@01.software/sdk 0.46.0 → 0.48.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (57) hide show
  1. package/CHANGELOG.md +75 -1
  2. package/README.md +81 -7
  3. package/dist/client.cjs +304 -63
  4. package/dist/client.cjs.map +1 -1
  5. package/dist/client.d.cts +6 -6
  6. package/dist/client.d.ts +6 -6
  7. package/dist/client.js +304 -63
  8. package/dist/client.js.map +1 -1
  9. package/dist/{collection-client-DolMjCoC.d.cts → collection-client-CBup9yOx.d.cts} +4 -4
  10. package/dist/{collection-client-D6kKrYdq.d.ts → collection-client-D3ExJU-7.d.ts} +4 -4
  11. package/dist/{const-BAG0MH0u.d.cts → const-BXEi1Kix.d.cts} +4 -4
  12. package/dist/{const-CaPq2AE4.d.ts → const-k9gHylYa.d.ts} +4 -4
  13. package/dist/errors.cjs +49 -1
  14. package/dist/errors.cjs.map +1 -1
  15. package/dist/errors.d.cts +3 -3
  16. package/dist/errors.d.ts +3 -3
  17. package/dist/errors.js +49 -1
  18. package/dist/errors.js.map +1 -1
  19. package/dist/{index-YGrZrxNn.d.cts → index-BCM9CTL7.d.cts} +3 -3
  20. package/dist/{index-BNICJxBL.d.ts → index-CHGGkcLj.d.ts} +3 -3
  21. package/dist/index.cjs +308 -64
  22. package/dist/index.cjs.map +1 -1
  23. package/dist/index.d.cts +7 -7
  24. package/dist/index.d.ts +7 -7
  25. package/dist/index.js +308 -64
  26. package/dist/index.js.map +1 -1
  27. package/dist/{payload-types-CJZuXcgF.d.cts → payload-types-B6AZQcB7.d.cts} +182 -15
  28. package/dist/{payload-types-CJZuXcgF.d.ts → payload-types-B6AZQcB7.d.ts} +182 -15
  29. package/dist/query.cjs +144 -43
  30. package/dist/query.cjs.map +1 -1
  31. package/dist/query.d.cts +5 -5
  32. package/dist/query.d.ts +5 -5
  33. package/dist/query.js +144 -43
  34. package/dist/query.js.map +1 -1
  35. package/dist/realtime.d.cts +2 -2
  36. package/dist/realtime.d.ts +2 -2
  37. package/dist/server.cjs +385 -63
  38. package/dist/server.cjs.map +1 -1
  39. package/dist/server.d.cts +7 -7
  40. package/dist/server.d.ts +7 -7
  41. package/dist/server.js +385 -63
  42. package/dist/server.js.map +1 -1
  43. package/dist/storefront-cache.cjs +49 -1
  44. package/dist/storefront-cache.cjs.map +1 -1
  45. package/dist/storefront-cache.js +49 -1
  46. package/dist/storefront-cache.js.map +1 -1
  47. package/dist/{types-D5p7-m1l.d.cts → types-8us-_C-Q.d.cts} +2 -2
  48. package/dist/{types-BC6rVmJa.d.ts → types-ByD2zii1.d.ts} +2 -2
  49. package/dist/{types-xlqBeW2N.d.cts → types-CM2je9Kw.d.cts} +84 -7
  50. package/dist/{types-C60vHIkY.d.ts → types-DbA5V3mt.d.ts} +84 -7
  51. package/dist/ui/form.d.cts +1 -1
  52. package/dist/ui/form.d.ts +1 -1
  53. package/dist/ui/video.d.cts +1 -1
  54. package/dist/ui/video.d.ts +1 -1
  55. package/dist/webhook.d.cts +4 -4
  56. package/dist/webhook.d.ts +4 -4
  57. package/package.json +6 -6
package/dist/client.js CHANGED
@@ -39,34 +39,78 @@ var SDKError = class extends Error {
39
39
  };
40
40
  var COMMERCE_ERROR_CODES = [
41
41
  "validation_failed",
42
+ "bad_request",
42
43
  "unauthorized",
43
44
  "forbidden",
45
+ "account_suspended",
46
+ "key_invalid",
47
+ "pat_tenant_header_forbidden",
48
+ "tenant_mismatch",
49
+ "test_tenant_expired",
50
+ "token_invalid",
44
51
  "token_expired",
45
52
  "origin_not_allowed",
46
53
  "server_credentials_required",
54
+ "role_denied",
55
+ "scope_denied",
56
+ "feature_disabled",
47
57
  "not_found",
48
58
  "conflict",
59
+ "locked",
49
60
  "cart_revision_conflict",
50
61
  "rate_limit_exceeded",
51
62
  "usage_limit_exceeded",
52
63
  "service_unavailable",
53
64
  "idempotency_conflict",
54
65
  "idempotency_in_progress",
66
+ "idempotency_key_required",
67
+ "invalid_idempotency_key",
55
68
  "cart_not_active",
56
69
  "cart_locked",
57
70
  "cart_empty",
58
71
  "cart_market_unavailable",
59
72
  "cart_market_mismatch",
60
73
  "checkout_not_open",
74
+ "checkout_already_open",
61
75
  "payment_slot_held",
62
76
  "reservation_expired",
63
77
  "payment_session_not_cancelable",
78
+ "payment_session_conflict",
64
79
  "provider_identity_mismatch",
80
+ "payment_method_unavailable",
65
81
  "provider_unavailable",
66
82
  "lock_timeout",
67
83
  "price_changed",
68
84
  "pricing_fact_in_use",
69
85
  "insufficient_stock",
86
+ "reservation_conflict",
87
+ "stock_lock_unavailable",
88
+ "variant_not_found",
89
+ "variant_stock_write_failed",
90
+ "stock_invariant_violation",
91
+ "payment_confirmation_in_flight",
92
+ "checkout_reservation_release_requires_transaction",
93
+ "admission_metadata_invalid",
94
+ "admission_metadata_required",
95
+ "capacity_exceeded",
96
+ "occurrence_lock_unavailable",
97
+ "occurrence_not_open",
98
+ "admission_type_capacity_exceeded",
99
+ "admission_type_occurrence_mismatch",
100
+ "admission_hold_expired",
101
+ "admission_hold_checkout_item_conflict",
102
+ "admission_hold_checkout_conflict",
103
+ "admission_hold_quantity_mismatch",
104
+ "admission_hold_unbound",
105
+ "admission_hold_missing",
106
+ "admission_hold_checkout_item_missing",
107
+ "admission_hold_expiry_failed",
108
+ "admission_hold_expiry_requires_transaction",
109
+ "admission_hold_line_item_mismatch",
110
+ "admission_materialization_failed",
111
+ "variant_inactive",
112
+ "variant_product_mismatch",
113
+ "product_not_public",
70
114
  "market_not_found",
71
115
  "market_shipping_currency_unsupported",
72
116
  "missing_market_rate",
@@ -91,7 +135,11 @@ var COMMERCE_ERROR_CODES = [
91
135
  "discount_min_order_amount",
92
136
  "discount_currency_scope_required",
93
137
  "discount_allocation_method_unsupported",
94
- "currency_mismatch"
138
+ "currency_mismatch",
139
+ "customer_token_required",
140
+ "market_required",
141
+ "server_derived",
142
+ "internal_error"
95
143
  ];
96
144
  var COMMERCE_ERROR_CODE_SET = new Set(
97
145
  COMMERCE_ERROR_CODES
@@ -117,6 +165,12 @@ function commerceProtocolError(issue, trustedRequestId) {
117
165
  );
118
166
  }
119
167
  function parseCommerceErrorEnvelope(body, headerRequestId) {
168
+ if (headerRequestId === void 0) {
169
+ throw commerceProtocolError("missing_request_id_header");
170
+ }
171
+ if (headerRequestId.length === 0) {
172
+ throw commerceProtocolError("empty_request_id_header");
173
+ }
120
174
  if (!isPlainRecord(body)) {
121
175
  throw commerceProtocolError("expected_object", headerRequestId);
122
176
  }
@@ -126,7 +180,7 @@ function parseCommerceErrorEnvelope(body, headerRequestId) {
126
180
  if (typeof body.error !== "string" || body.error.length === 0 || typeof body.reason !== "string" || body.reason.length === 0 || typeof body.requestId !== "string" || body.requestId.length === 0 || body.retryable !== void 0 && typeof body.retryable !== "boolean" || body.details !== void 0 && !isPlainRecord(body.details)) {
127
181
  throw commerceProtocolError("invalid_field", headerRequestId);
128
182
  }
129
- if (headerRequestId && headerRequestId !== body.requestId) {
183
+ if (headerRequestId !== void 0 && headerRequestId !== body.requestId) {
130
184
  throw commerceProtocolError("request_id_mismatch", headerRequestId);
131
185
  }
132
186
  return {
@@ -1103,7 +1157,10 @@ async function parseApiResponse(response, endpoint2, options = {}) {
1103
1157
  return parsed;
1104
1158
  }
1105
1159
  const data = parsed;
1106
- if (data.error) {
1160
+ const hasCommerceEnvelopeSignal = options.errorFamily === "commerce" && ["error", "reason", "requestId", "retryable", "details"].some(
1161
+ (key) => Object.prototype.hasOwnProperty.call(data, key)
1162
+ );
1163
+ if (data.error || hasCommerceEnvelopeSignal) {
1107
1164
  const errorMessage = typeof data.error === "string" ? data.error : "Unknown API error";
1108
1165
  const reason = typeof data.reason === "string" ? data.reason : void 0;
1109
1166
  const requestId = response.headers.get("x-request-id") ?? void 0;
@@ -1139,12 +1196,14 @@ async function parseApiResponse(response, endpoint2, options = {}) {
1139
1196
 
1140
1197
  // ../../internal/http-contracts/src/index.ts
1141
1198
  var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
1142
- var operation = (collection, method, path) => Object.freeze({
1199
+ var operation = (collection, method, path, errorFamily) => Object.freeze({
1143
1200
  [operationBrand]: true,
1144
1201
  collection,
1145
1202
  method,
1146
- path
1203
+ path,
1204
+ ...errorFamily && { errorFamily }
1147
1205
  });
1206
+ var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
1148
1207
  var COMMERCE_ENDPOINT_OPERATIONS = {
1149
1208
  products: {
1150
1209
  detail: operation("products", "get", "/detail"),
@@ -1177,13 +1236,13 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
1177
1236
  byPayment: operation("orders", "get", "/by-payment"),
1178
1237
  cancel: operation("orders", "post", "/cancel"),
1179
1238
  resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
1180
- checkout: operation("orders", "post", "/checkout"),
1239
+ checkout: strictCommerceOperation("orders", "post", "/checkout"),
1181
1240
  createFulfillment: operation("orders", "post", "/create-fulfillment"),
1182
1241
  updateFulfillment: operation("orders", "post", "/update-fulfillment")
1183
1242
  },
1184
1243
  checkouts: {
1185
- detail: operation("checkouts", "post", "/detail"),
1186
- query: operation("checkouts", "post", "/query")
1244
+ detail: strictCommerceOperation("checkouts", "post", "/detail"),
1245
+ query: strictCommerceOperation("checkouts", "post", "/query")
1187
1246
  },
1188
1247
  transactions: {
1189
1248
  update: operation("transactions", "post", "/update")
@@ -1204,29 +1263,58 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
1204
1263
  bulkImport: operation("fulfillments", "post", "/bulk-import")
1205
1264
  },
1206
1265
  carts: {
1207
- create: operation("carts", "post", "/create"),
1208
- retrieve: operation("carts", "post", "/retrieve"),
1209
- mine: operation("carts", "post", "/mine"),
1210
- merge: operation("carts", "post", "/merge"),
1211
- addItem: operation("carts", "post", "/add-item"),
1212
- updateItem: operation("carts", "post", "/update-item"),
1213
- removeItem: operation("carts", "post", "/remove-item"),
1214
- updateDiscountCodes: operation("carts", "post", "/update-discount-codes"),
1215
- updateAttributes: operation("carts", "post", "/update-attributes"),
1216
- clear: operation("carts", "post", "/clear")
1266
+ create: strictCommerceOperation("carts", "post", "/create"),
1267
+ retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
1268
+ mine: strictCommerceOperation("carts", "post", "/mine"),
1269
+ merge: strictCommerceOperation("carts", "post", "/merge"),
1270
+ addItem: strictCommerceOperation("carts", "post", "/add-item"),
1271
+ updateItem: strictCommerceOperation("carts", "post", "/update-item"),
1272
+ removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
1273
+ updateDiscountCodes: strictCommerceOperation(
1274
+ "carts",
1275
+ "post",
1276
+ "/update-discount-codes"
1277
+ ),
1278
+ updateAttributes: strictCommerceOperation(
1279
+ "carts",
1280
+ "post",
1281
+ "/update-attributes"
1282
+ ),
1283
+ clear: strictCommerceOperation("carts", "post", "/clear")
1217
1284
  },
1218
1285
  paymentSessions: {
1219
- create: operation("payment-sessions", "post", "/create"),
1220
- retrieve: operation("payment-sessions", "post", "/retrieve"),
1221
- cancel: operation("payment-sessions", "post", "/cancel"),
1286
+ create: strictCommerceOperation("payment-sessions", "post", "/create"),
1287
+ retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
1288
+ cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
1222
1289
  server: {
1223
- create: operation("payment-sessions", "post", "/server/create"),
1224
- retrieve: operation("payment-sessions", "post", "/server/retrieve"),
1225
- cancel: operation("payment-sessions", "post", "/server/cancel"),
1226
- confirm: operation("payment-sessions", "post", "/server/confirm")
1290
+ create: strictCommerceOperation(
1291
+ "payment-sessions",
1292
+ "post",
1293
+ "/server/create"
1294
+ ),
1295
+ retrieve: strictCommerceOperation(
1296
+ "payment-sessions",
1297
+ "post",
1298
+ "/server/retrieve"
1299
+ ),
1300
+ cancel: strictCommerceOperation(
1301
+ "payment-sessions",
1302
+ "post",
1303
+ "/server/cancel"
1304
+ ),
1305
+ confirm: strictCommerceOperation(
1306
+ "payment-sessions",
1307
+ "post",
1308
+ "/server/confirm"
1309
+ )
1227
1310
  },
1228
1311
  custom: {
1229
1312
  create: operation("orders", "post", "/custom-payment-sessions"),
1313
+ retrieve: operation(
1314
+ "orders",
1315
+ "post",
1316
+ "/custom-payment-sessions/retrieve"
1317
+ ),
1230
1318
  confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
1231
1319
  }
1232
1320
  },
@@ -1252,6 +1340,11 @@ var EVENTS_ENDPOINT_OPERATIONS = {
1252
1340
  )
1253
1341
  }
1254
1342
  };
1343
+ var COMMUNITY_ENDPOINT_OPERATIONS = {
1344
+ posts: {
1345
+ detail: operation("posts", "get", "/detail")
1346
+ }
1347
+ };
1255
1348
  function resolveOperationTemplate(descriptor) {
1256
1349
  return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
1257
1350
  }
@@ -1283,6 +1376,9 @@ var sharedEndpoint = (descriptor) => descriptor;
1283
1376
  function resolveOperationMethod2(descriptor) {
1284
1377
  return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
1285
1378
  }
1379
+ function resolveOperationErrorFamily(descriptor) {
1380
+ return "collection" in descriptor ? descriptor.errorFamily : void 0;
1381
+ }
1286
1382
  function resolveOperationPath2(descriptor, options) {
1287
1383
  if ("collection" in descriptor) {
1288
1384
  return resolveOperationPath(descriptor, options);
@@ -1317,12 +1413,12 @@ var COMMERCE_ENDPOINTS = {
1317
1413
  updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
1318
1414
  },
1319
1415
  checkouts: {
1320
- create: endpoint("POST", "/api/orders/checkout"),
1321
- retrieve: endpoint("POST", "/api/checkouts/detail"),
1416
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
1417
+ retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
1322
1418
  server: {
1323
- create: endpoint("POST", "/api/orders/checkout"),
1324
- retrieve: endpoint("POST", "/api/checkouts/detail"),
1325
- query: endpoint("POST", "/api/checkouts/query")
1419
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
1420
+ retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
1421
+ query: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.query)
1326
1422
  }
1327
1423
  },
1328
1424
  returns: {
@@ -1340,10 +1436,10 @@ var COMMERCE_ENDPOINTS = {
1340
1436
  bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
1341
1437
  },
1342
1438
  carts: {
1343
- create: endpoint("POST", "/api/carts/create"),
1439
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
1344
1440
  retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.retrieve),
1345
- mine: endpoint("POST", "/api/carts/mine"),
1346
- merge: endpoint("POST", "/api/carts/merge"),
1441
+ mine: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.mine),
1442
+ merge: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.merge),
1347
1443
  server: {
1348
1444
  // Server credentials are an authorization lane, not a second Cart
1349
1445
  // transport. These must stay bound to the registered shared operations.
@@ -1363,29 +1459,46 @@ var COMMERCE_ENDPOINTS = {
1363
1459
  clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
1364
1460
  },
1365
1461
  addItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.addItem),
1366
- updateItem: endpoint("POST", "/api/carts/update-item"),
1367
- removeItem: endpoint("POST", "/api/carts/remove-item"),
1368
- updateDiscountCodes: endpoint("POST", "/api/carts/update-discount-codes"),
1369
- updateAttributes: endpoint("POST", "/api/carts/update-attributes"),
1370
- clear: endpoint("POST", "/api/carts/clear")
1462
+ updateItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.updateItem),
1463
+ removeItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.removeItem),
1464
+ updateDiscountCodes: sharedEndpoint(
1465
+ COMMERCE_ENDPOINT_OPERATIONS.carts.updateDiscountCodes
1466
+ ),
1467
+ updateAttributes: sharedEndpoint(
1468
+ COMMERCE_ENDPOINT_OPERATIONS.carts.updateAttributes
1469
+ ),
1470
+ clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
1371
1471
  },
1372
1472
  paymentSessions: {
1373
- create: endpoint("POST", "/api/payment-sessions/create"),
1374
- retrieve: endpoint("POST", "/api/payment-sessions/retrieve"),
1375
- cancel: endpoint("POST", "/api/payment-sessions/cancel"),
1473
+ create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create),
1474
+ retrieve: sharedEndpoint(
1475
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve
1476
+ ),
1477
+ cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.cancel),
1376
1478
  custom: {
1377
1479
  create: sharedEndpoint(
1378
1480
  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.create
1379
1481
  ),
1482
+ retrieve: sharedEndpoint(
1483
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.retrieve
1484
+ ),
1380
1485
  confirm: sharedEndpoint(
1381
1486
  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.confirm
1382
1487
  )
1383
1488
  },
1384
1489
  server: {
1385
- create: endpoint("POST", "/api/payment-sessions/server/create"),
1386
- retrieve: endpoint("POST", "/api/payment-sessions/server/retrieve"),
1387
- cancel: endpoint("POST", "/api/payment-sessions/server/cancel"),
1388
- confirm: endpoint("POST", "/api/payment-sessions/server/confirm")
1490
+ create: sharedEndpoint(
1491
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create
1492
+ ),
1493
+ retrieve: sharedEndpoint(
1494
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
1495
+ ),
1496
+ cancel: sharedEndpoint(
1497
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.cancel
1498
+ ),
1499
+ confirm: sharedEndpoint(
1500
+ COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
1501
+ )
1389
1502
  }
1390
1503
  },
1391
1504
  shippingPolicies: {
@@ -1476,7 +1589,8 @@ var CustomerScopedApi = class {
1476
1589
  return this.transport.request(resolveOperationPath2(endpoint2, options), {
1477
1590
  method: resolveOperationMethod2(endpoint2),
1478
1591
  body,
1479
- headers: options?.headers
1592
+ headers: options?.headers,
1593
+ errorFamily: resolveOperationErrorFamily(endpoint2)
1480
1594
  });
1481
1595
  }
1482
1596
  };
@@ -1498,15 +1612,39 @@ function unwrapPayloadDoc(value) {
1498
1612
  }
1499
1613
  return value;
1500
1614
  }
1615
+ function hasCanonicalNotFoundReason(error) {
1616
+ const details = error.details;
1617
+ if (typeof details !== "object" || details === null) return false;
1618
+ if ("reason" in details && details.reason === "not_found") return true;
1619
+ if (!("body" in details) || typeof details.body !== "object" || details.body === null) {
1620
+ return false;
1621
+ }
1622
+ return "reason" in details.body && details.body.reason === "not_found";
1623
+ }
1501
1624
  var CommunityClient = class extends RawCustomerScopedApi {
1502
1625
  constructor(options) {
1503
1626
  super("CommunityClient", { ...options, requiresCredential: false });
1627
+ this.requiresSafePublicRawReads = !options.secretKey;
1504
1628
  }
1505
1629
  buildQuery(params) {
1506
1630
  if (!params) return "";
1507
1631
  const entries = Object.entries(params).filter((e) => e[1] !== void 0).map(([k, v]) => [k, String(v)]);
1508
1632
  return entries.length ? `?${new URLSearchParams(entries).toString()}` : "";
1509
1633
  }
1634
+ withSafePublicRawReadQuery(query) {
1635
+ if (!this.requiresSafePublicRawReads) return query;
1636
+ if (!query) return "?depth=0&joins=false";
1637
+ return `?depth=0&joins=false&${query.slice(1)}`;
1638
+ }
1639
+ buildSafePublicRawListQuery(params) {
1640
+ if (!this.requiresSafePublicRawReads) {
1641
+ return this.buildQuery(params);
1642
+ }
1643
+ const queryParams = {};
1644
+ if (params?.page !== void 0) queryParams.page = params.page;
1645
+ if (params?.limit !== void 0) queryParams.limit = params.limit;
1646
+ return this.withSafePublicRawReadQuery(this.buildQuery(queryParams));
1647
+ }
1510
1648
  buildPostsListQuery(params) {
1511
1649
  const urlParams = new URLSearchParams();
1512
1650
  const sort = params?.sort ?? DEFAULT_POST_LIST_SORT;
@@ -1566,15 +1704,35 @@ var CommunityClient = class extends RawCustomerScopedApi {
1566
1704
  "GET"
1567
1705
  );
1568
1706
  }
1707
+ /**
1708
+ * Public post detail projected by the same allowlist as the public feed.
1709
+ * Missing, hidden, and cross-tenant posts all resolve to `null`.
1710
+ */
1711
+ async getPost(params) {
1712
+ const query = new URLSearchParams({ postId: params.postId });
1713
+ try {
1714
+ return await this.execute(
1715
+ resolveOperationPath(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail, {
1716
+ query
1717
+ }),
1718
+ resolveOperationMethod(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail)
1719
+ );
1720
+ } catch (error) {
1721
+ if (error instanceof NotFoundError && hasCanonicalNotFoundReason(error)) {
1722
+ return null;
1723
+ }
1724
+ throw error;
1725
+ }
1726
+ }
1569
1727
  listPostCategories(params) {
1570
1728
  return this.execute(
1571
- `/api/post-categories${this.buildQuery(params)}`,
1729
+ `/api/post-categories${this.buildSafePublicRawListQuery(params)}`,
1572
1730
  "GET"
1573
1731
  );
1574
1732
  }
1575
1733
  listPostTags(params) {
1576
1734
  return this.execute(
1577
- `/api/post-tags${this.buildQuery(params)}`,
1735
+ `/api/post-tags${this.buildSafePublicRawListQuery(params)}`,
1578
1736
  "GET"
1579
1737
  );
1580
1738
  }
@@ -1740,7 +1898,7 @@ var CommunityClient = class extends RawCustomerScopedApi {
1740
1898
  }
1741
1899
  getReactionTypes() {
1742
1900
  return this.execute(
1743
- "/api/reaction-types?limit=100",
1901
+ `/api/reaction-types${this.buildSafePublicRawListQuery({ limit: 100 })}`,
1744
1902
  "GET"
1745
1903
  );
1746
1904
  }
@@ -1768,11 +1926,17 @@ var CommunityClient = class extends RawCustomerScopedApi {
1768
1926
  }
1769
1927
  // Profiles
1770
1928
  listProfileLists(params) {
1771
- return this.execute(`/api/customer-profile-lists${this.buildQuery(params)}`, "GET");
1929
+ return this.execute(
1930
+ `/api/customer-profile-lists${this.buildSafePublicRawListQuery(params)}`,
1931
+ "GET"
1932
+ );
1772
1933
  }
1773
1934
  async getProfileList(params) {
1774
1935
  const query = "slug" in params ? `?where[slug][equals]=${encodeURIComponent(params.slug)}&limit=1` : `?where[id][equals]=${encodeURIComponent(params.id)}&limit=1`;
1775
- const res = await this.execute(`/api/customer-profile-lists${query}`, "GET");
1936
+ const res = await this.execute(
1937
+ `/api/customer-profile-lists${this.withSafePublicRawReadQuery(query)}`,
1938
+ "GET"
1939
+ );
1776
1940
  return res.docs[0] ?? null;
1777
1941
  }
1778
1942
  updatePublicProfile(body) {
@@ -1885,7 +2049,7 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
1885
2049
  ];
1886
2050
  var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
1887
2051
  var ABANDONED_REASONS = ["expired", "customer", "operator"];
1888
- var PAYMENT_PROVIDERS = ["toss"];
2052
+ var PAYMENT_PROVIDERS = ["toss", "portone"];
1889
2053
  var PAYMENT_PROVIDER_STATUSES = [
1890
2054
  "requires_payment_method",
1891
2055
  "requires_action",
@@ -3058,8 +3222,33 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
3058
3222
  previous = current;
3059
3223
  });
3060
3224
  }
3061
- function validateNextAction(value, resource, path) {
3225
+ function validateNextAction(value, provider, resource, path) {
3062
3226
  const action = record(value, resource, path);
3227
+ if (provider === "portone") {
3228
+ exact(action, ["type", "checkoutUrl"], [], resource, path);
3229
+ if (action.type !== "portone_checkout") {
3230
+ fail(resource, `${path}.type`, "portone_checkout");
3231
+ }
3232
+ const checkoutUrl = boundedString(
3233
+ action.checkoutUrl,
3234
+ 2048,
3235
+ resource,
3236
+ `${path}.checkoutUrl`
3237
+ );
3238
+ try {
3239
+ const parsed = new URL(checkoutUrl);
3240
+ if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
3241
+ throw new Error("unsafe checkout URL");
3242
+ }
3243
+ } catch {
3244
+ fail(
3245
+ resource,
3246
+ `${path}.checkoutUrl`,
3247
+ "absolute HTTPS URL without embedded credentials"
3248
+ );
3249
+ }
3250
+ return;
3251
+ }
3063
3252
  exact(
3064
3253
  action,
3065
3254
  [
@@ -3110,10 +3299,18 @@ function validateNextAction(value, resource, path) {
3110
3299
  if (action.customerEmail !== void 0)
3111
3300
  validateCustomer({ email: action.customerEmail }, resource, path);
3112
3301
  }
3113
- function validatePublicPaymentSession(value) {
3302
+ function validatePublicPaymentSession(value, expectedProvider) {
3114
3303
  const resource = "PaymentSession";
3115
3304
  const session = record(value, resource, "$");
3116
- enumValue(session.provider, PAYMENT_PROVIDERS, resource, "$.provider");
3305
+ const provider = enumValue(
3306
+ session.provider,
3307
+ PAYMENT_PROVIDERS,
3308
+ resource,
3309
+ "$.provider"
3310
+ );
3311
+ if (expectedProvider !== void 0 && provider !== expectedProvider) {
3312
+ fail(resource, "$.provider", expectedProvider);
3313
+ }
3117
3314
  const status = enumValue(
3118
3315
  session.providerStatus,
3119
3316
  PAYMENT_PROVIDER_STATUSES,
@@ -3150,7 +3347,12 @@ function validatePublicPaymentSession(value) {
3150
3347
  }
3151
3348
  if (!("nextAction" in session))
3152
3349
  fail(resource, "$.nextAction", "required field");
3153
- validateNextAction(session.nextAction, resource, "$.nextAction");
3350
+ validateNextAction(
3351
+ session.nextAction,
3352
+ provider,
3353
+ resource,
3354
+ "$.nextAction"
3355
+ );
3154
3356
  } else if (session.sessionRole === "residual") {
3155
3357
  if (session.presentationStatus !== "suppressed" || session.finalizationStatus !== "not_ready") {
3156
3358
  fail(resource, "$", "suppressed residual not-ready state");
@@ -3889,8 +4091,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3889
4091
  }
3890
4092
  });
3891
4093
  }
3892
- async paymentSession(result) {
3893
- return validatePublicPaymentSession(await result);
4094
+ async paymentSession(result, expectedProvider) {
4095
+ return validatePublicPaymentSession(await result, expectedProvider);
3894
4096
  }
3895
4097
  create(params) {
3896
4098
  const { idempotencyKey, ...body } = params;
@@ -3900,18 +4102,53 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3900
4102
  this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
3901
4103
  body,
3902
4104
  idempotencyKey
3903
- )
4105
+ ),
4106
+ "toss"
4107
+ );
4108
+ }
4109
+ createPortOne(params) {
4110
+ const { idempotencyKey, ...body } = params;
4111
+ assertCommerceIdempotencyKey(idempotencyKey);
4112
+ return this.paymentSession(
4113
+ this.post(
4114
+ this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
4115
+ body,
4116
+ idempotencyKey
4117
+ ),
4118
+ "portone"
3904
4119
  );
3905
4120
  }
3906
4121
  retrieve(params) {
3907
4122
  const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
3908
- return this.paymentSession(this.post(endpoint2, params));
4123
+ return this.paymentSession(
4124
+ this.post(endpoint2, params),
4125
+ "toss"
4126
+ );
4127
+ }
4128
+ retrievePortOne(params) {
4129
+ const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
4130
+ return this.paymentSession(
4131
+ this.post(endpoint2, params),
4132
+ "portone"
4133
+ );
3909
4134
  }
3910
4135
  cancel(params) {
3911
4136
  const { idempotencyKey, ...body } = params;
3912
4137
  assertCommerceIdempotencyKey(idempotencyKey);
3913
4138
  const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
3914
- return this.paymentSession(this.post(endpoint2, body, idempotencyKey));
4139
+ return this.paymentSession(
4140
+ this.post(endpoint2, body, idempotencyKey),
4141
+ "toss"
4142
+ );
4143
+ }
4144
+ cancelPortOne(params) {
4145
+ const { idempotencyKey, ...body } = params;
4146
+ assertCommerceIdempotencyKey(idempotencyKey);
4147
+ const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
4148
+ return this.paymentSession(
4149
+ this.post(endpoint2, body, idempotencyKey),
4150
+ "portone"
4151
+ );
3915
4152
  }
3916
4153
  confirm(params) {
3917
4154
  const { idempotencyKey, ...body } = params;
@@ -3921,7 +4158,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
3921
4158
  COMMERCE_ENDPOINTS.paymentSessions.server.confirm,
3922
4159
  body,
3923
4160
  idempotencyKey
3924
- )
4161
+ ),
4162
+ "toss"
3925
4163
  );
3926
4164
  }
3927
4165
  };
@@ -5175,8 +5413,11 @@ var CommerceClient = class {
5175
5413
  };
5176
5414
  this.paymentSessions = {
5177
5415
  create: paymentSessionApi.create.bind(paymentSessionApi),
5416
+ createPortOne: paymentSessionApi.createPortOne.bind(paymentSessionApi),
5178
5417
  retrieve: (params) => paymentSessionApi.retrieve(params),
5179
- cancel: (params) => paymentSessionApi.cancel(params)
5418
+ retrievePortOne: (params) => paymentSessionApi.retrievePortOne(params),
5419
+ cancel: (params) => paymentSessionApi.cancel(params),
5420
+ cancelPortOne: (params) => paymentSessionApi.cancelPortOne(params)
5180
5421
  };
5181
5422
  this.discounts = {
5182
5423
  validate: (params) => api.requestEndpoint(