Auth API Service

Thin Dio wrapper for every auth endpoint. Owns the dual-login dance: loginCustomer is mandatory, loginSeller is best-effort (returns null on 401 instead of throwing) so callers can detect 'user is customer-only' without an exception path.

1. dualLogin(request) calls loginCustomer first — any non-401 customer error throws.
2. Then calls loginSeller — a 401 is swallowed and returned as null.
3. Returns DualLoginResponse{customerToken, sellerToken?} with hasBothRoles / isCustomerOnly helpers.
4. register, verify (OTP), loginGoogle, loginApple, changePassword are independent endpoints — no dual handling.

• Every call annotates Options with a RequestTrace (feature/screen/action/authScope) — used by TraceInterceptor in debug mode.
• Apple/Google login both return a DualLoginResponse with sellerToken=null; OAuth users have no seller path yet.
• changePassword has bespoke error mapping for HTML 4xx/5xx responses (DOCTYPE detection) because the Medusa admin path leaks HTML in some failure modes.

• lib/src/core/services/auth_service.dart:14 // DualLoginResponse
• lib/src/core/services/auth_service.dart:24 // AuthApiService
• lib/src/core/services/auth_service.dart:99 // dualLogin
• lib/src/core/services/auth_service.dart:127 // loginGoogle
• lib/src/core/services/auth_service.dart:160 // loginApple

• POST/auth/sign-in/emailno status

  Legacy single-token email/password sign-in — kept on the old AuthService for AuthRepositoryImpl compatibility, not used by the current Riverpod notifier.

  Request

  { email: string, password: string }

  Response

  { token: string }

  lib/src/features/shared/auth/login/data/auth_service.dart

  auth: none. Unrouted today — superseded by /auth/customer/emailpass-verified.

There is a legacy AuthService at lib/src/features/shared/auth/login/data/auth_service.dart hitting /auth/sign-in/email — only used by the older AuthRepositoryImpl, not by the current LoginNotifier. Endpoints already exposed via the notifier nodes (login-notifier, register-notifier, change-password-notifier) are NOT duplicated here — only the legacy /auth/sign-in/email is.