opts = {}) {
-  const store = browser.sessionStorage;
-  if (store === void 0) {
-    console.warn("[emporix] sessionStorage unavailable; falling back to in-memory storage");
-    return createMemoryStorage();
+  return fromWebStorage(store, opts);
+}
+var createLocalStorageStorage = createLocalStorage;
+function createSessionStorage(opts = {}) {
+  const store = browser.sessionStorage;
+  if (store === void 0) {
+    console.warn("[emporix] sessionStorage unavailable; falling back to in-memory storage");
+    return createMemoryStorage();
+  }
+  return fromWebStorage(store, opts);
+}
+function createCookieStorage(opts = {}) {
+  const sameSite = opts.sameSite ?? "lax";
+  const secure = opts.secure ?? browser.location?.protocol === "https:";
+  const doc = browser.document;
+  if (doc === void 0) {
+    console.warn("[emporix] document unavailable; cookie storage falling back to in-memory");
+    return createMemoryStorage();
+  }
+  const attrs = `path=/; SameSite=${sameSite}${secure ? "; Secure" : ""}`;
+  const all = createListenerSet();
+  const storage = createCookieBackedStorage(
+    {
+      get: (name) => {
+        for (const part of doc.cookie.split("; ")) {
+          const [k, ...v] = part.split("=");
+          if (k === name) return decodeURIComponent(v.join("=")) || null;
+        }
+        return null;
+      },
+      set: (name, value) => {
+        doc.cookie = value === null ? `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; ${attrs}` : `${name}=${encodeURIComponent(value)}; ${attrs}`;
+      }
+    },
+    {
+      ...opts.name !== void 0 ? { tokenName: opts.name } : {},
+      notify: (key) => all.notify(key)
+    }
+  );
+  return { ...storage, subscribeAll: (l) => all.add(l) };
+}
+
+// src/core/proxy.ts
+var PROXY_CUSTOMER_TOKEN = "emporix-proxy-session";
+function createProxyModeTokenProvider() {
+  const refuse = () => {
+    throw new EmporixAuthError(
+      "The client runs in proxy mode: the proxy attaches the token, so the SDK requests none"
+    );
+  };
+  return {
+    getToken: async () => refuse(),
+    getAnonymousToken: async () => refuse(),
+    refreshAnonymous: async () => refuse(),
+    setAnonymousContext: () => {
+    }
+  };
+}
+var TOKEN_KEYS = /* @__PURE__ */ new Set([
+  "customerToken",
+  "anonymousSession",
+  "refreshToken",
+  "saasToken"
+]);
+function createProxySessionStorage(base, authenticated) {
+  let current = authenticated;
+  const tokenListeners = createListenerSet();
+  const keyListeners = createListenerSet();
+  const token = () => current ? PROXY_CUSTOMER_TOKEN : null;
+  const drop = () => {
+  };
+  return {
+    getCustomerToken: token,
+    setCustomerToken: drop,
+    subscribe: (listener) => tokenListeners.add(listener),
+    getCartId: () => base.getCartId(),
+    setCartId: (id) => base.setCartId(id),
+    getAnonymousSession: () => null,
+    setAnonymousSession: drop,
+    getSiteCode: () => base.getSiteCode(),
+    setSiteCode: (code) => base.setSiteCode(code),
+    getLanguage: () => base.getLanguage(),
+    setLanguage: (language) => base.setLanguage(language),
+    getActiveLegalEntityId: () => base.getActiveLegalEntityId(),
+    setActiveLegalEntityId: (id) => base.setActiveLegalEntityId(id),
+    getRefreshToken: () => null,
+    setRefreshToken: drop,
+    getSaasToken: () => null,
+    setSaasToken: drop,
+    subscribeAll(listener) {
+      const own = keyListeners.add(listener);
+      const passed = base.subscribeAll?.((key) => {
+        if (!TOKEN_KEYS.has(key)) listener(key);
+      });
+      return () => {
+        own();
+        passed?.();
+      };
+    },
+    setProxyAuthenticated(next) {
+      if (next === current) return;
+      current = next;
+      tokenListeners.notify(token());
+      keyListeners.notify("customerToken");
+    }
+  };
+}
+
+// src/core/logger.ts
+var LEVEL = {
+  trace: 10,
+  debug: 20,
+  info: 30,
+  warn: 40,
+  error: 50,
+  silent: 60
+};
+function isValidLevel(v) {
+  return v !== void 0 && v in LEVEL;
+}
+function readEnv(name) {
+  try {
+    return typeof process !== "undefined" && process.env ? process.env[name] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var LevelResolver = class {
+  constructor(cfg, warn = () => {
+  }) {
+    this.warn = warn;
+    this.cfgLevel = cfg.level ?? "warn";
+    this.cfgServices = { ...cfg.services };
+  }
+  warn;
+  cfgLevel;
+  cfgServices;
+  forcedServices = {};
+  forcedGlobal;
+  warned = false;
+  envFor(svc) {
+    const raw = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`);
+    if (raw === void 0) return void 0;
+    if (isValidLevel(raw)) return raw;
+    if (!this.warned) {
+      this.warned = true;
+      this.warn(`Invalid EMPORIX_LOG_LEVEL_${svc.toUpperCase()}="${raw}" ignored`);
+    }
+    return void 0;
+  }
+  envGlobal() {
+    const raw = readEnv("EMPORIX_LOG_LEVEL");
+    if (raw === void 0) return void 0;
+    if (isValidLevel(raw)) return raw;
+    if (!this.warned) {
+      this.warned = true;
+      this.warn(`Invalid EMPORIX_LOG_LEVEL="${raw}" ignored`);
+    }
+    return void 0;
+  }
+  /**
+   * Effective level for a service. Forced overrides (from `set(..., force)`)
+   * take precedence over env vars; otherwise env > programmatic config.
+   */
+  get(svc) {
+    return this.forcedServices[svc] ?? this.envFor(svc) ?? this.forcedGlobal ?? this.envGlobal() ?? this.cfgServices[svc] ?? this.cfgLevel ?? "warn";
   }
-  return fromWebStorage(store, opts);
-}
-function createCookieStorage(opts = {}) {
-  const sameSite = opts.sameSite ?? "lax";
-  const secure = opts.secure ?? browser.location?.protocol === "https:";
-  const doc = browser.document;
-  if (doc === void 0) {
-    console.warn("[emporix] document unavailable; cookie storage falling back to in-memory");
-    return createMemoryStorage();
+  /** Numeric effective level for a service. */
+  numericLevel(svc) {
+    return LEVEL[this.get(svc)];
   }
-  const attrs = `path=/; SameSite=${sameSite}${secure ? "; Secure" : ""}`;
-  const all = createListenerSet();
-  const storage = createCookieBackedStorage(
-    {
-      get: (name) => {
-        for (const part of doc.cookie.split("; ")) {
-          const [k, ...v] = part.split("=");
-          if (k === name) return decodeURIComponent(v.join("=")) || null;
+  /** True if `svc`'s effective level allows emitting at `at`. */
+  isAtLeast(svc, at) {
+    return this.numericLevel(svc) <= LEVEL[at];
+  }
+  /** Mutates programmatic level (global or one service). Env-set levels are sticky unless `force`. */
+  set(level, svc, force = false) {
+    if (svc) {
+      const envBound = readEnv(`EMPORIX_LOG_LEVEL_${svc.toUpperCase()}`) !== void 0;
+      if (envBound && !force) {
+        this.warn(`Level for "${svc}" is env-controlled; pass force to override`);
+        return;
+      }
+      if (force) this.forcedServices[svc] = level;
+      else this.cfgServices[svc] = level;
+    } else {
+      const envBound = readEnv("EMPORIX_LOG_LEVEL") !== void 0;
+      if (envBound && !force) {
+        this.warn("Global level is env-controlled; pass force to override");
+        return;
+      }
+      if (force) this.forcedGlobal = level;
+      else this.cfgLevel = level;
+    }
+  }
+};
+var DEFAULT_REDACT = /* @__PURE__ */ new Set([
+  "authorization",
+  "password",
+  "oldpassword",
+  "newpassword",
+  "clientsecret",
+  "secret",
+  "access_token",
+  "refresh_token",
+  "customertoken",
+  "saastoken",
+  "saas-token",
+  "bearertoken",
+  "apikey",
+  "token"
+]);
+function redact(value, extra = []) {
+  const keys = new Set(DEFAULT_REDACT);
+  for (const k of extra) keys.add(k.toLowerCase());
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const src = v;
+      if (typeof src.kind === "string" && "token" in src) return { kind: src.kind };
+      const out = {};
+      for (const [k, val] of Object.entries(src)) {
+        if (keys.has(k.toLowerCase())) {
+          out[k] = k.toLowerCase() === "authorization" && typeof val === "string" ? "Bearer ***redacted***" : "***redacted***";
+        } else {
+          out[k] = walk(val);
         }
-        return null;
-      },
-      set: (name, value) => {
-        doc.cookie = value === null ? `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; ${attrs}` : `${name}=${encodeURIComponent(value)}; ${attrs}`;
       }
-    },
-    {
-      ...opts.name !== void 0 ? { tokenName: opts.name } : {},
-      notify: (key) => all.notify(key)
+      return out;
     }
-  );
-  return { ...storage, subscribeAll: (l) => all.add(l) };
+    return v;
+  };
+  return walk(value);
+}
+var EMIT = {
+  trace: LEVEL.trace,
+  debug: LEVEL.debug,
+  info: LEVEL.info,
+  warn: LEVEL.warn,
+  error: LEVEL.error
+};
+var BaseLogger = class {
+  constructor(resolver, bindings, extraRedact) {
+    this.resolver = resolver;
+    this.bindings = bindings;
+    this.extraRedact = extraRedact;
+  }
+  resolver;
+  bindings;
+  extraRedact;
+  svc() {
+    return this.bindings.service ?? "http";
+  }
+  get level() {
+    return this.resolver.get(this.svc());
+  }
+  isLevelEnabled(level) {
+    return this.resolver.isAtLeast(this.svc(), level);
+  }
+  at(level, msg, fields) {
+    if (this.resolver.numericLevel(this.svc()) > EMIT[level]) return;
+    const merged = { ...this.bindings, ...fields ?? {} };
+    this.emit(level, msg, redact(merged, this.extraRedact));
+  }
+  trace(m, f) {
+    this.at("trace", m, f);
+  }
+  debug(m, f) {
+    this.at("debug", m, f);
+  }
+  info(m, f) {
+    this.at("info", m, f);
+  }
+  warn(m, f) {
+    this.at("warn", m, f);
+  }
+  error(m, f) {
+    this.at("error", m, f);
+  }
+};
+var ConsoleLogger = class _ConsoleLogger extends BaseLogger {
+  constructor(resolver, bindings, extra, sink, pretty) {
+    super(resolver, bindings, extra);
+    this.sink = sink;
+    this.pretty = pretty;
+  }
+  sink;
+  pretty;
+  emit(level, msg, fields) {
+    if (this.pretty) {
+      const fn = level === "error" ? this.sink.error : level === "warn" ? this.sink.warn : level === "info" ? this.sink.info : this.sink.log;
+      fn(`[${level}] ${msg}`, fields);
+    } else {
+      this.sink.log(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg, ...fields }));
+    }
+  }
+  child(bindings) {
+    return new _ConsoleLogger(
+      this.resolver,
+      { ...this.bindings, ...bindings },
+      this.extraRedact,
+      this.sink,
+      this.pretty
+    );
+  }
+};
+var NoopLogger = class {
+  level = "silent";
+  isLevelEnabled() {
+    return false;
+  }
+  trace() {
+  }
+  debug() {
+  }
+  info() {
+  }
+  warn() {
+  }
+  error() {
+  }
+  child() {
+    return this;
+  }
+};
+function createConsoleLogger(resolver, bindings = {}, opts = {}) {
+  const pretty = opts.pretty ?? readEnv("NODE_ENV") !== "production";
+  const sink = opts.sink ?? {
+    log: console.log,
+    info: console.info,
+    warn: console.warn,
+    error: console.error
+  };
+  return new ConsoleLogger(resolver, bindings, opts.redact ?? [], sink, pretty);
+}
+function createNoopLogger() {
+  return new NoopLogger();
 }
 
 // src/core/query-keys.ts
@@ -687,20 +769,72 @@ var HttpClient = class {
   sleep;
   /** Resolved request fetch. The arrow keeps `globalThis.fetch` correctly bound. */
   doFetch;
+  /**
+   * `null` in proxy mode, where no token is resolved at all — the provider is
+   * never asked, so no token request can happen. A service context is refused
+   * there rather than sent anonymously through the proxy.
+   */
+  async tokenFor(o) {
+    if (!this.opts.proxy) return resolveToken(o.auth, this.opts.provider);
+    if (o.auth.kind === "service") {
+      throw new EmporixAuthError(
+        `${o.method} ${o.path}: auth.service() is not available in proxy mode \u2014 service tokens never belong in a browser. Make this call from your server.`
+      );
+    }
+    return null;
+  }
+  /** `host + path` plus query. A relative host (`/emporix`) resolves against the page origin. */
+  urlFor(o) {
+    const host = this.opts.host;
+    let url;
+    if (host.startsWith("/")) {
+      const origin = globalThis.location?.origin;
+      if (!origin) {
+        throw new EmporixError(
+          `host "${host}" is a path, which needs a page origin to resolve against, and globalThis.location is not available here. Use an absolute host on a server.`
+        );
+      }
+      url = new URL(host + o.path, origin);
+    } else {
+      url = new URL(host + o.path);
+    }
+    for (const [k, v] of Object.entries(o.query ?? {})) {
+      if (v !== void 0) url.searchParams.set(k, String(v));
+    }
+    return url;
+  }
+  /** Proxy mode: report the 401 before it is thrown. A throwing callback must not mask it. */
+  reportUnauthorized(o) {
+    try {
+      this.opts.proxy?.onUnauthorized?.({ method: o.method, path: o.path });
+    } catch {
+    }
+  }
   buildHeaders(o, token, isFormData) {
-    return {
+    const headers = {
       // Before `o.headers` on purpose: a caller may override the tenant for a
       // single request, the way `Accept-Language` and `Content-Language` can be
       // overridden. Only `Authorization` is non-negotiable.
       ...this.opts.tenant !== void 0 ? { "Emporix-Tenant": this.opts.tenant } : {},
       ...this.opts.requestContext?.language ? { "Accept-Language": this.opts.requestContext.language } : {},
       ...this.opts.contentLanguage && o.body !== void 0 ? { "Content-Language": this.opts.contentLanguage } : {},
+      ...this.opts.proxy?.headers ?? {},
       ...o.headers ?? {},
-      Authorization: `Bearer ${token}`,
+      ...token !== null ? { Authorization: `Bearer ${token}` } : {},
       // JSON bodies: set Content-Type. FormData bodies: let `fetch`
       // emit `multipart/form-data; boundary=...` itself.
       ...o.body !== void 0 && !isFormData ? { "Content-Type": "application/json" } : {}
     };
+    if (token === null) {
+      for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === "authorization") delete headers[k];
+      }
+    }
+    return headers;
+  }
+  /** `fetch`'s `credentials` — set only in proxy mode, where the session cookie must go along. */
+  credentialsInit() {
+    return this.opts.proxy ? { credentials: this.opts.proxy.credentials } : {};
   }
   /**
    * Issues a request and returns the parsed body. Retries 5xx/429 on idempotent
@@ -723,17 +857,14 @@ var HttpClient = class {
   async send(o) {
     const requestId = `req-${++requestSeq}`;
     const log = this.opts.logger.child({ requestId });
-    const url = new URL(this.opts.host + o.path);
-    for (const [k, v] of Object.entries(o.query ?? {})) {
-      if (v !== void 0) url.searchParams.set(k, String(v));
-    }
+    const url = this.urlFor(o);
     const sdkManaged = o.auth.kind === "service" || o.auth.kind === "anonymous";
     const maxAttempts = this.opts.retry.maxAttempts;
     let reauthed = false;
     let customerToken = o.auth.kind === "customer" ? o.auth.token : void 0;
     let customerReauthed = false;
     for (let attempt = 1; ; attempt++) {
-      const token = customerToken ?? await resolveToken(o.auth, this.opts.provider);
+      const token = !this.opts.proxy && customerToken !== void 0 ? customerToken : await this.tokenFor(o);
       log.debug("http request", {
         authKind: o.auth.kind,
         method: o.method,
@@ -757,7 +888,8 @@ var HttpClient = class {
       const init = {
         method: o.method,
         headers: this.buildHeaders(o, token, isFormData),
-        signal: controller.signal
+        signal: controller.signal,
+        ...this.credentialsInit()
       };
       if (o.body !== void 0) {
         init.body = isFormData ? o.body : JSON.stringify(o.body);
@@ -790,6 +922,10 @@ var HttpClient = class {
         return { data: parsed, headers: res.headers };
       }
       if (res.status === 401) {
+        if (this.opts.proxy) {
+          this.reportUnauthorized(o);
+          throw errorFromResponse(res.status, `${o.method} ${o.path} \u2192 401`, parsed);
+        }
         if (sdkManaged && !reauthed) {
           reauthed = true;
           if (o.auth.kind === "service") {
@@ -842,11 +978,8 @@ var HttpClient = class {
   async requestRaw(o, extra) {
     const requestId = `req-${++requestSeq}`;
     const log = this.opts.logger.child({ requestId });
-    const url = new URL(this.opts.host + o.path);
-    for (const [k, v] of Object.entries(o.query ?? {})) {
-      if (v !== void 0) url.searchParams.set(k, String(v));
-    }
-    const token = await resolveToken(o.auth, this.opts.provider);
+    const url = this.urlFor(o);
+    const token = await this.tokenFor(o);
     log.debug("http requestRaw", {
       authKind: o.auth.kind,
       method: o.method,
@@ -863,13 +996,15 @@ var HttpClient = class {
       method: o.method,
       headers: this.buildHeaders(o, token, isFormData),
       signal: controller.signal,
-      ...extra?.redirect ? { redirect: extra.redirect } : {}
+      ...extra?.redirect ? { redirect: extra.redirect } : {},
+      ...this.credentialsInit()
     };
     if (o.body !== void 0) {
       init.body = isFormData ? o.body : JSON.stringify(o.body);
     }
+    let res;
     try {
-      return await this.doFetch(url, init);
+      res = await this.doFetch(url, init);
     } catch (err) {
       if (err.name === "AbortError") {
         throw new EmporixTimeoutError(
@@ -882,6 +1017,12 @@ var HttpClient = class {
     } finally {
       clearTimeout(timer);
     }
+    if (this.opts.proxy && res.status === 401) {
+      this.reportUnauthorized(o);
+      const text = await res.text().catch(() => "");
+      throw errorFromResponse(401, `${o.method} ${o.path} \u2192 401`, text ? safeJson(text) : void 0);
+    }
+    return res;
   }
   /**
    * Open a Server-Sent Events stream (`text/event-stream`) and yield parsed
@@ -893,11 +1034,8 @@ var HttpClient = class {
    */
   async *requestStream(o) {
     const log = this.opts.logger.child({ requestId: `req-${++requestSeq}` });
-    const url = new URL(this.opts.host + o.path);
-    for (const [k, v] of Object.entries(o.query ?? {})) {
-      if (v !== void 0) url.searchParams.set(k, String(v));
-    }
-    const token = await resolveToken(o.auth, this.opts.provider);
+    const url = this.urlFor(o);
+    const token = await this.tokenFor(o);
     const controller = new AbortController();
     const connectTimer = setTimeout(() => controller.abort(), this.opts.timeouts.connectMs);
     const headers = this.buildHeaders(o, token, false);
@@ -908,7 +1046,8 @@ var HttpClient = class {
         method: o.method,
         headers,
         signal: controller.signal,
-        ...o.body !== void 0 ? { body: JSON.stringify(o.body) } : {}
+        ...o.body !== void 0 ? { body: JSON.stringify(o.body) } : {},
+        ...this.credentialsInit()
       });
     } catch (err) {
       clearTimeout(connectTimer);
@@ -921,6 +1060,7 @@ var HttpClient = class {
     }
     clearTimeout(connectTimer);
     if (!res.ok) {
+      if (this.opts.proxy && res.status === 401) this.reportUnauthorized(o);
       const text = await res.text().catch(() => "");
       throw errorFromResponse(
         res.status,
@@ -948,7 +1088,7 @@ var HttpClient = class {
 };
 
 // package.json
-var version = "4.10.0";
+var version = "4.11.1";
 
 // src/version.ts
 var SDK_VERSION = version;
@@ -971,8 +1111,19 @@ function createCore(config) {
     sdkVersion: SDK_VERSION,
     tenant: cfg.tenant
   });
-  const tokenProvider = cfg.tokenProvider ?? new DefaultTokenProvider(cfg);
+  const tokenProvider = cfg.proxy ? createProxyModeTokenProvider() : cfg.tokenProvider ?? new DefaultTokenProvider(cfg);
   const customerRefresh = new CustomerRefreshRegistry();
+  const unauthorized = createListenerSet();
+  const proxy = cfg.proxy && {
+    ...cfg.proxy,
+    onUnauthorized: (info) => {
+      try {
+        cfg.proxy?.onUnauthorized?.(info);
+      } finally {
+        unauthorized.notify(info);
+      }
+    }
+  };
   const requestContext = {
     language: cfg.credentials.storefront?.context?.language
   };
@@ -992,7 +1143,8 @@ function createCore(config) {
       // exactOptionalPropertyTypes: `{ fetch: undefined }` is a type error
       // against `fetch?: typeof globalThis.fetch`, so spread conditionally.
       ...cfg.fetch !== void 0 ? { fetch: cfg.fetch } : {},
-      ...cfg.contentLanguage !== void 0 ? { contentLanguage: cfg.contentLanguage } : {}
+      ...cfg.contentLanguage !== void 0 ? { contentLanguage: cfg.contentLanguage } : {},
+      ...proxy ? { proxy } : {}
     })
   });
   return {
@@ -1017,6 +1169,9 @@ function createCore(config) {
     },
     setCustomerTokenRefresher(refresher) {
       customerRefresh.set(refresher);
+    },
+    onUnauthorized(listener) {
+      return unauthorized.add(listener);
     }
   };
 }
@@ -5863,6 +6018,15 @@ var EmporixClient = class {
   setCustomerTokenRefresher(refresher) {
     this.core.setCustomerTokenRefresher(refresher);
   }
+  /**
+   * Proxy mode (`config.proxy`): subscribes to the 401s the proxy answers, next
+   * to `proxy.onUnauthorized`. Returns the unsubscribe function. The React
+   * `EmporixProvider` uses it for `onCustomerSessionExpired`. Never fires outside
+   * proxy mode — there a 401 is answered by re-authenticating.
+   */
+  onUnauthorized(listener) {
+    return this.core.onUnauthorized(listener);
+  }
 };
 
 // src/create-emporix-client.ts
@@ -5899,6 +6063,6 @@ function productYrn(tenant, productId) {
   return `urn:yaas:hybris:product:product:${tenant};${productId}`;
 }
 
-export { AiService, ApprovalService, AuditLogService, BrandService, CatalogService, ClientConfigService, CloudFunctionsService, CountryService, CouponService, CurrencyService, CustomerAdminService, DEFAULT_HOST, EmporixClient, FeeService, HttpClient, ImportService, IndexingService, InvoiceService, LEVEL, LabelService, LevelResolver, QuoteService, RagIndexerService, ReturnsService, RewardPointsService, STORAGE_KEYS, SchemaService, SearchService, SequentialIdService, SessionContextService, ShippingService, ShoppingListService, SiteService, TaxService, TenantConfigService, UnitHandlingService, VendorService, WebhookService, approvalStatusPatch, createConsoleLogger, createCookieBackedStorage, createCookieStorage, createCore, createEmporixClient, createListenerSet, createLocalStorage, createLocalStorageStorage, createMemoryStorage, createNoopLogger, createServerStorage, createSessionStorage, emporixKey, fromWebStorage, getCustomerSessionStore, parseAnonymousSession, pickFee, productIdFromYrn, productYrn, redact, resolveZone, serverAuth, siteMeta, validateConfig };
+export { AiService, ApprovalService, AuditLogService, BrandService, CatalogService, ClientConfigService, CloudFunctionsService, CountryService, CouponService, CurrencyService, CustomerAdminService, DEFAULT_HOST, EmporixClient, FeeService, HttpClient, ImportService, IndexingService, InvoiceService, LEVEL, LabelService, LevelResolver, PROXY_CUSTOMER_TOKEN, QuoteService, RagIndexerService, ReturnsService, RewardPointsService, STORAGE_KEYS, SchemaService, SearchService, SequentialIdService, SessionContextService, ShippingService, ShoppingListService, SiteService, TaxService, TenantConfigService, UnitHandlingService, VendorService, WebhookService, approvalStatusPatch, createConsoleLogger, createCookieBackedStorage, createCookieStorage, createCore, createEmporixClient, createListenerSet, createLocalStorage, createLocalStorageStorage, createMemoryStorage, createNoopLogger, createProxyModeTokenProvider, createProxySessionStorage, createServerStorage, createSessionStorage, emporixKey, fromWebStorage, getCustomerSessionStore, parseAnonymousSession, pickFee, productIdFromYrn, productYrn, redact, resolveZone, serverAuth, siteMeta, validateConfig };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map