react-shopwave-connect 0.3.0 → 0.4.0

package/README.md

@@ -165,6 +165,59 @@ How they behave (matches what the Shopwave API does):
 
 The generic forms are `saveEntity(kind, item)`, `deleteEntityById(kind, id)` and `fetchEntityById(kind, id)`; `SHOPWAVE_ENTITIES` lists each entity's route, collection key, Shopwave path and id headers.
 
+### Merchant, current user and image uploads
+
+The merchant and the logged-in user are single records (one per login), and images go to the Shopwave CDN:
+
+```ts
+import {
+  fetchMerchant, updateMerchant, fetchUser,
+  uploadMerchantImage, setMerchantImage, getMerchantImageUrl,
+  merchantLinksToForm, merchantLinksFromForm,
+} from "react-shopwave-connect/core";
+
+const merchant = await fetchMerchant();          // Merchant | null
+const user = await fetchUser();                  // User | null  ({ id, firstName, lastName, email, employee })
+
+// Reads the merchant, merges the patch over it and saves the record, so
+// fields you don't mention (companyNumber, vatNumber, links, …) are kept.
+// Returns the merchant as stored (read back after the save).
+await updateMerchant({ vatNumber: "123456789", links: merchantLinksFromForm({ website: "https://example.com" }) });
+
+// Images: fit to the slot's size, upload with the slot's kind, then save the file name.
+const image = await uploadMerchantImage(file, "square");          // { id, url, path }
+await updateMerchant({ imageIds: setMerchantImage(merchant?.imageIds, "square", image.id) });
+getMerchantImageUrl(saved.imageIds, "square");                     // HTTPS URL for <img src>
+```
+
+The shapes below are the ones adminV1 saves and adminV2 reads, so all three admins share one record (confirmed on the live API with merchant 5644, 30 Sep 2026):
+
+| Field | Shape |
+|---|---|
+| `imageIds` | `{ logo: { receipt, square }, feature: [ … ] }` — **file names** on write (the uploader's `fileName`), **full `http://static.merchantstack.com/…` URLs** on read |
+| `colours` | `{ primary: { main, highlight, contrast } }` (hex strings; adminV2 uses `primary.main` behind the logo) |
+| `links` | `{ website: { home }, social: { twitter, facebook, instagram } }` |
+
+- **Merchant fields** (`GET`/`POST /merchant`): `id`, `name`, `description`, `companyNumber`, `vatNumber`, `categoryId`, `estAnnualRevenue`, `note`, and the three objects above. The API returns `{}` for an empty object.
+- **What the live API does on `POST /merchant`** (checked 30 Sep 2026): it replaces the record. A scalar field left out (`companyNumber`, `vatNumber`, `note`, …) becomes `null`; an object field left out (`colours`, `links`, `imageIds`) is kept, and one that is sent replaces the stored one (`{}` clears it). It answers **205 with an empty body**. It silently cuts `companyNumber` to 11 characters and `vatNumber` to 9 (a UK VAT number without `GB`).
+- **`updateMerchant(patch, { merge })`**: `merge` (default `true`) reads first and merges the scalar fields, so nothing is wiped. Object fields (`MERCHANT_OBJECT_FIELDS`) are sent only when the patch has them, and then replace the stored one — to change one image, pass the whole `imageIds` (`setMerchantImage` does that). `imageIds` is always sent as file names (`toStoredImageIds`), so you can pass back what you read. It refuses a different merchant `id`, never sends `createdDate`/`modifiedDate`, rejects values longer than `MERCHANT_FIELD_MAX_LENGTH` (`validateMerchant(m)` lists them) instead of letting the API cut them, and returns the merchant **read back after the save**, so you see exactly what was kept. `merge: false` sends only the patch (which must include `id`, and clears the scalar fields you leave out).
+- **Merchant image slots** (`MERCHANT_IMAGE_SLOTS`): the API doesn't resize, and adminV1 accepts only these exact sizes.
+
+  | Slot | Stored at | Upload kind | Size |
+  |---|---|---|---|
+  | `receipt` | `imageIds.logo.receipt` | `merchant` | 576 × 325 |
+  | `square` | `imageIds.logo.square` | `merchant` | 1000 × 1000 |
+  | `featured` | `imageIds.feature[0]` | `merchantFeature` | 1200 × 600 |
+
+  The API builds each image URL from its key, not from where the file was uploaded (`logo.*` → `…/merchant/<id>/logo/<file>`, `feature` → `…/feature/<file>`), so the featured image must be uploaded as `merchantFeature`. `POST /merchant` stores all three objects with the SDK's `{ merchant: … }` body; adminV1's `{ merchants: { "0": … } }` form isn't needed.
+
+  `uploadMerchantImage(file, slot, { fit = true })` scales and centre-crops the image to the slot's size in the browser (`fitImageToSize`, `coverCrop`) and uploads it with the slot's kind; `fit: false` sends the file as-is. `getMerchantImage` / `getMerchantImageUrl` / `setMerchantImage` read and write a slot; `imageFileName(url)` gives the file name in a URL. Hook: `useUploadMerchantImage()`.
+- **Links:** `merchantLinksToForm(links)` gives flat fields (`website`, `twitter`, `facebook`, `instagram`) from the stored shape, flat keys or the old array form; `merchantLinksFromForm(fields)` builds the stored shape; `normalizeMerchantLinks(links)` converts any of them to the stored shape. Colour keys: `MERCHANT_COLOUR_KEYS`.
+- **User** (`GET /user`): the live API returns `id`, `firstName`, `lastName`, `email` and `employee: { merchantId, roleId, stores }` — no `createdDate` and **no `merchant`**, although the reference lists them. There's no option to include it (adminV1 also reads `GET /merchant` separately and attaches it to its session). Read the merchant with `fetchMerchant()`.
+- **`uploadImage(file, { kind, fileName? })`** posts the file to `/api/upload`, which `PUT`s it to Shopwave's `/uploader` (multipart `file`, header `contentType: <kind>`). Kinds: `merchant`, `merchantFeature`, `product`, `user`, `applicationLogo`, `applicationImages` (the last two sent as the API's own spelling, `applicaionLogo`/`applicaionImages`). Live: 201 `{ fileName, path }`. Returns `{ id, url, path }`: `id` is the generated file name (what records store), `path` the URL as the API gave it (`http://static.merchantstack.com/images/…`, which has no HTTPS endpoint), and `url` the same file over HTTPS via `getImageUrl(path)` (`SHOPWAVE_IMAGE_BASE_URL`, the S3 bucket behind the CDN). The upload alone changes no record.
+
+`SHOPWAVE_RESOURCES` (merchant, user) and `SHOPWAVE_UPLOAD` are shared with the server routes, like `SHOPWAVE_ENTITIES`.
+
 ### Available `core` functions
 
 | Domain    | Function(s)                                              |
@@ -176,12 +229,15 @@ The generic forms are `saveEntity(kind, item)`, `deleteEntityById(kind, id)` and
 | promotion | `fetchPromotions`, `fetchPromotion`, `savePromotion`, `deletePromotion` |
 | store     | `fetchStores` (now with `storeIds`), `fetchStore`, `saveStore`, `deleteStore` |
 | report    | `fetchReport`                                           |
+| merchant  | `fetchMerchant`, `updateMerchant`, `validateMerchant`; links `merchantLinksToForm`, `merchantLinksFromForm`, `normalizeMerchantLinks`; images `MERCHANT_IMAGE_SLOTS`, `uploadMerchantImage`, `getMerchantImage`, `getMerchantImageUrl`, `setMerchantImage`, `toStoredImageIds`, `imageFileName` |
+| user      | `fetchUser`                                              |
+| upload    | `uploadImage`, `getImageUrl`, `fitImageToSize`, `readImageSize`, `coverCrop` |
 | session   | `fetchSession`, `loginPath`, `logoutPath`, `logout`     |
 | entity    | `saveEntity`, `saveEntities`, `deleteEntityById`, `fetchEntityById`; low-level `submitEntity` / `deleteEntity` (raw endpoint) |
 | errors    | `ShopwaveApiError`, `getApiErrorMap`, `assertNoApiErrors` |
 | basket    | `buildBasketReportQuery`, `parseBasketReportData`, `combineBasketRows`, `computeBasketSummary`, … (pure transforms) |
 
-All types/interfaces (`Product`, `Store`, `Category`, `Consumer`, `Employee`, `ReportQueryMap`, `Basket*`, `apiResponse`, …) are exported from `core` too.
+All types/interfaces (`Product`, `Store`, `Category`, `Consumer`, `Employee`, `Merchant`, `User`, `UploadedImage`, `ReportQueryMap`, `Basket*`, `apiResponse`, …) are exported from `core` too.
 
 ---
 
@@ -224,14 +280,14 @@ const { data } = useProduct({ storeId }, { baseUrl: "https://api.merchantstack.c
 
 ### Auto-fetch hooks (`useEffect`-based)
 
-`useCategory`, `useConsumer`, `useEmployee`, `useProduct`, `usePromotion`, `useStore`, `useReport`, `useSession`.
+`useCategory`, `useConsumer`, `useEmployee`, `useProduct`, `usePromotion`, `useStore`, `useReport`, `useSession`, `useMerchant`, `useUser` (`useUser({ enabled: false })` stays idle).
 They fetch on mount and re-run when their arguments change. `useConsumer` and `useReport` stay idle until you pass ids / a query (they return `loading: false`, `data: null` until then). `refetch()` replaces the old `reloadFlag` argument.
 
 ### Manually-triggered hooks (`useCallback`-based)
 
 For saves and deletes, prefer calling the typed `core` functions (`saveProduct`, `deleteStore`, …) from your event handlers — they return the saved entity with its id.
 
-`useDelete`, `useSubmit`, `useLogout` return `{ mutate, data, loading, error, errorStatus }` — nothing fires until you call `mutate`:
+`useUpdateMerchant`, `useUploadImage`, `useUploadMerchantImage`, `useDelete`, `useSubmit`, `useLogout` return `{ mutate, data, loading, error, errorStatus }` — nothing fires until you call `mutate`:
 
 ```tsx
 import { useDelete, useSubmit } from "react-shopwave-connect/hooks";
@@ -401,8 +457,20 @@ export const { GET, PUT, DELETE } = shopwave.item("product");
 // app/api/report/route.ts         — any other Shopwave path, read-only
 import { shopwave } from "@/lib/shopwave";
 export const { GET } = shopwave.passthrough("report");
+
+// app/api/merchant/route.ts       — read / update the merchant
+export const { GET, PUT } = shopwave.resource("merchant");
+
+// app/api/user/route.ts           — the logged-in user (read-only)
+export const { GET } = shopwave.resource("user");
+
+// app/api/upload/route.ts         — image upload (uploadImage)
+export const { POST } = shopwave.upload();              // or upload({ maxBytes, accept })
 ```
 
+- `resource("merchant")`: `PUT`/`POST` take `{ merchant: {…} }` or the bare object and send every field on as `postBody`. The `id` is required (400 without it), because a POST without one would create a second merchant. `resource("user")` answers 405 to writes.
+- `upload()`: takes multipart `file` + `kind`, checks the size (default 10 MB → 413) and type (default `image/*` → 415), and `PUT`s only the file to `/uploader` with the `contentType` header. `extras` are ignored on uploads. Shopwave's reply (201 `{ fileName, path }`) is passed through.
+
 Entities: `product`, `category`, `store`, `promotion`, `employee` (DELETE retires via `exitDate`), `promotion` (DELETE ends it via `endDate`), `consumer` (mounted at `/api/consumer`; GET only, writes answer 405). For anything else, `shopwave.forward(request, { method, path, headers, postBody })` does the same token/refresh/encoding work for a custom handler.
 
 Every handler:

package/dist/core/index.cjs

@@ -709,12 +709,504 @@ function buildConsumerMap(consumers) {
 	return map;
 }
 
+//#endregion
+//#region src/core/resources.ts
+/**
+* - merchant: `GET /merchant`; `POST /merchant` with `{ merchant: { id, … } }`
+*   updates it (without an `id` the API would create a second merchant, so the
+*   route requires one).
+* - user: `GET /user` (read-only here; the API's `POST /user` invites users and
+*   needs the admin scope).
+*/
+const SHOPWAVE_RESOURCES = Object.freeze({
+	merchant: {
+		route: "merchant",
+		key: "merchant",
+		upstream: "merchant",
+		writable: true
+	},
+	user: {
+		route: "user",
+		key: "user",
+		upstream: "user",
+		writable: false
+	}
+});
+/** `UploadKind` → the API's `contentType` value. */
+const UPLOAD_KINDS = Object.freeze({
+	merchant: "merchant",
+	merchantFeature: "merchantFeature",
+	product: "product",
+	user: "user",
+	applicationLogo: "applicaionLogo",
+	applicationImages: "applicaionImages"
+});
+/** How uploads are addressed (app route and Shopwave uploader). */
+const SHOPWAVE_UPLOAD = Object.freeze({
+	route: "upload",
+	upstream: "uploader",
+	kindHeader: "contentType",
+	fileField: "file",
+	kindField: "kind"
+});
+function isUploadKind(value) {
+	return typeof value === "string" && Object.prototype.hasOwnProperty.call(UPLOAD_KINDS, value);
+}
+
+//#endregion
+//#region src/core/imageFit.ts
+/**
+* The centred part of a `srcWidth × srcHeight` image with the aspect ratio of
+* `dstWidth × dstHeight` (like CSS `object-fit: cover`).
+*/
+function coverCrop(srcWidth, srcHeight, dstWidth, dstHeight) {
+	if (![
+		srcWidth,
+		srcHeight,
+		dstWidth,
+		dstHeight
+	].every((n) => Number.isFinite(n) && n > 0)) throw new Error("coverCrop: sizes must be positive numbers");
+	const srcRatio = srcWidth / srcHeight;
+	const dstRatio = dstWidth / dstHeight;
+	if (srcRatio > dstRatio) {
+		const sw = Math.round(srcHeight * dstRatio);
+		return {
+			sx: Math.round((srcWidth - sw) / 2),
+			sy: 0,
+			sw,
+			sh: srcHeight
+		};
+	}
+	const sh = Math.round(srcWidth / dstRatio);
+	return {
+		sx: 0,
+		sy: Math.round((srcHeight - sh) / 2),
+		sw: srcWidth,
+		sh
+	};
+}
+function requireBrowserImages(fn) {
+	if (typeof createImageBitmap !== "function") throw new Error(`${fn} needs a browser (createImageBitmap is not available)`);
+}
+/** Reads an image file's pixel size (browser only). */
+async function readImageSize(file) {
+	requireBrowserImages("readImageSize");
+	const bitmap = await createImageBitmap(file);
+	try {
+		return {
+			width: bitmap.width,
+			height: bitmap.height
+		};
+	} finally {
+		bitmap.close?.();
+	}
+}
+/**
+* Returns the image at exactly `width × height`: scaled and centre-cropped
+* (never stretched). Browser only. The result is a `File` named like the
+* input, with the output type's extension.
+*/
+async function fitImageToSize(file, width, height, options = {}) {
+	requireBrowserImages("fitImageToSize");
+	const { type = "image/png", quality, keepIfExact = true } = options;
+	const name = file.name || "image";
+	const ext = type === "image/jpeg" ? "jpg" : type.split("/")[1];
+	const outName = `${name.replace(/\.[^.]+$/, "")}.${ext}`;
+	const bitmap = await createImageBitmap(file);
+	try {
+		if (keepIfExact && bitmap.width === width && bitmap.height === height && file.type === type) return file instanceof File ? file : new File([file], outName, { type });
+		const { sx, sy, sw, sh } = coverCrop(bitmap.width, bitmap.height, width, height);
+		let blob;
+		if (typeof OffscreenCanvas === "function") {
+			const canvas = new OffscreenCanvas(width, height);
+			const ctx = canvas.getContext("2d");
+			if (!ctx) throw new Error("fitImageToSize: no 2D canvas context");
+			ctx.imageSmoothingQuality = "high";
+			ctx.drawImage(bitmap, sx, sy, sw, sh, 0, 0, width, height);
+			blob = await canvas.convertToBlob({
+				type,
+				quality
+			});
+		} else {
+			const canvas = document.createElement("canvas");
+			canvas.width = width;
+			canvas.height = height;
+			const ctx = canvas.getContext("2d");
+			if (!ctx) throw new Error("fitImageToSize: no 2D canvas context");
+			ctx.imageSmoothingQuality = "high";
+			ctx.drawImage(bitmap, sx, sy, sw, sh, 0, 0, width, height);
+			blob = await new Promise((resolve, reject) => canvas.toBlob((b) => b ? resolve(b) : reject(/* @__PURE__ */ new Error("fitImageToSize: encoding failed")), type, quality));
+		}
+		return new File([blob], outName, { type });
+	} finally {
+		bitmap.close?.();
+	}
+}
+
+//#endregion
+//#region src/core/upload.ts
+/**
+* HTTPS host that serves the Shopwave CDN's images. The API returns
+* `http://static.merchantstack.com/images/…`, which has no HTTPS endpoint
+* (checked Sep 2026), so pages served over HTTPS can't show it.
+*/
+const SHOPWAVE_IMAGE_BASE_URL = "https://s3-eu-west-1.amazonaws.com/static.merchantstack.com/images";
+const STATIC_HOST = /^https?:\/\/static\.merchantstack\.com\/images\//i;
+/**
+* Turns an image path from the API into a URL a page can load over HTTPS:
+* `http://static.merchantstack.com/images/x.png` → `<base>/x.png`, and a
+* relative path (`merchant/5644/logo/x.png`) → `<base>/merchant/5644/logo/x.png`.
+* Other absolute URLs are returned unchanged; empty input gives `""`.
+*/
+function getImageUrl(path, base = SHOPWAVE_IMAGE_BASE_URL) {
+	if (!path) return "";
+	const root = base.replace(/\/+$/, "");
+	if (STATIC_HOST.test(path)) return `${root}/${path.replace(STATIC_HOST, "")}`;
+	if (/^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith("//")) return path;
+	return `${root}/${path.replace(/^\/+/, "")}`;
+}
+/**
+* Uploads one image to the Shopwave CDN through the app's `/api/upload` route
+* (`createShopwaveApi(...).upload()`), and returns its id and URL.
+*
+* The file only lands on the CDN (under `…/images/<kind>/<merchantId>/…`); a
+* record has to point at it to use it. Live API (Sep 2026): the upload answers
+* 201 `{ fileName, path }`.
+*/
+async function uploadImage(file, params, options = {}) {
+	if (!file || typeof file.size !== "number") throw new Error("uploadImage: file must be a File or Blob");
+	if (!isUploadKind(params?.kind)) throw new Error(`uploadImage: unknown kind "${params?.kind}"`);
+	const name = params.fileName ?? file.name ?? "upload";
+	const form = new FormData();
+	form.append(SHOPWAVE_UPLOAD.fileField, file, name);
+	form.append(SHOPWAVE_UPLOAD.kindField, params.kind);
+	const { status, body: raw } = await apiRequest(`/api/${SHOPWAVE_UPLOAD.route}`, {
+		method: "POST",
+		body: form
+	}, options);
+	const body = raw;
+	assertNoApiErrors(body, status);
+	const id = typeof body?.fileName === "string" ? body.fileName : "";
+	const path = typeof body?.path === "string" ? body.path : "";
+	if (!id) throw new ShopwaveApiError(status, `Shopwave API error (${status}): the upload response has no fileName`, { body });
+	return {
+		id,
+		url: getImageUrl(path),
+		path
+	};
+}
+
+//#endregion
+//#region src/core/merchantImages.ts
+/** The three image slots on the merchant settings page. */
+const MERCHANT_IMAGE_SLOT_KEYS = [
+	"receipt",
+	"square",
+	"featured"
+];
+/**
+* Where each slot lives, its upload kind and its exact size (from adminV1's
+* merchant settings page).
+*/
+const MERCHANT_IMAGE_SLOTS = Object.freeze({
+	receipt: {
+		field: "logo.receipt",
+		uploadKind: "merchant",
+		width: 576,
+		height: 325
+	},
+	square: {
+		field: "logo.square",
+		uploadKind: "merchant",
+		width: 1e3,
+		height: 1e3
+	},
+	featured: {
+		field: "feature[0]",
+		uploadKind: "merchantFeature",
+		width: 1200,
+		height: 600
+	}
+});
+/**
+* The file name in an image value: `"http://…/logo/abc.png"` → `"abc.png"`,
+* `"abc.png"` → `"abc.png"`. Query strings and fragments are ignored.
+* Returns `null` for empty or non-string values.
+*/
+function imageFileName(value) {
+	if (typeof value !== "string") return null;
+	const last = value.trim().replace(/[?#].*$/, "").split("/").pop() ?? "";
+	return last ? decodeURIComponent(last) : null;
+}
+/** The stored value for a slot (a URL when read from the API; a file name right after an upload). */
+function getMerchantImage(imageIds, slot) {
+	if (!imageIds || typeof imageIds !== "object") return null;
+	let value;
+	if (slot === "featured") value = Array.isArray(imageIds.feature) ? imageIds.feature[0] : void 0;
+	else {
+		const logo = imageIds.logo;
+		value = logo && typeof logo === "object" ? logo[slot] : void 0;
+	}
+	return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+/**
+* An HTTPS URL for a slot's stored image, or `""` when the slot is empty or
+* holds only a file name (a fresh upload not yet saved; use the upload's `url`).
+*/
+function getMerchantImageUrl(imageIds, slot, base) {
+	const value = getMerchantImage(imageIds, slot);
+	if (!value || !value.includes("/")) return "";
+	return getImageUrl(value, base);
+}
+/**
+* Returns a copy of `imageIds` with one slot set to `fileName` (or cleared
+* with `null`). Other slots and unknown keys are kept; an empty `logo` or
+* `feature` is removed.
+*/
+function setMerchantImage(imageIds, slot, fileName) {
+	const next = { ...imageIds && typeof imageIds === "object" ? imageIds : {} };
+	if (slot === "featured") {
+		const rest = Array.isArray(next.feature) ? next.feature.slice(1) : [];
+		const feature = fileName ? [fileName, ...rest] : rest;
+		if (feature.length > 0) next.feature = feature;
+		else delete next.feature;
+	} else {
+		const logo = { ...next.logo && typeof next.logo === "object" ? next.logo : {} };
+		if (fileName) logo[slot] = fileName;
+		else delete logo[slot];
+		if (Object.keys(logo).length > 0) next.logo = logo;
+		else delete next.logo;
+	}
+	return next;
+}
+function toStored(value) {
+	if (typeof value === "string") return imageFileName(value) ?? void 0;
+	if (Array.isArray(value)) {
+		const items = value.map(toStored).filter((v) => v !== void 0 && v !== null && v !== "");
+		return items.length > 0 ? items : void 0;
+	}
+	if (value && typeof value === "object") {
+		const out = {};
+		for (const [k, v] of Object.entries(value)) {
+			const stored = toStored(v);
+			if (stored !== void 0 && stored !== null && stored !== "") out[k] = stored;
+		}
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
+}
+/**
+* The `imageIds` to send on a save: every URL is turned back into its file
+* name (what adminV1 does with images you didn't change) and empty values
+* are dropped. No images gives `{}`.
+*/
+function toStoredImageIds(imageIds) {
+	return toStored(imageIds) ?? {};
+}
+/**
+* Uploads an image for a merchant slot: fits it to the slot's size, uploads
+* it with the slot's kind, and returns `{ id, url, path }`. Put `id` into
+* `imageIds` with {@link setMerchantImage} and save with `updateMerchant`.
+*/
+async function uploadMerchantImage(file, slot, options = {}) {
+	const def = MERCHANT_IMAGE_SLOTS[slot];
+	if (!def) throw new Error(`uploadMerchantImage: unknown slot "${slot}"`);
+	const { fit = true, fitOptions,...requestOptions } = options;
+	return uploadImage(fit ? await fitImageToSize(file, def.width, def.height, fitOptions) : file, { kind: def.uploadKind }, requestOptions);
+}
+
+//#endregion
+//#region src/core/merchant.ts
+const MERCHANT_PATH = `/api/${SHOPWAVE_RESOURCES.merchant.route}`;
+/** Colour keys inside `colours.primary`, in display order. */
+const MERCHANT_COLOUR_KEYS = [
+	"main",
+	"highlight",
+	"contrast"
+];
+/** Flat link fields a form edits, in display order. */
+const MERCHANT_LINK_KEYS = [
+	"website",
+	"twitter",
+	"facebook",
+	"instagram"
+];
+/** Where each flat link field lives in `merchant.links`. */
+const MERCHANT_LINK_PATHS = Object.freeze({
+	website: ["website", "home"],
+	twitter: ["social", "twitter"],
+	facebook: ["social", "facebook"],
+	instagram: ["social", "instagram"]
+});
+function trimmed(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+/**
+* Reads `merchant.links` as flat fields (`{ website, twitter, facebook,
+* instagram }`), whatever shape it was saved in:
+* - the nested shape adminV1 saves (`{ website: { home }, social: { … } }`);
+* - flat keys (`{ website: "…" }`, what SDK 0.4.0 pre-releases sent);
+* - an array in {@link MERCHANT_LINK_KEYS} order (older AdminUI versions).
+* Empty values are dropped.
+*/
+function merchantLinksToForm(links) {
+	const out = {};
+	if (Array.isArray(links)) {
+		links.forEach((value, i) => {
+			const key = MERCHANT_LINK_KEYS[i];
+			const v = trimmed(value);
+			if (key && v) out[key] = v;
+		});
+		return out;
+	}
+	if (!links || typeof links !== "object") return out;
+	const obj = links;
+	for (const key of MERCHANT_LINK_KEYS) {
+		const [group, field] = MERCHANT_LINK_PATHS[key];
+		const nested = obj[group];
+		const v = nested && typeof nested === "object" && !Array.isArray(nested) ? trimmed(nested[field]) : trimmed(obj[key]);
+		if (v) out[key] = v;
+	}
+	return out;
+}
+/**
+* Builds the stored `links` object from flat fields. Empty values are left
+* out, and so is a group with nothing in it; no links gives `{}`.
+*/
+function merchantLinksFromForm(form) {
+	const out = {};
+	for (const key of MERCHANT_LINK_KEYS) {
+		const v = trimmed(form[key]);
+		if (!v) continue;
+		const [group, field] = MERCHANT_LINK_PATHS[key];
+		(out[group] ??= {})[field] = v;
+	}
+	return out;
+}
+/** Reads any stored or older `links` value into the nested shape adminV1 saves. */
+function normalizeMerchantLinks(links) {
+	return merchantLinksFromForm(merchantLinksToForm(links));
+}
+/**
+* Object fields of the merchant. The API keeps one you leave out, and
+* replaces it as a whole when you send it.
+*/
+const MERCHANT_OBJECT_FIELDS = [
+	"colours",
+	"links",
+	"imageIds"
+];
+/** Fields the API sets itself; `updateMerchant` never sends them back. */
+const MERCHANT_READ_ONLY_FIELDS = ["createdDate", "modifiedDate"];
+/**
+* Longest values the API stores. Longer values are cut off silently
+* (live API, Sep 2026), so `updateMerchant` rejects them instead.
+* `vatNumber` fits a UK VAT number without the `GB` prefix.
+*/
+const MERCHANT_FIELD_MAX_LENGTH = Object.freeze({
+	companyNumber: 11,
+	vatNumber: 9
+});
+/** Returns `"<field> is longer than <n> characters"` messages for over-long fields. */
+function validateMerchant(merchant) {
+	const problems = [];
+	for (const [field, max] of Object.entries(MERCHANT_FIELD_MAX_LENGTH)) {
+		const value = merchant[field];
+		if (typeof value === "string" && value.length > max) problems.push(`${field} is longer than ${max} characters`);
+	}
+	return problems;
+}
+/**
+* Reads the logged-in user's merchant (a user has exactly one), or `null`
+* when the API returns none.
+*/
+async function fetchMerchant(options = {}) {
+	const json = await apiGet(MERCHANT_PATH, {}, options);
+	assertNoApiErrors(json, 200);
+	return json?.merchant ?? null;
+}
+/**
+* Updates the merchant and returns it as stored.
+*
+* Shopwave's `POST /merchant` replaces the whole record: a scalar field you
+* leave out (`companyNumber`, `vatNumber`, `note`, …) is set to null, while
+* an object field you leave out (`colours`, `links`, `imageIds`) is kept and
+* one you send replaces the stored one; sending `{}` clears it (live API,
+* Sep 2026). So by default the
+* current merchant is read first and the patch is merged over it.
+*
+* `imageIds` is always sent as file names ({@link toStoredImageIds}), so you
+* can pass back what you read. See `MerchantImageIds` for the shape.
+*
+* The API answers 205 with an empty body, so the merchant is read again after
+* the save and that is what's returned (it shows exactly what was kept).
+* Throws before sending when a value is longer than the API stores
+* ({@link MERCHANT_FIELD_MAX_LENGTH}).
+*/
+async function updateMerchant(patch, options = {}) {
+	const { merge = true,...requestOptions } = options;
+	let merchant = { ...patch };
+	if (merge) {
+		const current = await fetchMerchant(requestOptions);
+		if (!current) throw new ShopwaveApiError(404, "Shopwave API error (404): no merchant to update");
+		if (patch.id != null && String(patch.id) !== String(current.id)) throw new Error(`Merchant id ${patch.id} is not the logged-in merchant (${current.id})`);
+		merchant = {
+			...current,
+			...patch,
+			id: current.id
+		};
+		for (const field of MERCHANT_OBJECT_FIELDS) if (!(field in patch)) delete merchant[field];
+	}
+	if (merchant.imageIds && typeof merchant.imageIds === "object") merchant.imageIds = toStoredImageIds(merchant.imageIds);
+	if (merchant.id == null || merchant.id === "") throw new Error("merchant id is missing");
+	for (const field of MERCHANT_READ_ONLY_FIELDS) delete merchant[field];
+	const problems = validateMerchant(merchant);
+	if (problems.length > 0) throw new Error(`Invalid merchant: ${problems.join("; ")}`);
+	const { status, body: raw } = await apiRequest(MERCHANT_PATH, {
+		method: "PUT",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ merchant })
+	}, requestOptions);
+	const body = raw;
+	assertNoApiErrors(body, status);
+	const echoed = body?.merchant && typeof body.merchant === "object" ? body.merchant : null;
+	if (echoed) return {
+		...merchant,
+		...echoed,
+		id: Number(echoed.id ?? merchant.id)
+	};
+	return await fetchMerchant(requestOptions) ?? {
+		...merchant,
+		id: Number(merchant.id)
+	};
+}
+
+//#endregion
+//#region src/core/user.ts
+/** Reads the logged-in user, or `null` when the API returns none. */
+async function fetchUser(options = {}) {
+	const json = await apiGet(`/api/${SHOPWAVE_RESOURCES.user.route}`, {}, options);
+	assertNoApiErrors(json, 200);
+	return json?.user ?? null;
+}
+
 //#endregion
 exports.DEFAULT_BASKET_FILTERS = DEFAULT_BASKET_FILTERS;
 exports.DEFAULT_PAGINATION = DEFAULT_PAGINATION;
+exports.MERCHANT_COLOUR_KEYS = MERCHANT_COLOUR_KEYS;
+exports.MERCHANT_FIELD_MAX_LENGTH = MERCHANT_FIELD_MAX_LENGTH;
+exports.MERCHANT_IMAGE_SLOTS = MERCHANT_IMAGE_SLOTS;
+exports.MERCHANT_IMAGE_SLOT_KEYS = MERCHANT_IMAGE_SLOT_KEYS;
+exports.MERCHANT_LINK_KEYS = MERCHANT_LINK_KEYS;
+exports.MERCHANT_LINK_PATHS = MERCHANT_LINK_PATHS;
+exports.MERCHANT_OBJECT_FIELDS = MERCHANT_OBJECT_FIELDS;
+exports.MERCHANT_READ_ONLY_FIELDS = MERCHANT_READ_ONLY_FIELDS;
 exports.PromotionRuleSet = PromotionRuleSet;
 exports.SHOPWAVE_ENTITIES = SHOPWAVE_ENTITIES;
+exports.SHOPWAVE_IMAGE_BASE_URL = SHOPWAVE_IMAGE_BASE_URL;
+exports.SHOPWAVE_RESOURCES = SHOPWAVE_RESOURCES;
+exports.SHOPWAVE_UPLOAD = SHOPWAVE_UPLOAD;
 exports.ShopwaveApiError = ShopwaveApiError;
+exports.UPLOAD_KINDS = UPLOAD_KINDS;
 exports.apiDelete = apiDelete;
 exports.apiGet = apiGet;
 exports.apiRequest = apiRequest;
@@ -727,6 +1219,7 @@ exports.collectConsumerIds = collectConsumerIds;
 exports.collectProductIds = collectProductIds;
 exports.combineBasketRows = combineBasketRows;
 exports.computeBasketSummary = computeBasketSummary;
+exports.coverCrop = coverCrop;
 exports.deleteCategory = deleteCategory;
 exports.deleteEmployee = deleteEmployee;
 exports.deleteEntity = deleteEntity;
@@ -741,6 +1234,7 @@ exports.fetchConsumers = fetchConsumers;
 exports.fetchEmployee = fetchEmployee;
 exports.fetchEmployees = fetchEmployees;
 exports.fetchEntityById = fetchEntityById;
+exports.fetchMerchant = fetchMerchant;
 exports.fetchProduct = fetchProduct;
 exports.fetchProducts = fetchProducts;
 exports.fetchProductsMap = fetchProductsMap;
@@ -750,13 +1244,24 @@ exports.fetchReport = fetchReport;
 exports.fetchSession = fetchSession;
 exports.fetchStore = fetchStore;
 exports.fetchStores = fetchStores;
+exports.fetchUser = fetchUser;
+exports.fitImageToSize = fitImageToSize;
 exports.formatDateForQuery = formatDateForQuery;
 exports.getApiErrorMap = getApiErrorMap;
 exports.getApiErrors = getApiErrors;
+exports.getImageUrl = getImageUrl;
+exports.getMerchantImage = getMerchantImage;
+exports.getMerchantImageUrl = getMerchantImageUrl;
+exports.imageFileName = imageFileName;
+exports.isUploadKind = isUploadKind;
 exports.loginPath = loginPath;
 exports.logout = logout;
 exports.logoutPath = logoutPath;
+exports.merchantLinksFromForm = merchantLinksFromForm;
+exports.merchantLinksToForm = merchantLinksToForm;
+exports.normalizeMerchantLinks = normalizeMerchantLinks;
 exports.parseBasketReportData = parseBasketReportData;
+exports.readImageSize = readImageSize;
 exports.rolesById = rolesById;
 exports.saveCategory = saveCategory;
 exports.saveEmployee = saveEmployee;
@@ -765,7 +1270,13 @@ exports.saveEntity = saveEntity;
 exports.saveProduct = saveProduct;
 exports.savePromotion = savePromotion;
 exports.saveStore = saveStore;
+exports.setMerchantImage = setMerchantImage;
 exports.submitEntity = submitEntity;
 exports.toShopwaveApiError = toShopwaveApiError;
+exports.toStoredImageIds = toStoredImageIds;
+exports.updateMerchant = updateMerchant;
+exports.uploadImage = uploadImage;
+exports.uploadMerchantImage = uploadMerchantImage;
+exports.validateMerchant = validateMerchant;
 exports.withToken = withToken;
 //# sourceMappingURL=index.cjs.map