@01.software/sdk 0.46.0 → 0.48.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (57) hide show
  1. package/CHANGELOG.md +75 -1
  2. package/README.md +81 -7
  3. package/dist/client.cjs +304 -63
  4. package/dist/client.cjs.map +1 -1
  5. package/dist/client.d.cts +6 -6
  6. package/dist/client.d.ts +6 -6
  7. package/dist/client.js +304 -63
  8. package/dist/client.js.map +1 -1
  9. package/dist/{collection-client-DolMjCoC.d.cts → collection-client-CBup9yOx.d.cts} +4 -4
  10. package/dist/{collection-client-D6kKrYdq.d.ts → collection-client-D3ExJU-7.d.ts} +4 -4
  11. package/dist/{const-BAG0MH0u.d.cts → const-BXEi1Kix.d.cts} +4 -4
  12. package/dist/{const-CaPq2AE4.d.ts → const-k9gHylYa.d.ts} +4 -4
  13. package/dist/errors.cjs +49 -1
  14. package/dist/errors.cjs.map +1 -1
  15. package/dist/errors.d.cts +3 -3
  16. package/dist/errors.d.ts +3 -3
  17. package/dist/errors.js +49 -1
  18. package/dist/errors.js.map +1 -1
  19. package/dist/{index-YGrZrxNn.d.cts → index-BCM9CTL7.d.cts} +3 -3
  20. package/dist/{index-BNICJxBL.d.ts → index-CHGGkcLj.d.ts} +3 -3
  21. package/dist/index.cjs +308 -64
  22. package/dist/index.cjs.map +1 -1
  23. package/dist/index.d.cts +7 -7
  24. package/dist/index.d.ts +7 -7
  25. package/dist/index.js +308 -64
  26. package/dist/index.js.map +1 -1
  27. package/dist/{payload-types-CJZuXcgF.d.cts → payload-types-B6AZQcB7.d.cts} +182 -15
  28. package/dist/{payload-types-CJZuXcgF.d.ts → payload-types-B6AZQcB7.d.ts} +182 -15
  29. package/dist/query.cjs +144 -43
  30. package/dist/query.cjs.map +1 -1
  31. package/dist/query.d.cts +5 -5
  32. package/dist/query.d.ts +5 -5
  33. package/dist/query.js +144 -43
  34. package/dist/query.js.map +1 -1
  35. package/dist/realtime.d.cts +2 -2
  36. package/dist/realtime.d.ts +2 -2
  37. package/dist/server.cjs +385 -63
  38. package/dist/server.cjs.map +1 -1
  39. package/dist/server.d.cts +7 -7
  40. package/dist/server.d.ts +7 -7
  41. package/dist/server.js +385 -63
  42. package/dist/server.js.map +1 -1
  43. package/dist/storefront-cache.cjs +49 -1
  44. package/dist/storefront-cache.cjs.map +1 -1
  45. package/dist/storefront-cache.js +49 -1
  46. package/dist/storefront-cache.js.map +1 -1
  47. package/dist/{types-D5p7-m1l.d.cts → types-8us-_C-Q.d.cts} +2 -2
  48. package/dist/{types-BC6rVmJa.d.ts → types-ByD2zii1.d.ts} +2 -2
  49. package/dist/{types-xlqBeW2N.d.cts → types-CM2je9Kw.d.cts} +84 -7
  50. package/dist/{types-C60vHIkY.d.ts → types-DbA5V3mt.d.ts} +84 -7
  51. package/dist/ui/form.d.cts +1 -1
  52. package/dist/ui/form.d.ts +1 -1
  53. package/dist/ui/video.d.cts +1 -1
  54. package/dist/ui/video.d.ts +1 -1
  55. package/dist/webhook.d.cts +4 -4
  56. package/dist/webhook.d.ts +4 -4
  57. package/package.json +6 -6
package/dist/client.cjs CHANGED
@@ -67,34 +67,78 @@ var SDKError = class extends Error {
67
67
  };
68
68
  var COMMERCE_ERROR_CODES = [
69
69
  "validation_failed",
70
+ "bad_request",
70
71
  "unauthorized",
71
72
  "forbidden",
73
+ "account_suspended",
74
+ "key_invalid",
75
+ "pat_tenant_header_forbidden",
76
+ "tenant_mismatch",
77
+ "test_tenant_expired",
78
+ "token_invalid",
72
79
  "token_expired",
73
80
  "origin_not_allowed",
74
81
  "server_credentials_required",
82
+ "role_denied",
83
+ "scope_denied",
84
+ "feature_disabled",
75
85
  "not_found",
76
86
  "conflict",
87
+ "locked",
77
88
  "cart_revision_conflict",
78
89
  "rate_limit_exceeded",
79
90
  "usage_limit_exceeded",
80
91
  "service_unavailable",
81
92
  "idempotency_conflict",
82
93
  "idempotency_in_progress",
94
+ "idempotency_key_required",
95
+ "invalid_idempotency_key",
83
96
  "cart_not_active",
84
97
  "cart_locked",
85
98
  "cart_empty",
86
99
  "cart_market_unavailable",
87
100
  "cart_market_mismatch",
88
101
  "checkout_not_open",
102
+ "checkout_already_open",
89
103
  "payment_slot_held",
90
104
  "reservation_expired",
91
105
  "payment_session_not_cancelable",
106
+ "payment_session_conflict",
92
107
  "provider_identity_mismatch",
108
+ "payment_method_unavailable",
93
109
  "provider_unavailable",
94
110
  "lock_timeout",
95
111
  "price_changed",
96
112
  "pricing_fact_in_use",
97
113
  "insufficient_stock",
114
+ "reservation_conflict",
115
+ "stock_lock_unavailable",
116
+ "variant_not_found",
117
+ "variant_stock_write_failed",
118
+ "stock_invariant_violation",
119
+ "payment_confirmation_in_flight",
120
+ "checkout_reservation_release_requires_transaction",
121
+ "admission_metadata_invalid",
122
+ "admission_metadata_required",
123
+ "capacity_exceeded",
124
+ "occurrence_lock_unavailable",
125
+ "occurrence_not_open",
126
+ "admission_type_capacity_exceeded",
127
+ "admission_type_occurrence_mismatch",
128
+ "admission_hold_expired",
129
+ "admission_hold_checkout_item_conflict",
130
+ "admission_hold_checkout_conflict",
131
+ "admission_hold_quantity_mismatch",
132
+ "admission_hold_unbound",
133
+ "admission_hold_missing",
134
+ "admission_hold_checkout_item_missing",
135
+ "admission_hold_expiry_failed",
136
+ "admission_hold_expiry_requires_transaction",
137
+ "admission_hold_line_item_mismatch",
138
+ "admission_materialization_failed",
139
+ "variant_inactive",
140
+ "variant_product_mismatch",
141
+ "product_not_public",
98
142
  "market_not_found",
99
143
  "market_shipping_currency_unsupported",
100
144
  "missing_market_rate",
@@ -119,7 +163,11 @@ var COMMERCE_ERROR_CODES = [
119
163
  "discount_min_order_amount",
120
164
  "discount_currency_scope_required",
121
165
  "discount_allocation_method_unsupported",
122
- "currency_mismatch"
166
+ "currency_mismatch",
167
+ "customer_token_required",
168
+ "market_required",
169
+ "server_derived",
170
+ "internal_error"
123
171
  ];
124
172
  var COMMERCE_ERROR_CODE_SET = new Set(
125
173
  COMMERCE_ERROR_CODES
@@ -145,6 +193,12 @@ function commerceProtocolError(issue, trustedRequestId) {
145
193
  );
146
194
  }
147
195
  function parseCommerceErrorEnvelope(body, headerRequestId) {
196
+ if (headerRequestId === void 0) {
197
+ throw commerceProtocolError("missing_request_id_header");
198
+ }
199
+ if (headerRequestId.length === 0) {
200
+ throw commerceProtocolError("empty_request_id_header");
201
+ }
148
202
  if (!isPlainRecord(body)) {
149
203
  throw commerceProtocolError("expected_object", headerRequestId);
150
204
  }
@@ -154,7 +208,7 @@ function parseCommerceErrorEnvelope(body, headerRequestId) {
154
208
  if (typeof body.error !== "string" || body.error.length === 0 || typeof body.reason !== "string" || body.reason.length === 0 || typeof body.requestId !== "string" || body.requestId.length === 0 || body.retryable !== void 0 && typeof body.retryable !== "boolean" || body.details !== void 0 && !isPlainRecord(body.details)) {
155
209
  throw commerceProtocolError("invalid_field", headerRequestId);
156
210
  }
157
- if (headerRequestId && headerRequestId !== body.requestId) {
211
+ if (headerRequestId !== void 0 && headerRequestId !== body.requestId) {
158
212
  throw commerceProtocolError("request_id_mismatch", headerRequestId);
159
213
  }
160
214
  return {
@@ -1131,7 +1185,10 @@ async function parseApiResponse(response, endpoint2, options = {}) {
1131
1185
  return parsed;
1132
1186
  }
1133
1187
  const data = parsed;
1134
- if (data.error) {
1188
+ const hasCommerceEnvelopeSignal = options.errorFamily === "commerce" && ["error", "reason", "requestId", "retryable", "details"].some(
1189
+ (key) => Object.prototype.hasOwnProperty.call(data, key)
1190
+ );
1191
+ if (data.error || hasCommerceEnvelopeSignal) {
1135
1192
  const errorMessage = typeof data.error === "string" ? data.error : "Unknown API error";
1136
1193
  const reason = typeof data.reason === "string" ? data.reason : void 0;
1137
1194
  const requestId = response.headers.get("x-request-id") ?? void 0;
@@ -1167,12 +1224,14 @@ async function parseApiResponse(response, endpoint2, options = {}) {
1167
1224
 
1168
1225
  // ../../internal/http-contracts/src/index.ts
1169
1226
  var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
1170
- var operation = (collection, method, path) => Object.freeze({
1227
+ var operation = (collection, method, path, errorFamily) => Object.freeze({
1171
1228
  [operationBrand]: true,
1172
1229
  collection,
1173
1230
  method,
1174
- path
1231
+ path,
1232
+ ...errorFamily && { errorFamily }
1175
1233
  });
1234
+ var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
1176
1235
  var COMMERCE_ENDPOINT_OPERATIONS = {
1177
1236
  products: {
1178
1237
  detail: operation("products", "get", "/detail"),
@@ -1205,13 +1264,13 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
1205
1264
  byPayment: operation("orders", "get", "/by-payment"),
1206
1265
  cancel: operation("orders", "post", "/cancel"),
1207
1266
  resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
1208
- checkout: operation("orders", "post", "/checkout"),
1267
+ checkout: strictCommerceOperation("orders", "post", "/checkout"),
1209
1268
  createFulfillment: operation("orders", "post", "/create-fulfillment"),
1210
1269
  updateFulfillment: operation("orders", "post", "/update-fulfillment")
1211
1270
  },
1212
1271
  checkouts: {
1213
- detail: operation("checkouts", "post", "/detail"),
1214
- query: operation("checkouts", "post", "/query")
1272
+ detail: strictCommerceOperation("checkouts", "post", "/detail"),
1273
+ query: strictCommerceOperation("checkouts", "post", "/query")
1215
1274
  },
1216
1275
  transactions: {
1217
1276
  update: operation("transactions", "post", "/update")
@@ -1232,29 +1291,58 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
1232
1291
  bulkImport: operation("fulfillments", "post", "/bulk-import")
1233
1292
  },
1234
1293
  carts: {
1235
- create: operation("carts", "post", "/create"),
1236
- retrieve: operation("carts", "post", "/retrieve"),
1237
- mine: operation("carts", "post", "/mine"),
1238
- merge: operation("carts", "post", "/merge"),
1239
- addItem: operation("carts", "post", "/add-item"),
1240
- updateItem: operation("carts", "post", "/update-item"),
1241
- removeItem: operation("carts", "post", "/remove-item"),
1242
- updateDiscountCodes: operation("carts", "post", "/update-discount-codes"),
1243
- updateAttributes: operation("carts", "post", "/update-attributes"),
1244
- clear: operation("carts", "post", "/clear")
1294
+ create: strictCommerceOperation("carts", "post", "/create"),
1295
+ retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
1296
+ mine: strictCommerceOperation("carts", "post", "/mine"),
1297
+ merge: strictCommerceOperation("carts", "post", "/merge"),
1298
+ addItem: strictCommerceOperation("carts", "post", "/add-item"),
1299
+ updateItem: strictCommerceOperation("carts", "post", "/update-item"),
1300
+ removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
1301
+ updateDiscountCodes: strictCommerceOperation(
1302
+ "carts",
1303
+ "post",
1304
+ "/update-discount-codes"
1305
+ ),
1306
+ updateAttributes: strictCommerceOperation(
1307
+ "carts",
1308
+ "post",
1309
+ "/update-attributes"
1310
+ ),
1311
+ clear: strictCommerceOperation("carts", "post", "/clear")
1245
1312
  },
1246
1313
  paymentSessions: {
1247
- create: operation("payment-sessions", "post", "/create"),
1248
- retrieve: operation("payment-sessions", "post", "/retrieve"),
1249
- cancel: operation("payment-sessions", "post", "/cancel"),
1314
+ create: strictCommerceOperation("payment-sessions", "post", "/create"),
1315
+ retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
1316
+ cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
1250
1317
  server: {
1251
- create: operation("payment-sessions", "post", "/server/create"),
1252
- retrieve: operation("payment-sessions", "post", "/server/retrieve"),
1253
- cancel: operation("payment-sessions", "post", "/server/cancel"),
1254
- confirm: operation("payment-sessions", "post", "/server/confirm")
1318
+ create: strictCommerceOperation(
1319
+ "payment-sessions",
1320
+ "post",
1321
+ "/server/create"
1322
+ ),
1323
+ retrieve: strictCommerceOperation(
1324
+ "payment-sessions",
1325
+ "post",
1326
+ "/server/retrieve"
1327
+ ),
1328
+ cancel: strictCommerceOperation(
1329
+ "payment-sessions",
1330
+ "post",
1331
+ "/server/cancel"
1332
+ ),
1333
+ confirm: strictCommerceOperation(
1334
+ "payment-sessions",
1335
+ "post",
1336
+ "/server/confirm"
1337
+ )
1255
1338
  },
1256
1339
  custom: {
1257
1340
  create: operation("orders", "post", "/custom-payment-sessions"),
1341
+ retrieve: operation(
1342
+ "orders",
1343
+ "post",
1344
+ "/custom-payment-sessions/retrieve"
1345
+ ),
1258
1346
  confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
1259
1347
  }
1260
1348
  },
@@ -1280,6 +1368,11 @@ var EVENTS_ENDPOINT_OPERATIONS = {
1280
1368
  )
1281
1369
  }
1282
1370
  };
1371
+ var COMMUNITY_ENDPOINT_OPERATIONS = {
1372
+ posts: {
1373
+ detail: operation("posts", "get", "/detail")
1374
+ }
1375
+ };
1283
1376
  function resolveOperationTemplate(descriptor) {
1284
1377
  return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
1285
1378
  }
@@ -1311,6 +1404,9 @@ var sharedEndpoint = (descriptor) => descriptor;
1311
1404
  function resolveOperationMethod2(descriptor) {
1312
1405
  return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
1313
1406
  }
1407
+ function resolveOperationErrorFamily(descriptor) {
1408
+ return "collection" in descriptor ? descriptor.errorFamily : void 0;
1409
+ }
1314
1410
  function resolveOperationPath2(descriptor, options) {
1315
1411
  if ("collection" in descriptor) {
1316
1412
  return resolveOperationPath(descriptor, options);
@@ -1345,12 +1441,12 @@ var COMMERCE_ENDPOINTS = {
1345
1441
  updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
1346
1442
  },
1347
1443
  checkouts: {
1348
- create: endpoint("POST", "/api/orders/checkout"),
1349
- retrieve: endpoint("POST", "/api/checkouts/detail"),
1444
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
1445
+ retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
1350
1446
  server: {
1351
- create: endpoint("POST", "/api/orders/checkout"),
1352
- retrieve: endpoint("POST", "/api/checkouts/detail"),
1353
- query: endpoint("POST", "/api/checkouts/query")
1447
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
1448
+ retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
1449
+ query: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.query)
1354
1450
  }
1355
1451
  },
1356
1452
  returns: {
@@ -1368,10 +1464,10 @@ var COMMERCE_ENDPOINTS = {
1368
1464
  bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
1369
1465
  },
1370
1466
  carts: {
1371
- create: endpoint("POST", "/api/carts/create"),
1467
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
1372
1468
  retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.retrieve),
1373
- mine: endpoint("POST", "/api/carts/mine"),
1374
- merge: endpoint("POST", "/api/carts/merge"),
1469
+ mine: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.mine),
1470
+ merge: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.merge),
1375
1471
  server: {
1376
1472
  // Server credentials are an authorization lane, not a second Cart
1377
1473
  // transport. These must stay bound to the registered shared operations.
@@ -1391,29 +1487,46 @@ var COMMERCE_ENDPOINTS = {
1391
1487
  clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
1392
1488
  },
1393
1489
  addItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.addItem),
1394
- updateItem: endpoint("POST", "/api/carts/update-item"),
1395
- removeItem: endpoint("POST", "/api/carts/remove-item"),
1396
- updateDiscountCodes: endpoint("POST", "/api/carts/update-discount-codes"),
1397
- updateAttributes: endpoint("POST", "/api/carts/update-attributes"),
1398
- clear: endpoint("POST", "/api/carts/clear")
1490
+ updateItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.updateItem),
1491
+ removeItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.removeItem),
1492
+ updateDiscountCodes: sharedEndpoint(
1493
+ COMMERCE_ENDPOINT_OPERATIONS.carts.updateDiscountCodes
1494
+ ),
1495
+ updateAttributes: sharedEndpoint(
1496
+ COMMERCE_ENDPOINT_OPERATIONS.carts.updateAttributes
1497
+ ),
1498
+ clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
1399
1499
  },
1400
1500
  paymentSessions: {
1401
- create: endpoint("POST", "/api/payment-sessions/create"),
1402
- retrieve: endpoint("POST", "/api/payment-sessions/retrieve"),
1403
- cancel: endpoint("POST", "/api/payment-sessions/cancel"),
1501
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create),
1502
+ retrieve: sharedEndpoint(
1503
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve
1504
+ ),
1505
+ cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.cancel),
1404
1506
  custom: {
1405
1507
  create: sharedEndpoint(
1406
1508
  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.create
1407
1509
  ),
1510
+ retrieve: sharedEndpoint(
1511
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.retrieve
1512
+ ),
1408
1513
  confirm: sharedEndpoint(
1409
1514
  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.confirm
1410
1515
  )
1411
1516
  },
1412
1517
  server: {
1413
- create: endpoint("POST", "/api/payment-sessions/server/create"),
1414
- retrieve: endpoint("POST", "/api/payment-sessions/server/retrieve"),
1415
- cancel: endpoint("POST", "/api/payment-sessions/server/cancel"),
1416
- confirm: endpoint("POST", "/api/payment-sessions/server/confirm")
1518
+ create: sharedEndpoint(
1519
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create
1520
+ ),
1521
+ retrieve: sharedEndpoint(
1522
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
1523
+ ),
1524
+ cancel: sharedEndpoint(
1525
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.cancel
1526
+ ),
1527
+ confirm: sharedEndpoint(
1528
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
1529
+ )
1417
1530
  }
1418
1531
  },
1419
1532
  shippingPolicies: {
@@ -1504,7 +1617,8 @@ var CustomerScopedApi = class {
1504
1617
  return this.transport.request(resolveOperationPath2(endpoint2, options), {
1505
1618
  method: resolveOperationMethod2(endpoint2),
1506
1619
  body,
1507
- headers: options?.headers
1620
+ headers: options?.headers,
1621
+ errorFamily: resolveOperationErrorFamily(endpoint2)
1508
1622
  });
1509
1623
  }
1510
1624
  };
@@ -1526,15 +1640,39 @@ function unwrapPayloadDoc(value) {
1526
1640
  }
1527
1641
  return value;
1528
1642
  }
1643
+ function hasCanonicalNotFoundReason(error) {
1644
+ const details = error.details;
1645
+ if (typeof details !== "object" || details === null) return false;
1646
+ if ("reason" in details && details.reason === "not_found") return true;
1647
+ if (!("body" in details) || typeof details.body !== "object" || details.body === null) {
1648
+ return false;
1649
+ }
1650
+ return "reason" in details.body && details.body.reason === "not_found";
1651
+ }
1529
1652
  var CommunityClient = class extends RawCustomerScopedApi {
1530
1653
  constructor(options) {
1531
1654
  super("CommunityClient", { ...options, requiresCredential: false });
1655
+ this.requiresSafePublicRawReads = !options.secretKey;
1532
1656
  }
1533
1657
  buildQuery(params) {
1534
1658
  if (!params) return "";
1535
1659
  const entries = Object.entries(params).filter((e) => e[1] !== void 0).map(([k, v]) => [k, String(v)]);
1536
1660
  return entries.length ? `?${new URLSearchParams(entries).toString()}` : "";
1537
1661
  }
1662
+ withSafePublicRawReadQuery(query) {
1663
+ if (!this.requiresSafePublicRawReads) return query;
1664
+ if (!query) return "?depth=0&joins=false";
1665
+ return `?depth=0&joins=false&${query.slice(1)}`;
1666
+ }
1667
+ buildSafePublicRawListQuery(params) {
1668
+ if (!this.requiresSafePublicRawReads) {
1669
+ return this.buildQuery(params);
1670
+ }
1671
+ const queryParams = {};
1672
+ if (params?.page !== void 0) queryParams.page = params.page;
1673
+ if (params?.limit !== void 0) queryParams.limit = params.limit;
1674
+ return this.withSafePublicRawReadQuery(this.buildQuery(queryParams));
1675
+ }
1538
1676
  buildPostsListQuery(params) {
1539
1677
  const urlParams = new URLSearchParams();
1540
1678
  const sort = params?.sort ?? DEFAULT_POST_LIST_SORT;
@@ -1594,15 +1732,35 @@ var CommunityClient = class extends RawCustomerScopedApi {
1594
1732
  "GET"
1595
1733
  );
1596
1734
  }
1735
+ /**
1736
+ * Public post detail projected by the same allowlist as the public feed.
1737
+ * Missing, hidden, and cross-tenant posts all resolve to `null`.
1738
+ */
1739
+ async getPost(params) {
1740
+ const query = new URLSearchParams({ postId: params.postId });
1741
+ try {
1742
+ return await this.execute(
1743
+ resolveOperationPath(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail, {
1744
+ query
1745
+ }),
1746
+ resolveOperationMethod(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail)
1747
+ );
1748
+ } catch (error) {
1749
+ if (error instanceof NotFoundError && hasCanonicalNotFoundReason(error)) {
1750
+ return null;
1751
+ }
1752
+ throw error;
1753
+ }
1754
+ }
1597
1755
  listPostCategories(params) {
1598
1756
  return this.execute(
1599
- `/api/post-categories${this.buildQuery(params)}`,
1757
+ `/api/post-categories${this.buildSafePublicRawListQuery(params)}`,
1600
1758
  "GET"
1601
1759
  );
1602
1760
  }
1603
1761
  listPostTags(params) {
1604
1762
  return this.execute(
1605
- `/api/post-tags${this.buildQuery(params)}`,
1763
+ `/api/post-tags${this.buildSafePublicRawListQuery(params)}`,
1606
1764
  "GET"
1607
1765
  );
1608
1766
  }
@@ -1768,7 +1926,7 @@ var CommunityClient = class extends RawCustomerScopedApi {
1768
1926
  }
1769
1927
  getReactionTypes() {
1770
1928
  return this.execute(
1771
- "/api/reaction-types?limit=100",
1929
+ `/api/reaction-types${this.buildSafePublicRawListQuery({ limit: 100 })}`,
1772
1930
  "GET"
1773
1931
  );
1774
1932
  }
@@ -1796,11 +1954,17 @@ var CommunityClient = class extends RawCustomerScopedApi {
1796
1954
  }
1797
1955
  // Profiles
1798
1956
  listProfileLists(params) {
1799
- return this.execute(`/api/customer-profile-lists${this.buildQuery(params)}`, "GET");
1957
+ return this.execute(
1958
+ `/api/customer-profile-lists${this.buildSafePublicRawListQuery(params)}`,
1959
+ "GET"
1960
+ );
1800
1961
  }
1801
1962
  async getProfileList(params) {
1802
1963
  const query = "slug" in params ? `?where[slug][equals]=${encodeURIComponent(params.slug)}&limit=1` : `?where[id][equals]=${encodeURIComponent(params.id)}&limit=1`;
1803
- const res = await this.execute(`/api/customer-profile-lists${query}`, "GET");
1964
+ const res = await this.execute(
1965
+ `/api/customer-profile-lists${this.withSafePublicRawReadQuery(query)}`,
1966
+ "GET"
1967
+ );
1804
1968
  return res.docs[0] ?? null;
1805
1969
  }
1806
1970
  updatePublicProfile(body) {
@@ -1913,7 +2077,7 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
1913
2077
  ];
1914
2078
  var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
1915
2079
  var ABANDONED_REASONS = ["expired", "customer", "operator"];
1916
- var PAYMENT_PROVIDERS = ["toss"];
2080
+ var PAYMENT_PROVIDERS = ["toss", "portone"];
1917
2081
  var PAYMENT_PROVIDER_STATUSES = [
1918
2082
  "requires_payment_method",
1919
2083
  "requires_action",
@@ -3086,8 +3250,33 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
3086
3250
  previous = current;
3087
3251
  });
3088
3252
  }
3089
- function validateNextAction(value, resource, path) {
3253
+ function validateNextAction(value, provider, resource, path) {
3090
3254
  const action = record(value, resource, path);
3255
+ if (provider === "portone") {
3256
+ exact(action, ["type", "checkoutUrl"], [], resource, path);
3257
+ if (action.type !== "portone_checkout") {
3258
+ fail(resource, `${path}.type`, "portone_checkout");
3259
+ }
3260
+ const checkoutUrl = boundedString(
3261
+ action.checkoutUrl,
3262
+ 2048,
3263
+ resource,
3264
+ `${path}.checkoutUrl`
3265
+ );
3266
+ try {
3267
+ const parsed = new URL(checkoutUrl);
3268
+ if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
3269
+ throw new Error("unsafe checkout URL");
3270
+ }
3271
+ } catch {
3272
+ fail(
3273
+ resource,
3274
+ `${path}.checkoutUrl`,
3275
+ "absolute HTTPS URL without embedded credentials"
3276
+ );
3277
+ }
3278
+ return;
3279
+ }
3091
3280
  exact(
3092
3281
  action,
3093
3282
  [
@@ -3138,10 +3327,18 @@ function validateNextAction(value, resource, path) {
3138
3327
  if (action.customerEmail !== void 0)
3139
3328
  validateCustomer({ email: action.customerEmail }, resource, path);
3140
3329
  }
3141
- function validatePublicPaymentSession(value) {
3330
+ function validatePublicPaymentSession(value, expectedProvider) {
3142
3331
  const resource = "PaymentSession";
3143
3332
  const session = record(value, resource, "$");
3144
- enumValue(session.provider, PAYMENT_PROVIDERS, resource, "$.provider");
3333
+ const provider = enumValue(
3334
+ session.provider,
3335
+ PAYMENT_PROVIDERS,
3336
+ resource,
3337
+ "$.provider"
3338
+ );
3339
+ if (expectedProvider !== void 0 && provider !== expectedProvider) {
3340
+ fail(resource, "$.provider", expectedProvider);
3341
+ }
3145
3342
  const status = enumValue(
3146
3343
  session.providerStatus,
3147
3344
  PAYMENT_PROVIDER_STATUSES,
@@ -3178,7 +3375,12 @@ function validatePublicPaymentSession(value) {
3178
3375
  }
3179
3376
  if (!("nextAction" in session))
3180
3377
  fail(resource, "$.nextAction", "required field");
3181
- validateNextAction(session.nextAction, resource, "$.nextAction");
3378
+ validateNextAction(
3379
+ session.nextAction,
3380
+ provider,
3381
+ resource,
3382
+ "$.nextAction"
3383
+ );
3182
3384
  } else if (session.sessionRole === "residual") {
3183
3385
  if (session.presentationStatus !== "suppressed" || session.finalizationStatus !== "not_ready") {
3184
3386
  fail(resource, "$", "suppressed residual not-ready state");
@@ -3917,8 +4119,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3917
4119
  }
3918
4120
  });
3919
4121
  }
3920
- async paymentSession(result) {
3921
- return validatePublicPaymentSession(await result);
4122
+ async paymentSession(result, expectedProvider) {
4123
+ return validatePublicPaymentSession(await result, expectedProvider);
3922
4124
  }
3923
4125
  create(params) {
3924
4126
  const { idempotencyKey, ...body } = params;
@@ -3928,18 +4130,53 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3928
4130
  this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
3929
4131
  body,
3930
4132
  idempotencyKey
3931
- )
4133
+ ),
4134
+ "toss"
4135
+ );
4136
+ }
4137
+ createPortOne(params) {
4138
+ const { idempotencyKey, ...body } = params;
4139
+ assertCommerceIdempotencyKey(idempotencyKey);
4140
+ return this.paymentSession(
4141
+ this.post(
4142
+ this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
4143
+ body,
4144
+ idempotencyKey
4145
+ ),
4146
+ "portone"
3932
4147
  );
3933
4148
  }
3934
4149
  retrieve(params) {
3935
4150
  const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
3936
- return this.paymentSession(this.post(endpoint2, params));
4151
+ return this.paymentSession(
4152
+ this.post(endpoint2, params),
4153
+ "toss"
4154
+ );
4155
+ }
4156
+ retrievePortOne(params) {
4157
+ const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
4158
+ return this.paymentSession(
4159
+ this.post(endpoint2, params),
4160
+ "portone"
4161
+ );
3937
4162
  }
3938
4163
  cancel(params) {
3939
4164
  const { idempotencyKey, ...body } = params;
3940
4165
  assertCommerceIdempotencyKey(idempotencyKey);
3941
4166
  const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
3942
- return this.paymentSession(this.post(endpoint2, body, idempotencyKey));
4167
+ return this.paymentSession(
4168
+ this.post(endpoint2, body, idempotencyKey),
4169
+ "toss"
4170
+ );
4171
+ }
4172
+ cancelPortOne(params) {
4173
+ const { idempotencyKey, ...body } = params;
4174
+ assertCommerceIdempotencyKey(idempotencyKey);
4175
+ const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
4176
+ return this.paymentSession(
4177
+ this.post(endpoint2, body, idempotencyKey),
4178
+ "portone"
4179
+ );
3943
4180
  }
3944
4181
  confirm(params) {
3945
4182
  const { idempotencyKey, ...body } = params;
@@ -3949,7 +4186,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3949
4186
  COMMERCE_ENDPOINTS.paymentSessions.server.confirm,
3950
4187
  body,
3951
4188
  idempotencyKey
3952
- )
4189
+ ),
4190
+ "toss"
3953
4191
  );
3954
4192
  }
3955
4193
  };
@@ -5203,8 +5441,11 @@ var CommerceClient = class {
5203
5441
  };
5204
5442
  this.paymentSessions = {
5205
5443
  create: paymentSessionApi.create.bind(paymentSessionApi),
5444
+ createPortOne: paymentSessionApi.createPortOne.bind(paymentSessionApi),
5206
5445
  retrieve: (params) => paymentSessionApi.retrieve(params),
5207
- cancel: (params) => paymentSessionApi.cancel(params)
5446
+ retrievePortOne: (params) => paymentSessionApi.retrievePortOne(params),
5447
+ cancel: (params) => paymentSessionApi.cancel(params),
5448
+ cancelPortOne: (params) => paymentSessionApi.cancelPortOne(params)
5208
5449
  };
5209
5450
  this.discounts = {
5210
5451
  validate: (params) => api.requestEndpoint(