@01.software/sdk 0.15.0 → 0.16.0

package/README.md

@@ -590,6 +590,22 @@ SOFTWARE_SECRET_KEY=sk01_...  # Server only — opaque API key from Console
 
 ## Migration Guide
 
+### v0.16.0 (Phase 1–7 sync — additive)
+
+New error codes propagated via `SDKError.code` (no breaking change; existing callers ignore unknown codes safely):
+
+| Code | Phase | Trigger |
+|---|---|---|
+| `account_suspended` | P1 | Suspended session / `sk01_` / `pat01_` / customer JWT — 401 |
+| `pat_tenant_header_forbidden` | P1 | `pat01_` with `X-Tenant-Id` header — 401 (header rejected) |
+| `tenant_mismatch` | P3 | Cross-tenant FK rejection (forms / community / orders) |
+| `server_derived` | P3 | Body-driven write into a server-derived state field — 422 |
+| `scope_denied` | P5 | `pat01_` whose `ApiKeys.scopes` lacks the operation |
+
+P5 also adds JWT-`jti` revocation: `revokeCustomerJti(jti, ttl)` on the server invalidates a token immediately; subsequent SDK calls receive `401 { code: 'token_revoked' }`.
+
+`COLLECTIONS` and `INTERNAL_COLLECTIONS` are now both exported from `@01.software/sdk`. Use `INTERNAL_COLLECTIONS` to detect admin-only slugs in custom tooling.
+
 ### v0.8.0 (Breaking Changes)
 
 **Field renames** — update any code that reads these fields from API responses:

package/dist/const-BLwHrFZ-.d.cts

@@ -0,0 +1,24 @@
+import { C as Config } from './payload-types-DRvL_bS2.cjs';
+
+/**
+ * Collection type derived from Payload Config.
+ * This ensures type safety and automatic synchronization with payload-types.ts
+ */
+type Collection = keyof Config['collections'];
+/**
+ * Internal collections that should not be exposed via SDK.
+ * Includes Payload system collections and admin-only collections.
+ */
+declare const INTERNAL_COLLECTIONS: readonly ["users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "tenant-auth-settings", "tenant-community-settings", "api-usage", "tenant-analytics-daily", "analytics-event-schemas", "subscriptions", "billing-history", "order-status-logs", "api-keys", "personal-access-tokens", "tenant-entitlements", "webhook-events", "webhook-deliveries", "audit-logs", "plans", "webhooks"];
+/**
+ * Array of all public collection names for runtime use (e.g., Zod enum validation).
+ * This is the single source of truth for which collections are publicly accessible via SDK.
+ */
+declare const COLLECTIONS: readonly ["tenants", "tenant-metadata", "tenant-logos", "products", "product-variants", "product-options", "product-option-values", "product-categories", "product-tags", "product-collections", "brands", "brand-logos", "orders", "order-items", "returns", "return-items", "fulfillments", "fulfillment-items", "transactions", "customers", "customer-addresses", "customer-groups", "carts", "cart-items", "discounts", "promotions", "shipping-policies", "documents", "document-categories", "document-types", "posts", "post-authors", "post-categories", "post-tags", "playlists", "playlist-categories", "playlist-tags", "tracks", "track-categories", "track-tags", "galleries", "gallery-categories", "gallery-tags", "gallery-items", "links", "link-categories", "link-tags", "canvases", "canvas-node-types", "canvas-edge-types", "canvas-categories", "canvas-tags", "canvas-nodes", "canvas-edges", "videos", "video-categories", "video-tags", "live-streams", "images", "forms", "form-submissions", "threads", "comments", "reactions", "reaction-types", "bookmarks", "thread-categories", "reports", "community-bans"];
+/**
+ * Public collections available for SDK access.
+ * Derived from the COLLECTIONS array (single source of truth).
+ */
+type PublicCollection = (typeof COLLECTIONS)[number];
+
+export { type Collection as C, INTERNAL_COLLECTIONS as I, type PublicCollection as P, COLLECTIONS as a };

package/dist/const-RMD3ZVaS.d.ts

@@ -0,0 +1,24 @@
+import { C as Config } from './payload-types-DRvL_bS2.js';
+
+/**
+ * Collection type derived from Payload Config.
+ * This ensures type safety and automatic synchronization with payload-types.ts
+ */
+type Collection = keyof Config['collections'];
+/**
+ * Internal collections that should not be exposed via SDK.
+ * Includes Payload system collections and admin-only collections.
+ */
+declare const INTERNAL_COLLECTIONS: readonly ["users", "payload-kv", "payload-locked-documents", "payload-preferences", "payload-migrations", "field-configs", "system-media", "track-assets", "audiences", "email-logs", "tenant-auth-settings", "tenant-community-settings", "api-usage", "tenant-analytics-daily", "analytics-event-schemas", "subscriptions", "billing-history", "order-status-logs", "api-keys", "personal-access-tokens", "tenant-entitlements", "webhook-events", "webhook-deliveries", "audit-logs", "plans", "webhooks"];
+/**
+ * Array of all public collection names for runtime use (e.g., Zod enum validation).
+ * This is the single source of truth for which collections are publicly accessible via SDK.
+ */
+declare const COLLECTIONS: readonly ["tenants", "tenant-metadata", "tenant-logos", "products", "product-variants", "product-options", "product-option-values", "product-categories", "product-tags", "product-collections", "brands", "brand-logos", "orders", "order-items", "returns", "return-items", "fulfillments", "fulfillment-items", "transactions", "customers", "customer-addresses", "customer-groups", "carts", "cart-items", "discounts", "promotions", "shipping-policies", "documents", "document-categories", "document-types", "posts", "post-authors", "post-categories", "post-tags", "playlists", "playlist-categories", "playlist-tags", "tracks", "track-categories", "track-tags", "galleries", "gallery-categories", "gallery-tags", "gallery-items", "links", "link-categories", "link-tags", "canvases", "canvas-node-types", "canvas-edge-types", "canvas-categories", "canvas-tags", "canvas-nodes", "canvas-edges", "videos", "video-categories", "video-tags", "live-streams", "images", "forms", "form-submissions", "threads", "comments", "reactions", "reaction-types", "bookmarks", "thread-categories", "reports", "community-bans"];
+/**
+ * Public collections available for SDK access.
+ * Derived from the COLLECTIONS array (single source of truth).
+ */
+type PublicCollection = (typeof COLLECTIONS)[number];
+
+export { type Collection as C, INTERNAL_COLLECTIONS as I, type PublicCollection as P, COLLECTIONS as a };

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(src_exports, {
   DiscountApi: () => DiscountApi,
   GoneError: () => GoneError,
   IMAGE_SIZES: () => IMAGE_SIZES,
+  INTERNAL_COLLECTIONS: () => INTERNAL_COLLECTIONS,
   ModerationApi: () => ModerationApi,
   NetworkError: () => NetworkError,
   NotFoundError: () => NotFoundError,
@@ -1065,6 +1066,34 @@ var CollectionClient = class extends HttpClient {
 };
 
 // src/core/collection/const.ts
+var INTERNAL_COLLECTIONS = [
+  "users",
+  "payload-kv",
+  "payload-locked-documents",
+  "payload-preferences",
+  "payload-migrations",
+  "field-configs",
+  "system-media",
+  "track-assets",
+  "audiences",
+  "email-logs",
+  "tenant-auth-settings",
+  "tenant-community-settings",
+  "api-usage",
+  "tenant-analytics-daily",
+  "analytics-event-schemas",
+  "subscriptions",
+  "billing-history",
+  "order-status-logs",
+  "api-keys",
+  "personal-access-tokens",
+  "tenant-entitlements",
+  "webhook-events",
+  "webhook-deliveries",
+  "audit-logs",
+  "plans",
+  "webhooks"
+];
 var COLLECTIONS = [
   "tenants",
   "tenant-metadata",
@@ -1091,6 +1120,7 @@ var COLLECTIONS = [
   "carts",
   "cart-items",
   "discounts",
+  "promotions",
   "shipping-policies",
   "documents",
   "document-categories",
@@ -1117,6 +1147,8 @@ var COLLECTIONS = [
   "canvas-edge-types",
   "canvas-categories",
   "canvas-tags",
+  "canvas-nodes",
+  "canvas-edges",
   "videos",
   "video-categories",
   "video-tags",