@viu/emporix-sdk 4.2.3 → 4.3.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @viu/emporix-sdk
 
+## 4.3.0
+
+### Minor Changes
+
+- [#387](https://github.com/viuteam/emporix-sdk/pull/387) [`46f6caa`](https://github.com/viuteam/emporix-sdk/commit/46f6caa6206d975a97a1aa829f93b6159bf8df2f) Thanks [@amnael1](https://github.com/amnael1)! - Align `media.update` and the helpers built on it with the Media spec.
+  
+  - **`attachToProduct` / `detachFromProduct` follow the spec** (checked against the spec, not a live tenant). They sent a JSON `PUT` of `{ type, refIds }`, which the spec rejects for both asset types: a BLOB takes no JSON `PUT`, and a LINK's requires `access` and `url`. They now send a JSON Patch that touches only `refIds` (`add /refIds/-`, `replace /refIds`) and still resolve to the asset, with the change applied.
+  - **Type change — `update()` and `replaceFile()` resolve to `void`.** The `PUT` answers `204` with no body, so they always resolved to `undefined` at runtime despite promising an `Asset`. Code that read the result was already broken; it now fails to compile instead.
+  - **Type change — the JSON body of `update()` is `AssetUpdateLinkInput`.** The spec takes JSON only for a LINK asset. A BLOB is replaced with `{ kind: "blob", file, body }` (or `replaceFile()`), and its metadata alone is changed with `patch()`. `AssetUpdateInput` stays exported but is deprecated.
+  
+  Both type changes only affect code that, per the spec, did not work before — hence a minor rather than a major.
+
+- [#388](https://github.com/viuteam/emporix-sdk/pull/388) [`4d8685e`](https://github.com/viuteam/emporix-sdk/commit/4d8685eeb5138a8d1198f6257e8abb5ae35be236) Thanks [@amnael1](https://github.com/amnael1)! - Follow what the live Media API requires on top of the spec, found by running the facade against a tenant.
+  
+  - **Type change — `update()` requires `metadata.version`** in both bodies (`AssetUpdateLinkInput`, `AssetUpdateBlobInput`). The spec marks it optional, but the API answers `400` «`metadata.version` is required for update» without it.
+  - **`replaceFile()` works without a `version`.** It sent none and got that `400`; it now reads the current version first. Pass `version` for optimistic locking (a stale one gets a `409`).
+  - **`attachToProduct` / `detachFromProduct` return the asset as read back after the patch.** The API answers `204` to a reference to a product that does not exist and drops it, so the locally computed result could claim an attachment that never happened.
+
+## 4.2.4
+
+### Patch Changes
+
+- [#381](https://github.com/viuteam/emporix-sdk/pull/381) [`f151f7c`](https://github.com/viuteam/emporix-sdk/commit/f151f7ca11c32d1aa68355a5efbf36286e7b78ac) Thanks [@amnael1](https://github.com/amnael1)! - Export from the package root every type a public method takes or returns. These were reachable only through a subpath or not at all, so a call like `imports.getLicense()` returned an `ImportLicense` that could not be named: `ImportStats`, `ImportStatsQuery`, `ImportJobGroup`, `ImportHealthThresholds`, `ImportLicense`, `LegalEntitySearchInput`, `QuoteReasonsResource`, `CustomerTokenValidation`, `CartItemBatchEntry`, `CartItemsBatchResponse`, `SegmentGroup`, `SegmentGroupInput`, `SessionContextData`, `SiteAddress`, `SiteHomeBase`, and the AI sub-resources `AgenticCrudResource`, `JobsResource`, `TemplatesResource`, `LogsResource` and `AnalyticsResource`. Type-only; no runtime change.
+
 ## 4.2.3
 
 ### Patch Changes

package/README.md

@@ -72,12 +72,14 @@ The sections below highlight the most-used services; per-service guides live in
 
 ## Searching by mixin (custom) fields
 
-`products.search`, `categories.search`, `orders.listMine(auth, { q })`,
-`customerAdmin.searchCustomers({ q })` and `vendors.searchVendors({ q })` accept a
-raw Emporix `q` string **or** a type-safe filter built with `mixinQuery` from
-[`@viu/emporix-mixins`](../mixins). The filter is entity-gated (a filter built for
-one entity is a compile error on another) and an `or()` filter is rejected on
-services that don't support `compoundLogicalQuery`.
+`products.search`, `categories.search`, `categories.searchByQuery`,
+`orders.listMine(auth, { q })`, `orders.listForLegalEntity(id, auth, { q })`,
+`salesOrders.list(auth, { q })`, `customerAdmin.searchCustomers({ q })` and
+`vendors.searchVendors({ q })` accept a raw Emporix `q` string **or** a type-safe
+filter built with `mixinQuery` from [`@viu/emporix-mixins`](../mixins). The
+filter is entity-gated (a filter built for one entity is a compile error on
+another) and an `or()` filter is rejected on services that don't support
+`compoundLogicalQuery`.
 
 ```ts
 import { mixinQuery } from "@viu/emporix-mixins";
@@ -96,7 +98,7 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
 | `tenant` (required) | — | lowercase, 3–16 chars, `^[a-z][a-z0-9]{2,15}$` |
 | `credentials` (required) | — | the object itself is required; which sets it holds is up to you |
 | `credentials.backend` | — | `{ clientId, secret, scope? }` — service token |
-| `credentials.storefront` | — | `{ clientId }` — anonymous token (no secret) |
+| `credentials.storefront` | — | `{ clientId, context? }` — anonymous token (no secret). `context` holds `currency` / `siteCode` / `targetLocation`, bound to the anonymous token and needed by `prices.matchByContext`, plus `language` (`Accept-Language`); `sdk.setStorefrontContext()` switches it at runtime |
 | `credentials.custom` | — | `Record<name, { clientId, secret, scope? }>` |
 | `host` | `https://api.emporix.io` | |
 | `timeouts` | `{ connectMs: 10000, readMs: 60000 }` | |
@@ -104,6 +106,7 @@ See [`../../docs/mixin-search.md`](../../docs/mixin-search.md) for the capabilit
 | `cache` | `{ expirationBufferSeconds: 60, maxLifetimeSeconds: 3600 }` | token cache |
 | `logger` | console @ `warn` | `false`, a `Logger`, or `{ level, services, pretty, redact }` |
 | `tokenProvider` | built-in | inject for SSO/token-exchange |
+| `fetch` | global `fetch` | replaces `fetch` for API requests; token requests and SSE streams keep the global one |
 
 `credentials: {}` is legal: a client that never mints its own token, for when the
 token comes from outside. The Managed Dashboard module in
@@ -115,8 +118,10 @@ anonymous browsing, both when you need both.
 ## AuthContext per method
 
 `auth.service(name?)`, `auth.anonymous()`, `auth.customer(token)`,
-`auth.raw(token)`. The last argument of every service method is the
-`AuthContext`; defaults below apply when omitted.
+`auth.raw(token)`. The `AuthContext` is usually a service method's last
+argument — some take options after it (`orders.listMine(auth, opts)`,
+`availability.get(productId, siteCode, auth, opts)`); defaults below apply when
+omitted.
 
 | Method | Default | Required kind |
 | --- | --- | --- |
@@ -124,7 +129,8 @@ anonymous browsing, both when you need both.
 | `customers.me` / `.update` / `.changePassword` / `.addresses.*` | — | `customer` or `raw` |
 | `customers.anonymous()` | — | obtains anonymous session (token ignored) |
 | `products.*` / `categories.*` (reads) | `anonymous` | — (pass `customer` for personalized pricing) |
-| `carts.*` | — | explicit `customer` or `anonymous` |
+| `carts.*` (shopper methods) | — | explicit `customer` or `anonymous` |
+| `carts.search` / `.delete` / `.update` | — | any kind, unguarded — `service` for admin use; the server enforces scope |
 | `carts.merge` | — | `customer` |
 | `carts.execute` ([command chains](../../docs/cart.md)) | — | `customer`, `anonymous`, or `service` with `cart.cart_manage` |
 | `companies.*` / `contacts.*` / `locations.*` / `customerGroups.*` (B2B) | — | `customer` (reads need `*_read_own`; mutations need `*_manage`) |
@@ -133,7 +139,9 @@ anonymous browsing, both when you need both.
 `AuthContext` is **per call, never stored** — one client safely serves many
 concurrent shoppers (SSR/edge/multi-tenant). SDK-managed (`service`/`anonymous`)
 401s refresh-and-retry once; caller-managed (`customer`/`raw`) 401s propagate as
-`EmporixAuthError`. Full details in [`../../docs/auth.md`](../../docs/auth.md).
+`EmporixAuthError` — unless a refresher is registered with
+`sdk.setCustomerTokenRefresher(...)`, which refreshes and retries a `customer`
+401 once. Full details in [`../../docs/auth.md`](../../docs/auth.md).
 
 ## Logging
 
@@ -161,11 +169,20 @@ customer's role lacks scope for surface as `EmporixInsufficientScopeError`
 ## Media
 
 `sdk.media` covers the full `/media/{tenant}/assets/*` surface: create
-(`uploadFile` / `link` / `create`), list (paginated, `PaginatedItems<Asset>`),
-get, update (JSON metadata or BLOB multipart file-replacement via the
-`replaceFile` sugar), remove, and download (resolves to either a redirect
-URL for `PUBLIC` assets or an `ArrayBuffer` for `PRIVATE`). All endpoints
-require a server-only scope — every call defaults to a `service`
+(`uploadFile` / `link` / `create`, or `startUploadSession` for a direct upload
+to storage once Emporix Support enables it for the tenant), list (paginated,
+`PaginatedItems<Asset>`), get, update (a `PUT` that needs `metadata.version` and
+resolves to nothing: JSON for a LINK asset, multipart file replacement for a
+BLOB, also via the `replaceFile` sugar, which reads the version when you pass
+none), `patch` (JSON Patch — the way to change a BLOB's metadata without
+re-uploading the file; `attachToProduct` / `detachFromProduct` use it and return
+the asset as read back, since a reference to an unknown product is dropped
+silently), remove,
+`getDownloadUrl` (a storage URL with no size limit, which Emporix recommends for
+every download), and download (resolves to either a redirect URL for `PUBLIC`
+assets or an `ArrayBuffer` for `PRIVATE`; above the streaming limit, 30 MB by
+default, it fails with a `413` and only `getDownloadUrl` serves the file). All
+endpoints require a server-only scope — every call defaults to a `service`
 `AuthContext`. Storefronts read media via `product.productMedia` (denormalised
 on the product) or the `useProductMedia(productId)` hook, not by calling
 the Media service directly. See [`../../docs/media.md`](../../docs/media.md).
@@ -186,13 +203,28 @@ stock record. There is no restock-date field.
 ## Subpath exports
 
 `@viu/emporix-sdk` (the package root) re-exports **everything** — every service,
-type, and helper. Tree-shakeable subpaths are published for the high-traffic
+type, and helper. Subpaths are published for the high-traffic
 services: `./customer`, `./product`, `./category`, `./cart`, `./checkout`,
 `./payment`, `./price`, `./media`, `./segment`, `./companies`, `./contacts`,
 `./locations`, `./customer-groups`, `./orders`, `./availability`. All other
 services (Tax, Coupon, RewardPoints, Shipping, Returns, Catalog, Vendor,
 CustomerAdmin, Approval, …) are reached from the package root.
 
+A subpath import alone does not shrink a bundle: `EmporixClient` imports every
+service. When bundle size matters, build the client with `createEmporixClient`,
+which instantiates only the service classes you pass (`segments` also needs
+`products` and `categories` in the map):
+
+```ts
+import { createEmporixClient, ProductService, CartService } from "@viu/emporix-sdk";
+
+const sdk = createEmporixClient(
+  { tenant: "mytenant", credentials: { storefront: { clientId: "..." } } },
+  { products: ProductService, carts: CartService },
+);
+const products = await sdk.products.list(); // no other service is bundled
+```
+
 ## Changelog
 
 npmjs.com renders only this README, never a changelog — the registry has no field

package/dist/{chunk-5MPL4XBD.js → chunk-NFSO7WUA.js}

@@ -70,37 +70,31 @@ var MediaService = class {
     });
   }
   /**
-   * Update an asset. The input is a discriminated union mirroring
-   * {@link create}:
-   * - `{ kind: "json", body }` — metadata-only patch (BLOB or LINK).
-   *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,
-   *   or `url` changes.
-   * - `{ kind: "blob", file, body }` — replaces the BLOB file content
-   *   (max 30 MB) AND patches metadata in the same request. Sends
-   *   `multipart/form-data`.
+   * Replace an asset (`PUT`, HTTP 204 — nothing is returned). The spec takes one
+   * body per asset type, mirrored by the discriminated input:
+   * - `{ kind: "json", body }` — a LINK asset, sent as `application/json`. The
+   *   body is the whole asset: `type: "LINK"`, `access` and `url` are required.
+   * - `{ kind: "blob", file, body }` — a BLOB asset, sent as
+   *   `multipart/form-data`: the file (max 30 MB) and the asset body, both
+   *   required, so this always replaces the bytes.
    *
-   * `type` and `access` are immutable per Emporix — they must match the
-   * existing asset's values. Optimistic-locking is via `body.metadata.version`;
-   * the server returns 409 Conflict on a stale version.
+   * A BLOB's metadata alone — `refIds`, `details`, mixins — goes through
+   * {@link patch}. Earlier versions also took a BLOB as the JSON body and
+   * promised the updated asset in return; the spec allows neither.
+   *
+   * `type` and `access` are immutable. Optimistic locking is via
+   * `body.metadata.version`; a stale one gets a 409.
    */
   async update(assetId, input, auth = SERVICE) {
+    const path = `${this.base()}/${encodeURIComponent(assetId)}`;
     if (input.kind === "blob") {
       const fd = new FormData();
       fd.set("file", input.file);
       fd.set("body", JSON.stringify(input.body));
-      return this.ctx.http.request({
-        method: "PUT",
-        path: `${this.base()}/${assetId}`,
-        auth,
-        body: fd
-      });
+      await this.ctx.http.request({ method: "PUT", path, auth, body: fd });
+      return;
     }
-    return this.ctx.http.request({
-      method: "PUT",
-      path: `${this.base()}/${assetId}`,
-      auth,
-      body: input.body
-    });
+    await this.ctx.http.request({ method: "PUT", path, auth, body: input.body });
   }
   /**
    * Partially update an asset with an RFC-6902 JSON-Patch op-array
@@ -283,12 +277,17 @@ var MediaService = class {
   }
   /**
    * Replace the file content of an existing BLOB asset. Sugar over
-   * {@link update} with `kind: "blob"`. `access` is required because the
-   * field is immutable and the server validates that the patch matches.
-   * Pass `version` from `asset.metadata.version` if you want optimistic
-   * locking (recommended when concurrent writers are possible).
+   * {@link update} with `kind: "blob"`, and like it resolves to nothing — the
+   * PUT answers 204. `access` is required because the field is immutable and
+   * the server validates that the body matches.
+   *
+   * Pass `version` from `asset.metadata.version` for optimistic locking
+   * (recommended when concurrent writers are possible) — a stale one gets a 409.
+   * Without it the current version is read first, because the live API rejects
+   * an update that carries none; the write then wins over any in between.
    */
   async replaceFile(assetId, input, auth = SERVICE) {
+    const version = input.version ?? (await this.get(assetId, auth)).metadata?.version ?? 1;
     const body = {
       type: "BLOB",
       access: input.access,
@@ -298,7 +297,7 @@ var MediaService = class {
           ...input.mimeType ? { mimeType: input.mimeType } : {}
         }
       } : {},
-      ...input.version !== void 0 ? { metadata: { version: input.version } } : {}
+      metadata: { version }
     };
     return this.update(assetId, { kind: "blob", file: input.file, body }, auth);
   }
@@ -312,23 +311,42 @@ var MediaService = class {
     };
     return this.create({ kind: "link", body }, auth);
   }
-  /** Idempotently add a PRODUCT refId to an asset. */
+  /**
+   * Idempotently add a PRODUCT refId to an asset, through a JSON Patch that
+   * appends the one reference, so it works for BLOB and LINK alike and leaves
+   * the rest of the asset alone.
+   *
+   * Resolves to the asset as read back after the patch, because Emporix answers
+   * 204 to a reference to a product that does not exist and drops it — check
+   * `refIds` rather than trusting the call. Only a PUBLIC asset takes a product
+   * reference; a PRIVATE one answers 400.
+   *
+   * Earlier versions sent a JSON PUT of `{ type, refIds }`, which the spec
+   * rejects for both types: a BLOB takes no JSON PUT, and a LINK's requires
+   * `access` and `url`.
+   */
   async attachToProduct(assetId, productId, auth = SERVICE) {
     const a = await this.get(assetId, auth);
     const refIds = a.refIds ?? [];
     if (refIds.some((r) => isProductRef(r, productId))) return a;
-    const next = [...refIds, { type: "PRODUCT", id: productId }];
-    const patch = { type: a.type, refIds: next };
-    return this.update(assetId, { kind: "json", body: patch }, auth);
+    const ref = { type: "PRODUCT", id: productId };
+    const op = a.refIds === void 0 ? { op: "add", path: "/refIds", value: [ref] } : { op: "add", path: "/refIds/-", value: ref };
+    await this.patch(assetId, [op], auth);
+    return this.get(assetId, auth);
   }
-  /** Remove a PRODUCT refId from an asset (no-op if absent). */
+  /**
+   * Remove a PRODUCT refId from an asset (no-op if absent), through a JSON Patch
+   * that replaces the references and nothing else. Resolves to the asset as
+   * read back after the patch, like {@link attachToProduct}. Earlier versions
+   * sent a spec-invalid JSON PUT, as that one did.
+   */
   async detachFromProduct(assetId, productId, auth = SERVICE) {
     const a = await this.get(assetId, auth);
     const refIds = a.refIds ?? [];
     const next = refIds.filter((r) => !isProductRef(r, productId));
     if (next.length === refIds.length) return a;
-    const patch = { type: a.type, refIds: next };
-    return this.update(assetId, { kind: "json", body: patch }, auth);
+    await this.patch(assetId, [{ op: "replace", path: "/refIds", value: next }], auth);
+    return this.get(assetId, auth);
   }
   /** Convenience: list assets attached to a product (server-side filter). */
   async listForProduct(productId, auth = SERVICE) {
@@ -338,5 +356,5 @@ var MediaService = class {
 var _internalMedia = { isProductRef };
 
 export { MediaService, _internalMedia };
-//# sourceMappingURL=chunk-5MPL4XBD.js.map
-//# sourceMappingURL=chunk-5MPL4XBD.js.map
+//# sourceMappingURL=chunk-NFSO7WUA.js.map
+//# sourceMappingURL=chunk-NFSO7WUA.js.map

package/dist/chunk-NFSO7WUA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/media.ts"],"names":["text"],"mappings":";;;;AA0FA,IAAM,OAAA,GAAuB,EAAE,IAAA,EAAM,SAAA,EAAU;AAE/C,SAAS,YAAA,CAAa,GAAe,SAAA,EAA4B;AAC/D,EAAA,OAAO,CAAA,CAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,EAAA,KAAO,SAAA;AAC1C;AAMO,IAAM,eAAN,MAAmB;AAAA,EAExB,YAA6B,GAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAAA,EAAqB;AAAA,EAArB,GAAA;AAAA,EAD7B,OAAgB,OAAA,GAAU,OAAA;AAAA,EAGlB,IAAA,GAAe;AACrB,IAAA,OAAO,CAAA,OAAA,EAAU,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA,OAAA,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,CACJ,KAAA,EAGA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAwB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,IAAA;AAAA,MACA,MAAM,KAAA,CAAM;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,IAAA,CACJ,KAAA,GAAyB,EAAC,EAC1B,OAAoB,OAAA,EACY;AAChC,IAAA,MAAM,UAAA,GAAa,MAAM,UAAA,IAAc,CAAA;AACvC,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,EAAA;AAInC,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,KAAA;AAChC,IAAA,OAAO,WAAA;AAAA,MACL,KAAK,GAAA,CAAI,IAAA;AAAA,MACT;AAAA,QACE,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,QAChB,IAAA;AAAA,QACA,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,YAAY,QAAA;AAAS,OACzC;AAAA,MACA,EAAE,UAAA,EAAY,QAAA,EAAU,GAAI,UAAA,KAAe,SAAY,EAAC,GAAI,EAAE,UAAA,EAAW;AAAG,KAC9E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAyB;AACtE,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAe;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,MAAA,CACJ,OAAA,EACA,KAAA,EAGA,OAAoB,OAAA,EACL;AACf,IAAA,MAAM,IAAA,GAAO,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAC1D,IAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,MAAA,MAAM,EAAA,GAAK,IAAI,QAAA,EAAS;AACxB,MAAA,EAAA,CAAG,GAAA,CAAI,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACzB,MAAA,EAAA,CAAG,IAAI,MAAA,EAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,CAAA;AACzE,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,KAAA,CAAM,OAAA,EAAiB,GAAA,EAAiB,OAAoB,OAAA,EAAwB;AACxF,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,OAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,kBAAA,CAAmB,OAAO,CAAC,CAAA,CAAA;AAAA,MACnD,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,MAAA,CAAO,OAAA,EAAiB,IAAA,GAAoB,OAAA,EAAwB;AACxE,IAAA,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAAc;AAAA,MAChC,MAAA,EAAQ,QAAA;AAAA,MACR,MAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,CAAA;AAAA,MAC/B;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,QAAA,CACJ,OAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,IAAI,OAAO,CAAA,SAAA,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,UAAA;AAAA,MAC9B,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAAA,MAC5B,EAAE,UAAU,QAAA;AAAS,KACvB;AAGA,IAAA,IAAI,GAAA,CAAI,MAAA,IAAU,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACzC,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AACtC,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,IAAI,YAAA;AAAA,UACR,CAAA,gBAAA,EAAmB,IAAI,MAAM,CAAA,mCAAA,CAAA;AAAA,UAC7B,GAAA,CAAI;AAAA,SACN;AAAA,MACF;AACA,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAA,EAAI;AAAA,IACjC;AAGA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,MAAA;AACxC,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,MAAA;AACvD,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAIzC,QAAA,MAAMA,KAAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,QAAA,MAAM,GAAA,GAAM,KAAKA,KAAI,CAAA;AACrB,QAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,QAAA,IAAA,GAAO,GAAA,CAAI,MAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,GAAO,MAAM,IAAI,WAAA,EAAY;AAAA,MAC/B;AACA,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA;AAAA,QACA,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,KAAS,EAAC;AAAA,QACrC,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB;AAAC,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,MAAA,GAAkB,MAAA;AACtB,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC1B,CAAA,CAAA,MAAQ;AACN,QAAA,MAAA,GAAS,IAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,MAAM,iBAAA,CAAkB,IAAI,MAAA,EAAQ,CAAA,IAAA,EAAO,IAAI,CAAA,QAAA,EAAM,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,cAAA,CACJ,OAAA,EACA,QAA+B,EAAC,EAChC,OAAoB,OAAA,EACO;AAC3B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA0B;AAAA,MAC7C,MAAA,EAAQ,KAAA;AAAA,MACR,IAAA,EAAM,GAAG,IAAA,CAAK,IAAA,EAAM,CAAA,CAAA,EAAI,kBAAA,CAAmB,OAAO,CAAC,CAAA,aAAA,CAAA;AAAA,MACnD,IAAA;AAAA,MACA,KAAA,EAAO,EAAE,GAAG,KAAA;AAAM,KACnB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,MAAM,kBAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACS;AAC7B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,OAAA,CAA4B;AAAA,MAC/C,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,IAAA,EAAM,CAAA,eAAA,CAAA;AAAA,MACpB,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,UAAA,CACJ,KAAA,EAOA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD,EAAC;AAAA,MACL,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF;AAAC,KACP;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAA,CACJ,OAAA,EACA,KAAA,EAOA,OAAoB,OAAA,EACL;AACf,IAAA,MAAM,OAAA,GACJ,KAAA,CAAM,OAAA,IAAA,CAAY,MAAM,IAAA,CAAK,IAAI,OAAA,EAAS,IAAI,CAAA,EAAG,QAAA,EAAU,OAAA,IAAW,CAAA;AACxE,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,GAAI,KAAA,CAAM,QAAA,IAAY,KAAA,CAAM,QAAA,GACxB;AAAA,QACE,OAAA,EAAS;AAAA,UACP,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa,EAAC;AAAA,UACrD,GAAI,MAAM,QAAA,GAAW,EAAE,UAAU,KAAA,CAAM,QAAA,KAAa;AAAC;AACvD,UAEF,EAAC;AAAA,MACL,QAAA,EAAU,EAAE,OAAA;AAAQ,KACtB;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,EAAS,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,IAAA,EAAK,EAAG,IAAI,CAAA;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,IAAA,CACJ,KAAA,EACA,IAAA,GAAoB,OAAA,EACK;AACzB,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,IAAA,EAAM,MAAA;AAAA,MACN,MAAA,EAAQ,MAAM,MAAA,IAAU,QAAA;AAAA,MACxB,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,SAAA,GACN,EAAE,QAAQ,CAAC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,KAAA,CAAM,SAAA,EAAW,CAAA,KACnD;AAAC,KACP;AACA,IAAA,OAAO,KAAK,MAAA,CAAO,EAAE,MAAM,MAAA,EAAQ,IAAA,IAAQ,IAAI,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,eAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,KAAM,aAAa,CAAA,EAAG,SAAS,CAAC,CAAA,EAAG,OAAO,CAAA;AAC3D,IAAA,MAAM,GAAA,GAAkB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,SAAA,EAAU;AAEzD,IAAA,MAAM,EAAA,GACJ,EAAE,MAAA,KAAW,MAAA,GACT,EAAE,EAAA,EAAI,KAAA,EAAgB,MAAM,SAAA,EAAW,KAAA,EAAO,CAAC,GAAG,CAAA,KAClD,EAAE,EAAA,EAAI,OAAgB,IAAA,EAAM,WAAA,EAAa,OAAO,GAAA,EAAI;AAC1D,IAAA,MAAM,KAAK,KAAA,CAAM,OAAA,EAAS,CAAC,EAAE,GAAG,IAAI,CAAA;AACpC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAA,CACJ,OAAA,EACA,SAAA,EACA,OAAoB,OAAA,EACJ;AAChB,IAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,GAAA,CAAI,SAAS,IAAI,CAAA;AACtC,IAAA,MAAM,MAAA,GAAuB,CAAA,CAAE,MAAA,IAAU,EAAC;AAC1C,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,CAAA,EAAG,SAAS,CAAC,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAC1C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,EAAS,CAAC,EAAE,EAAA,EAAI,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,IAAA,EAAM,GAAG,IAAI,CAAA;AACjF,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,cAAA,CACJ,SAAA,EACA,IAAA,GAAoB,OAAA,EACY;AAChC,IAAA,OAAO,KAAK,IAAA,CAAK,EAAE,WAAA,EAAa,SAAA,IAAa,IAAI,CAAA;AAAA,EACnD;AACF;AAIO,IAAM,cAAA,GAAiB,EAAE,YAAA","file":"chunk-NFSO7WUA.js","sourcesContent":["import type { ClientContext, PaginatedItems } from \"../core/context\";\nimport { requestPage } from \"../core/paged\";\nimport type { AuthContext } from \"../core/auth\";\nimport { EmporixError, errorFromResponse } from \"../core/errors\";\nimport type {\n  AssetCreateBlob,\n  AssetCreateLink,\n  AssetUpdateBlob,\n  AssetUpdateLink,\n  DownloadUrl,\n  GetAsset,\n  GetMediaRetrieveDownloadUrlData,\n  MetadataUpdate,\n  PatchOperation,\n  RefId,\n  UploadSession,\n  UploadSessionRequest,\n} from \"../generated/media\";\n\n/**\n * The spec marks `metadata` optional on both update bodies; the live API rejects\n * an update without it — «`metadata.version` is required for update» (measured\n * 2026-10-06 on BLOB and LINK assets). Required here, so leaving it out is a\n * compile error rather than a 400.\n */\ntype Versioned<T> = Omit<T, \"metadata\"> & { metadata: MetadataUpdate };\n\n/** Generated media types (caller sends the exact wire shape). */\nexport type AssetCreateBlobInput = AssetCreateBlob;\nexport type AssetCreateLinkInput = AssetCreateLink;\nexport type AssetUpdateBlobInput = Versioned<AssetUpdateBlob>;\nexport type AssetUpdateLinkInput = Versioned<AssetUpdateLink>;\n/**\n * @deprecated `update()` takes {@link AssetUpdateLinkInput} as its JSON body and\n * {@link AssetUpdateBlobInput} next to a file; a BLOB is never sent as JSON.\n */\nexport type AssetUpdateInput = AssetUpdateBlob | AssetUpdateLink;\nexport type Asset = GetAsset;\nexport type AssetRefId = RefId;\n/** Partial-update body (`PATCH /assets/{id}`) — an RFC-6902 JSON-Patch op-array. */\nexport type AssetPatch = PatchOperation[];\n/** Result of {@link MediaService.getDownloadUrl} — `{ provider, url, expiresAt? }`. */\nexport type AssetDownloadUrl = DownloadUrl;\n/** Query for {@link MediaService.getDownloadUrl} — `{ disposition? }`. */\nexport type AssetDownloadUrlQuery = NonNullable<GetMediaRetrieveDownloadUrlData[\"query\"]>;\n/** Body for {@link MediaService.startUploadSession}: a BLOB create payload plus `uploadType`. */\nexport type AssetUploadSessionInput = UploadSessionRequest;\n/** The storage instruction {@link MediaService.startUploadSession} returns. */\nexport type AssetUploadSession = UploadSession;\n\n/**\n * Filter / pagination options for {@link MediaService.list}. The explicit\n * fields are typed for autocomplete; the index signature stays open so\n * Emporix `q`-syntax filters like `\"refIds.id\"` can be passed verbatim.\n */\nexport interface ListAssetsQuery {\n  pageNumber?: number;\n  pageSize?: number;\n  /** Emporix sort syntax, e.g. `\"name,metadata.createdAt:desc\"`. */\n  sort?: string;\n  /** Emporix `q`-syntax filter, e.g. `\"name:hero\"`. */\n  q?: string;\n  /**\n   * Ask for `X-Total-Count`. An SDK-side flag, not an Emporix query parameter:\n   * it becomes a request header.\n   */\n  totalCount?: boolean;\n  [key: string]: string | number | boolean | undefined;\n}\n\n/**\n * Result of {@link MediaService.download}. The endpoint's behaviour depends\n * on the asset's `access`:\n * - `PUBLIC` assets respond with a 30x redirect whose `Location` header\n *   carries the externally-cacheable storage URL — useful when the\n *   storefront wants to send the user there directly.\n * - `PRIVATE` assets respond with the raw bytes (plus an `ETag` header\n *   for caching). The file lives in Google Cloud Storage and is reachable\n *   without the service token only through a signed URL from\n *   {@link MediaService.getDownloadUrl}.\n */\nexport type DownloadResult =\n  | { kind: \"redirect\"; url: string }\n  | {\n      kind: \"bytes\";\n      data: ArrayBuffer;\n      etag?: string;\n      contentType?: string;\n    };\n\nconst SERVICE: AuthContext = { kind: \"service\" };\n\nfunction isProductRef(r: AssetRefId, productId: string): boolean {\n  return r.type === \"PRODUCT\" && r.id === productId;\n}\n\n/**\n * Media assets (BLOB/LINK). All endpoints require a backend-only scope\n * (`media.asset_manage` / `media.asset_read`) — default auth: service.\n */\nexport class MediaService {\n  static readonly channel = \"media\" as const;\n  constructor(private readonly ctx: ClientContext) {}\n\n  private base(): string {\n    return `/media/${this.ctx.tenant}/assets`;\n  }\n\n  /**\n   * Create an asset. BLOB uploads via multipart (max 30 MB); LINK via JSON.\n   * {@link startUploadSession} sends the file straight to storage instead.\n   */\n  async create(\n    input:\n      | { kind: \"blob\"; file: Blob; body: AssetCreateBlobInput }\n      | { kind: \"link\"; body: AssetCreateLinkInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      return this.ctx.http.request<{ id: string }>({\n        method: \"POST\",\n        path: this.base(),\n        auth,\n        body: fd,\n      });\n    }\n    return this.ctx.http.request<{ id: string }>({\n      method: \"POST\",\n      path: this.base(),\n      auth,\n      body: input.body,\n    });\n  }\n\n  /**\n   * List assets, wrapped in the shared {@link PaginatedItems} envelope so\n   * callers can iterate over pages consistently with the rest of the SDK.\n   * `hasNextPage` is the standard SDK heuristic: `true` when the returned\n   * page is full (`items.length === requested pageSize`). Pagination\n   * defaults match Emporix's server defaults (`pageNumber: 1`,\n   * `pageSize: 60`) so an empty `query` produces stable expectations.\n   */\n  async list(\n    query: ListAssetsQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    const pageNumber = query.pageNumber ?? 1;\n    const pageSize = query.pageSize ?? 60;\n    // Destructured out because the rest of `query` is spread into the query\n    // string: `totalCount` is an SDK-side flag that becomes a request header,\n    // and would otherwise ride along as a stray `?totalCount=true`.\n    const { totalCount, ...rest } = query;\n    return requestPage<Asset>(\n      this.ctx.http,\n      {\n        method: \"GET\",\n        path: this.base(),\n        auth,\n        query: { ...rest, pageNumber, pageSize },\n      },\n      { pageNumber, pageSize, ...(totalCount === undefined ? {} : { totalCount }) },\n    );\n  }\n\n  /** Fetch an asset by id. */\n  async get(assetId: string, auth: AuthContext = SERVICE): Promise<Asset> {\n    return this.ctx.http.request<Asset>({\n      method: \"GET\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Replace an asset (`PUT`, HTTP 204 — nothing is returned). The spec takes one\n   * body per asset type, mirrored by the discriminated input:\n   * - `{ kind: \"json\", body }` — a LINK asset, sent as `application/json`. The\n   *   body is the whole asset: `type: \"LINK\"`, `access` and `url` are required.\n   * - `{ kind: \"blob\", file, body }` — a BLOB asset, sent as\n   *   `multipart/form-data`: the file (max 30 MB) and the asset body, both\n   *   required, so this always replaces the bytes.\n   *\n   * A BLOB's metadata alone — `refIds`, `details`, mixins — goes through\n   * {@link patch}. Earlier versions also took a BLOB as the JSON body and\n   * promised the updated asset in return; the spec allows neither.\n   *\n   * `type` and `access` are immutable. Optimistic locking is via\n   * `body.metadata.version`; a stale one gets a 409.\n   */\n  async update(\n    assetId: string,\n    input:\n      | { kind: \"json\"; body: AssetUpdateLinkInput }\n      | { kind: \"blob\"; file: Blob; body: AssetUpdateBlobInput },\n    auth: AuthContext = SERVICE,\n  ): Promise<void> {\n    const path = `${this.base()}/${encodeURIComponent(assetId)}`;\n    if (input.kind === \"blob\") {\n      const fd = new FormData();\n      fd.set(\"file\", input.file);\n      fd.set(\"body\", JSON.stringify(input.body));\n      await this.ctx.http.request<void>({ method: \"PUT\", path, auth, body: fd });\n      return;\n    }\n    await this.ctx.http.request<void>({ method: \"PUT\", path, auth, body: input.body });\n  }\n\n  /**\n   * Partially update an asset with an RFC-6902 JSON-Patch op-array\n   * (`PATCH /assets/{id}`, HTTP 204 — nothing is returned).\n   *\n   * This is the way to change one field without resending the whole asset, and\n   * the only way to touch a `BLOB` asset's metadata **without re-uploading the\n   * file** — {@link update} in `blob` mode always replaces the bytes.\n   *\n   * Append to an array with a path ending in `/-`, which preserves the existing\n   * entries:\n   *\n   * ```ts\n   * await client.media.patch(assetId, [\n   *   { op: \"add\", path: \"/refIds/-\", value: { id: \"product1\", type: \"PRODUCT\" } },\n   * ]);\n   * ```\n   *\n   * `type` and `access` are immutable here too, as with {@link update}. Only\n   * `add`, `remove` and `replace` are accepted, and optimistic locking still\n   * applies — a stale `metadata.version` gets a 409.\n   */\n  async patch(assetId: string, ops: AssetPatch, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"PATCH\",\n      path: `${this.base()}/${encodeURIComponent(assetId)}`,\n      auth,\n      body: ops,\n    });\n  }\n\n  /** Remove an asset. */\n  async remove(assetId: string, auth: AuthContext = SERVICE): Promise<void> {\n    await this.ctx.http.request<void>({\n      method: \"DELETE\",\n      path: `${this.base()}/${assetId}`,\n      auth,\n    });\n  }\n\n  /**\n   * Download an asset by id. Returns a discriminated union:\n   * - `{ kind: \"redirect\", url }` for `PUBLIC` assets (server-side 30x with\n   *   the storage URL in `Location`).\n   * - `{ kind: \"bytes\", data }` for `PRIVATE` assets (server-side 200 with\n   *   the asset bytes; `etag` + `contentType` headers are exposed for\n   *   caching). When the server reports `text/plain` Content-Type (the\n   *   OpenAPI-documented format), the SDK decodes the base64 stream into\n   *   an `ArrayBuffer` transparently; binary Content-Types are passed\n   *   through verbatim.\n   *\n   * Emporix recommends {@link getDownloadUrl} for every download: here the file\n   * passes through the Media API. A `413` means the asset's known size exceeds\n   * the streaming limit (30 MB by default) — only {@link getDownloadUrl} can\n   * serve it. A `409` means the asset is still `PENDING` from a direct upload\n   * whose file has not reached storage.\n   *\n   * Implementation note: uses `redirect: \"manual\"` so the redirect-location\n   * is observable. In Node.js this works; in a browser the redirect Location\n   * is intentionally hidden by fetch — there, `PUBLIC` downloads will\n   * surface as an opaque-redirect and the SDK throws. Browser code should\n   * use the asset's `url` field from `get()` for `LINK` assets, or the\n   * direct storage URL for `PUBLIC` `BLOB` assets (typically delivered via\n   * an `<img>` tag rather than `download()`).\n   */\n  async download(\n    assetId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<DownloadResult> {\n    const path = `${this.base()}/${assetId}/download`;\n    const res = await this.ctx.http.requestRaw(\n      { method: \"GET\", path, auth },\n      { redirect: \"manual\" },\n    );\n\n    // PUBLIC: server-side redirect — capture Location.\n    if (res.status >= 300 && res.status < 400) {\n      const url = res.headers.get(\"location\");\n      if (!url) {\n        throw new EmporixError(\n          `media.download: ${res.status} response without a Location header`,\n          res.status,\n        );\n      }\n      return { kind: \"redirect\", url };\n    }\n\n    // PRIVATE: bytes.\n    if (res.ok) {\n      const etag = res.headers.get(\"etag\") ?? undefined;\n      const contentType = res.headers.get(\"content-type\") ?? undefined;\n      let data: ArrayBuffer;\n      if (contentType?.startsWith(\"text/plain\")) {\n        // Per OpenAPI spec the server returns the byte stream as a\n        // base64-encoded text/plain body. Decode once into raw bytes\n        // so callers always see an ArrayBuffer.\n        const text = await res.text();\n        const bin = atob(text);\n        const arr = new Uint8Array(bin.length);\n        for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);\n        data = arr.buffer;\n      } else {\n        data = await res.arrayBuffer();\n      }\n      return {\n        kind: \"bytes\",\n        data,\n        ...(etag !== undefined ? { etag } : {}),\n        ...(contentType !== undefined ? { contentType } : {}),\n      };\n    }\n\n    // Error: surface via the standard EmporixError hierarchy.\n    const text = await res.text();\n    let parsed: unknown = undefined;\n    if (text) {\n      try {\n        parsed = JSON.parse(text);\n      } catch {\n        parsed = text;\n      }\n    }\n    throw errorFromResponse(res.status, `GET ${path} → ${res.status}`, parsed);\n  }\n\n  /**\n   * Get a URL that serves the stored file straight from storage\n   * (`GET /assets/{assetId}/download-url`). Emporix recommends it for every\n   * download: the file never passes through the Media API, there is no size\n   * limit, and the URL can be handed to a browser as it is.\n   *\n   * - `PRIVATE` BLOB → `provider: \"GCS\"`, a signed Google Cloud Storage URL that\n   *   works without an Emporix token until `expiresAt` (15 minutes by default).\n   * - `PUBLIC` BLOB → `provider: \"CLOUDINARY\"`, the permanent URL.\n   * - `LINK` → `provider: \"LINK\"`, the stored URL.\n   *\n   * `disposition` (`attachment` by default, or `inline`) affects private URLs\n   * only. Unlike {@link startUploadSession}, this works whether or not direct\n   * upload is enabled for the tenant. A `409` means a direct upload is still\n   * `PENDING` and its file has not reached storage; once it has, this call\n   * completes the asset before answering.\n   */\n  async getDownloadUrl(\n    assetId: string,\n    query: AssetDownloadUrlQuery = {},\n    auth: AuthContext = SERVICE,\n  ): Promise<AssetDownloadUrl> {\n    return this.ctx.http.request<AssetDownloadUrl>({\n      method: \"GET\",\n      path: `${this.base()}/${encodeURIComponent(assetId)}/download-url`,\n      auth,\n      query: { ...query },\n    });\n  }\n\n  /**\n   * Start a direct upload of a `BLOB` asset (`POST /assets/upload-session`,\n   * `201`). Emporix creates the asset as `PENDING` — `id` is its id — and\n   * returns where to send the file. **This method does not send it**:\n   *\n   * - `upload.method === \"PUT\"` (a `PRIVATE` asset, `uploadType: \"put\"` or\n   *   omitted): `PUT` the file to `upload.url` with every `upload.headers` entry.\n   * - `upload.method === \"POST\"` (every `PUBLIC` asset, or `uploadType: \"form\"`):\n   *   a multipart `POST` to `upload.url` with every `upload.fields` entry\n   *   unchanged and the file part last.\n   *\n   * That request goes to Google Cloud Storage or Cloudinary, not to Emporix, so\n   * it must not carry the Emporix token — which is also why a browser can make\n   * it. The asset turns `READY` once storage confirms; until then, calls that\n   * need the file answer `409`. The instruction is valid for 15 minutes (GCS) or\n   * an hour (Cloudinary), and an unused session expires at `expiresAt`.\n   *\n   * Direct upload is enabled per tenant by Emporix Support. Without it the call\n   * throws an `EmporixForbiddenError` whose `body.message` is `direct upload is\n   * not enabled for this tenant`, and nothing is created — the same status as a\n   * missing scope, so read the message.\n   */\n  async startUploadSession(\n    input: AssetUploadSessionInput,\n    auth: AuthContext = SERVICE,\n  ): Promise<AssetUploadSession> {\n    return this.ctx.http.request<AssetUploadSession>({\n      method: \"POST\",\n      path: `${this.base()}/upload-session`,\n      auth,\n      body: input,\n    });\n  }\n\n  /** Multipart upload sugar: builds `AssetCreateBlob` from input. */\n  async uploadFile(\n    input: {\n      file: Blob;\n      productId?: string;\n      filename?: string;\n      mimeType?: string;\n      access?: \"PUBLIC\" | \"PRIVATE\";\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateBlobInput = {\n      type: \"BLOB\",\n      access: input.access ?? \"PUBLIC\",\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n    };\n    return this.create({ kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /**\n   * Replace the file content of an existing BLOB asset. Sugar over\n   * {@link update} with `kind: \"blob\"`, and like it resolves to nothing — the\n   * PUT answers 204. `access` is required because the field is immutable and\n   * the server validates that the body matches.\n   *\n   * Pass `version` from `asset.metadata.version` for optimistic locking\n   * (recommended when concurrent writers are possible) — a stale one gets a 409.\n   * Without it the current version is read first, because the live API rejects\n   * an update that carries none; the write then wins over any in between.\n   */\n  async replaceFile(\n    assetId: string,\n    input: {\n      file: Blob;\n      access: \"PUBLIC\" | \"PRIVATE\";\n      filename?: string;\n      mimeType?: string;\n      version?: number;\n    },\n    auth: AuthContext = SERVICE,\n  ): Promise<void> {\n    const version =\n      input.version ?? (await this.get(assetId, auth)).metadata?.version ?? 1;\n    const body: AssetUpdateBlobInput = {\n      type: \"BLOB\",\n      access: input.access,\n      ...(input.filename || input.mimeType\n        ? {\n            details: {\n              ...(input.filename ? { filename: input.filename } : {}),\n              ...(input.mimeType ? { mimeType: input.mimeType } : {}),\n            },\n          }\n        : {}),\n      metadata: { version },\n    };\n    return this.update(assetId, { kind: \"blob\", file: input.file, body }, auth);\n  }\n\n  /** External-URL sugar: builds `AssetCreateLink`. */\n  async link(\n    input: { url: string; productId?: string; access?: \"PUBLIC\" | \"PRIVATE\" },\n    auth: AuthContext = SERVICE,\n  ): Promise<{ id: string }> {\n    const body: AssetCreateLinkInput = {\n      type: \"LINK\",\n      access: input.access ?? \"PUBLIC\",\n      url: input.url,\n      ...(input.productId\n        ? { refIds: [{ type: \"PRODUCT\", id: input.productId }] }\n        : {}),\n    };\n    return this.create({ kind: \"link\", body }, auth);\n  }\n\n  /**\n   * Idempotently add a PRODUCT refId to an asset, through a JSON Patch that\n   * appends the one reference, so it works for BLOB and LINK alike and leaves\n   * the rest of the asset alone.\n   *\n   * Resolves to the asset as read back after the patch, because Emporix answers\n   * 204 to a reference to a product that does not exist and drops it — check\n   * `refIds` rather than trusting the call. Only a PUBLIC asset takes a product\n   * reference; a PRIVATE one answers 400.\n   *\n   * Earlier versions sent a JSON PUT of `{ type, refIds }`, which the spec\n   * rejects for both types: a BLOB takes no JSON PUT, and a LINK's requires\n   * `access` and `url`.\n   */\n  async attachToProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    if (refIds.some((r) => isProductRef(r, productId))) return a;\n    const ref: AssetRefId = { type: \"PRODUCT\", id: productId };\n    // `/refIds/-` appends to an existing array only (RFC 6902).\n    const op =\n      a.refIds === undefined\n        ? { op: \"add\" as const, path: \"/refIds\", value: [ref] }\n        : { op: \"add\" as const, path: \"/refIds/-\", value: ref };\n    await this.patch(assetId, [op], auth);\n    return this.get(assetId, auth);\n  }\n\n  /**\n   * Remove a PRODUCT refId from an asset (no-op if absent), through a JSON Patch\n   * that replaces the references and nothing else. Resolves to the asset as\n   * read back after the patch, like {@link attachToProduct}. Earlier versions\n   * sent a spec-invalid JSON PUT, as that one did.\n   */\n  async detachFromProduct(\n    assetId: string,\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<Asset> {\n    const a = await this.get(assetId, auth);\n    const refIds: AssetRefId[] = a.refIds ?? [];\n    const next = refIds.filter((r) => !isProductRef(r, productId));\n    if (next.length === refIds.length) return a;\n    await this.patch(assetId, [{ op: \"replace\", path: \"/refIds\", value: next }], auth);\n    return this.get(assetId, auth);\n  }\n\n  /** Convenience: list assets attached to a product (server-side filter). */\n  async listForProduct(\n    productId: string,\n    auth: AuthContext = SERVICE,\n  ): Promise<PaginatedItems<Asset>> {\n    return this.list({ \"refIds.id\": productId }, auth);\n  }\n}\n\n// Re-export so consumers can `import { isProductRef } from \"@viu/emporix-sdk/media\"`?\n// Internal helper — kept module-private; convenience methods in Task 4 use it.\nexport const _internalMedia = { isProductRef };\n"]}

package/dist/companies.d.cts

@@ -50,4 +50,4 @@ declare class CompaniesService {
     parentHierarchy(legalEntityId: string, auth: AuthContext): Promise<LegalEntity[]>;
 }
 
-export { CompaniesService, LegalEntity, LegalEntityCreate, LegalEntityUpdate };
+export { CompaniesService, LegalEntity, LegalEntityCreate, type LegalEntitySearchInput, LegalEntityUpdate };

package/dist/companies.d.ts

@@ -50,4 +50,4 @@ declare class CompaniesService {
     parentHierarchy(legalEntityId: string, auth: AuthContext): Promise<LegalEntity[]>;
 }
 
-export { CompaniesService, LegalEntity, LegalEntityCreate, LegalEntityUpdate };
+export { CompaniesService, LegalEntity, LegalEntityCreate, type LegalEntitySearchInput, LegalEntityUpdate };

package/dist/index.cjs

@@ -1242,7 +1242,7 @@ var HttpClient = class {
 };
 
 // package.json
-var version = "4.2.3";
+var version = "4.3.0";
 
 // src/version.ts
 var SDK_VERSION = version;
@@ -3506,37 +3506,31 @@ var MediaService = class {
     });
   }
   /**
-   * Update an asset. The input is a discriminated union mirroring
-   * {@link create}:
-   * - `{ kind: "json", body }` — metadata-only patch (BLOB or LINK).
-   *   Sends `application/json`. Used for `refIds`, `details`, `metadata`,
-   *   or `url` changes.
-   * - `{ kind: "blob", file, body }` — replaces the BLOB file content
-   *   (max 30 MB) AND patches metadata in the same request. Sends
-   *   `multipart/form-data`.
+   * Replace an asset (`PUT`, HTTP 204 — nothing is returned). The spec takes one
+   * body per asset type, mirrored by the discriminated input:
+   * - `{ kind: "json", body }` — a LINK asset, sent as `application/json`. The
+   *   body is the whole asset: `type: "LINK"`, `access` and `url` are required.
+   * - `{ kind: "blob", file, body }` — a BLOB asset, sent as
+   *   `multipart/form-data`: the file (max 30 MB) and the asset body, both
+   *   required, so this always replaces the bytes.
    *
-   * `type` and `access` are immutable per Emporix — they must match the
-   * existing asset's values. Optimistic-locking is via `body.metadata.version`;
-   * the server returns 409 Conflict on a stale version.
+   * A BLOB's metadata alone — `refIds`, `details`, mixins — goes through
+   * {@link patch}. Earlier versions also took a BLOB as the JSON body and
+   * promised the updated asset in return; the spec allows neither.
+   *
+   * `type` and `access` are immutable. Optimistic locking is via
+   * `body.metadata.version`; a stale one gets a 409.
    */
   async update(assetId, input, auth2 = SERVICE5) {
+    const path = `${this.base()}/${encodeURIComponent(assetId)}`;
     if (input.kind === "blob") {
       const fd = new FormData();
       fd.set("file", input.file);
       fd.set("body", JSON.stringify(input.body));
-      return this.ctx.http.request({
-        method: "PUT",
-        path: `${this.base()}/${assetId}`,
-        auth: auth2,
-        body: fd
-      });
+      await this.ctx.http.request({ method: "PUT", path, auth: auth2, body: fd });
+      return;
     }
-    return this.ctx.http.request({
-      method: "PUT",
-      path: `${this.base()}/${assetId}`,
-      auth: auth2,
-      body: input.body
-    });
+    await this.ctx.http.request({ method: "PUT", path, auth: auth2, body: input.body });
   }
   /**
    * Partially update an asset with an RFC-6902 JSON-Patch op-array
@@ -3719,12 +3713,17 @@ var MediaService = class {
   }
   /**
    * Replace the file content of an existing BLOB asset. Sugar over
-   * {@link update} with `kind: "blob"`. `access` is required because the
-   * field is immutable and the server validates that the patch matches.
-   * Pass `version` from `asset.metadata.version` if you want optimistic
-   * locking (recommended when concurrent writers are possible).
+   * {@link update} with `kind: "blob"`, and like it resolves to nothing — the
+   * PUT answers 204. `access` is required because the field is immutable and
+   * the server validates that the body matches.
+   *
+   * Pass `version` from `asset.metadata.version` for optimistic locking
+   * (recommended when concurrent writers are possible) — a stale one gets a 409.
+   * Without it the current version is read first, because the live API rejects
+   * an update that carries none; the write then wins over any in between.
    */
   async replaceFile(assetId, input, auth2 = SERVICE5) {
+    const version2 = input.version ?? (await this.get(assetId, auth2)).metadata?.version ?? 1;
     const body = {
       type: "BLOB",
       access: input.access,
@@ -3734,7 +3733,7 @@ var MediaService = class {
           ...input.mimeType ? { mimeType: input.mimeType } : {}
         }
       } : {},
-      ...input.version !== void 0 ? { metadata: { version: input.version } } : {}
+      metadata: { version: version2 }
     };
     return this.update(assetId, { kind: "blob", file: input.file, body }, auth2);
   }
@@ -3748,23 +3747,42 @@ var MediaService = class {
     };
     return this.create({ kind: "link", body }, auth2);
   }
-  /** Idempotently add a PRODUCT refId to an asset. */
+  /**
+   * Idempotently add a PRODUCT refId to an asset, through a JSON Patch that
+   * appends the one reference, so it works for BLOB and LINK alike and leaves
+   * the rest of the asset alone.
+   *
+   * Resolves to the asset as read back after the patch, because Emporix answers
+   * 204 to a reference to a product that does not exist and drops it — check
+   * `refIds` rather than trusting the call. Only a PUBLIC asset takes a product
+   * reference; a PRIVATE one answers 400.
+   *
+   * Earlier versions sent a JSON PUT of `{ type, refIds }`, which the spec
+   * rejects for both types: a BLOB takes no JSON PUT, and a LINK's requires
+   * `access` and `url`.
+   */
   async attachToProduct(assetId, productId, auth2 = SERVICE5) {
     const a = await this.get(assetId, auth2);
     const refIds = a.refIds ?? [];
     if (refIds.some((r) => isProductRef(r, productId))) return a;
-    const next = [...refIds, { type: "PRODUCT", id: productId }];
-    const patch = { type: a.type, refIds: next };
-    return this.update(assetId, { kind: "json", body: patch }, auth2);
+    const ref = { type: "PRODUCT", id: productId };
+    const op = a.refIds === void 0 ? { op: "add", path: "/refIds", value: [ref] } : { op: "add", path: "/refIds/-", value: ref };
+    await this.patch(assetId, [op], auth2);
+    return this.get(assetId, auth2);
   }
-  /** Remove a PRODUCT refId from an asset (no-op if absent). */
+  /**
+   * Remove a PRODUCT refId from an asset (no-op if absent), through a JSON Patch
+   * that replaces the references and nothing else. Resolves to the asset as
+   * read back after the patch, like {@link attachToProduct}. Earlier versions
+   * sent a spec-invalid JSON PUT, as that one did.
+   */
   async detachFromProduct(assetId, productId, auth2 = SERVICE5) {
     const a = await this.get(assetId, auth2);
     const refIds = a.refIds ?? [];
     const next = refIds.filter((r) => !isProductRef(r, productId));
     if (next.length === refIds.length) return a;
-    const patch = { type: a.type, refIds: next };
-    return this.update(assetId, { kind: "json", body: patch }, auth2);
+    await this.patch(assetId, [{ op: "replace", path: "/refIds", value: next }], auth2);
+    return this.get(assetId, auth2);
   }
   /** Convenience: list assets attached to a product (server-side filter). */
   async listForProduct(productId, auth2 = SERVICE5) {