@01.software/sdk 0.46.0 → 0.48.0

package/dist/index.cjs

@@ -184,34 +184,78 @@ var SDKError = class extends Error {
 };
 var COMMERCE_ERROR_CODES = [
   "validation_failed",
+  "bad_request",
   "unauthorized",
   "forbidden",
+  "account_suspended",
+  "key_invalid",
+  "pat_tenant_header_forbidden",
+  "tenant_mismatch",
+  "test_tenant_expired",
+  "token_invalid",
   "token_expired",
   "origin_not_allowed",
   "server_credentials_required",
+  "role_denied",
+  "scope_denied",
+  "feature_disabled",
   "not_found",
   "conflict",
+  "locked",
   "cart_revision_conflict",
   "rate_limit_exceeded",
   "usage_limit_exceeded",
   "service_unavailable",
   "idempotency_conflict",
   "idempotency_in_progress",
+  "idempotency_key_required",
+  "invalid_idempotency_key",
   "cart_not_active",
   "cart_locked",
   "cart_empty",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
+  "checkout_already_open",
   "payment_slot_held",
   "reservation_expired",
   "payment_session_not_cancelable",
+  "payment_session_conflict",
   "provider_identity_mismatch",
+  "payment_method_unavailable",
   "provider_unavailable",
   "lock_timeout",
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "reservation_conflict",
+  "stock_lock_unavailable",
+  "variant_not_found",
+  "variant_stock_write_failed",
+  "stock_invariant_violation",
+  "payment_confirmation_in_flight",
+  "checkout_reservation_release_requires_transaction",
+  "admission_metadata_invalid",
+  "admission_metadata_required",
+  "capacity_exceeded",
+  "occurrence_lock_unavailable",
+  "occurrence_not_open",
+  "admission_type_capacity_exceeded",
+  "admission_type_occurrence_mismatch",
+  "admission_hold_expired",
+  "admission_hold_checkout_item_conflict",
+  "admission_hold_checkout_conflict",
+  "admission_hold_quantity_mismatch",
+  "admission_hold_unbound",
+  "admission_hold_missing",
+  "admission_hold_checkout_item_missing",
+  "admission_hold_expiry_failed",
+  "admission_hold_expiry_requires_transaction",
+  "admission_hold_line_item_mismatch",
+  "admission_materialization_failed",
+  "variant_inactive",
+  "variant_product_mismatch",
+  "product_not_public",
   "market_not_found",
   "market_shipping_currency_unsupported",
   "missing_market_rate",
@@ -236,7 +280,11 @@ var COMMERCE_ERROR_CODES = [
   "discount_min_order_amount",
   "discount_currency_scope_required",
   "discount_allocation_method_unsupported",
-  "currency_mismatch"
+  "currency_mismatch",
+  "customer_token_required",
+  "market_required",
+  "server_derived",
+  "internal_error"
 ];
 var COMMERCE_ERROR_CODE_SET = new Set(
   COMMERCE_ERROR_CODES
@@ -262,6 +310,12 @@ function commerceProtocolError(issue, trustedRequestId) {
   );
 }
 function parseCommerceErrorEnvelope(body, headerRequestId) {
+  if (headerRequestId === void 0) {
+    throw commerceProtocolError("missing_request_id_header");
+  }
+  if (headerRequestId.length === 0) {
+    throw commerceProtocolError("empty_request_id_header");
+  }
   if (!isPlainRecord(body)) {
     throw commerceProtocolError("expected_object", headerRequestId);
   }
@@ -271,7 +325,7 @@ function parseCommerceErrorEnvelope(body, headerRequestId) {
   if (typeof body.error !== "string" || body.error.length === 0 || typeof body.reason !== "string" || body.reason.length === 0 || typeof body.requestId !== "string" || body.requestId.length === 0 || body.retryable !== void 0 && typeof body.retryable !== "boolean" || body.details !== void 0 && !isPlainRecord(body.details)) {
     throw commerceProtocolError("invalid_field", headerRequestId);
   }
-  if (headerRequestId && headerRequestId !== body.requestId) {
+  if (headerRequestId !== void 0 && headerRequestId !== body.requestId) {
     throw commerceProtocolError("request_id_mismatch", headerRequestId);
   }
   return {
@@ -1300,7 +1354,10 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     return parsed;
   }
   const data = parsed;
-  if (data.error) {
+  const hasCommerceEnvelopeSignal = options.errorFamily === "commerce" && ["error", "reason", "requestId", "retryable", "details"].some(
+    (key) => Object.prototype.hasOwnProperty.call(data, key)
+  );
+  if (data.error || hasCommerceEnvelopeSignal) {
     const errorMessage = typeof data.error === "string" ? data.error : "Unknown API error";
     const reason = typeof data.reason === "string" ? data.reason : void 0;
     const requestId = response.headers.get("x-request-id") ?? void 0;
@@ -1336,12 +1393,14 @@ async function parseApiResponse(response, endpoint2, options = {}) {
 
 // ../../internal/http-contracts/src/index.ts
 var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
-var operation = (collection, method, path) => Object.freeze({
+var operation = (collection, method, path, errorFamily) => Object.freeze({
   [operationBrand]: true,
   collection,
   method,
-  path
+  path,
+  ...errorFamily && { errorFamily }
 });
+var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
 var COMMERCE_ENDPOINT_OPERATIONS = {
   products: {
     detail: operation("products", "get", "/detail"),
@@ -1374,13 +1433,13 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     byPayment: operation("orders", "get", "/by-payment"),
     cancel: operation("orders", "post", "/cancel"),
     resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
-    checkout: operation("orders", "post", "/checkout"),
+    checkout: strictCommerceOperation("orders", "post", "/checkout"),
     createFulfillment: operation("orders", "post", "/create-fulfillment"),
     updateFulfillment: operation("orders", "post", "/update-fulfillment")
   },
   checkouts: {
-    detail: operation("checkouts", "post", "/detail"),
-    query: operation("checkouts", "post", "/query")
+    detail: strictCommerceOperation("checkouts", "post", "/detail"),
+    query: strictCommerceOperation("checkouts", "post", "/query")
   },
   transactions: {
     update: operation("transactions", "post", "/update")
@@ -1401,29 +1460,58 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     bulkImport: operation("fulfillments", "post", "/bulk-import")
   },
   carts: {
-    create: operation("carts", "post", "/create"),
-    retrieve: operation("carts", "post", "/retrieve"),
-    mine: operation("carts", "post", "/mine"),
-    merge: operation("carts", "post", "/merge"),
-    addItem: operation("carts", "post", "/add-item"),
-    updateItem: operation("carts", "post", "/update-item"),
-    removeItem: operation("carts", "post", "/remove-item"),
-    updateDiscountCodes: operation("carts", "post", "/update-discount-codes"),
-    updateAttributes: operation("carts", "post", "/update-attributes"),
-    clear: operation("carts", "post", "/clear")
+    create: strictCommerceOperation("carts", "post", "/create"),
+    retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
+    mine: strictCommerceOperation("carts", "post", "/mine"),
+    merge: strictCommerceOperation("carts", "post", "/merge"),
+    addItem: strictCommerceOperation("carts", "post", "/add-item"),
+    updateItem: strictCommerceOperation("carts", "post", "/update-item"),
+    removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
+    updateDiscountCodes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-discount-codes"
+    ),
+    updateAttributes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-attributes"
+    ),
+    clear: strictCommerceOperation("carts", "post", "/clear")
   },
   paymentSessions: {
-    create: operation("payment-sessions", "post", "/create"),
-    retrieve: operation("payment-sessions", "post", "/retrieve"),
-    cancel: operation("payment-sessions", "post", "/cancel"),
+    create: strictCommerceOperation("payment-sessions", "post", "/create"),
+    retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
+    cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
     server: {
-      create: operation("payment-sessions", "post", "/server/create"),
-      retrieve: operation("payment-sessions", "post", "/server/retrieve"),
-      cancel: operation("payment-sessions", "post", "/server/cancel"),
-      confirm: operation("payment-sessions", "post", "/server/confirm")
+      create: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/create"
+      ),
+      retrieve: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/retrieve"
+      ),
+      cancel: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/cancel"
+      ),
+      confirm: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/confirm"
+      )
     },
     custom: {
       create: operation("orders", "post", "/custom-payment-sessions"),
+      retrieve: operation(
+        "orders",
+        "post",
+        "/custom-payment-sessions/retrieve"
+      ),
       confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
     }
   },
@@ -1449,6 +1537,11 @@ var EVENTS_ENDPOINT_OPERATIONS = {
     )
   }
 };
+var COMMUNITY_ENDPOINT_OPERATIONS = {
+  posts: {
+    detail: operation("posts", "get", "/detail")
+  }
+};
 function resolveOperationTemplate(descriptor) {
   return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
 }
@@ -1480,6 +1573,9 @@ var sharedEndpoint = (descriptor) => descriptor;
 function resolveOperationMethod2(descriptor) {
   return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
 }
+function resolveOperationErrorFamily(descriptor) {
+  return "collection" in descriptor ? descriptor.errorFamily : void 0;
+}
 function resolveOperationPath2(descriptor, options) {
   if ("collection" in descriptor) {
     return resolveOperationPath(descriptor, options);
@@ -1514,12 +1610,12 @@ var COMMERCE_ENDPOINTS = {
     updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
   },
   checkouts: {
-    create: endpoint("POST", "/api/orders/checkout"),
-    retrieve: endpoint("POST", "/api/checkouts/detail"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+    retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
     server: {
-      create: endpoint("POST", "/api/orders/checkout"),
-      retrieve: endpoint("POST", "/api/checkouts/detail"),
-      query: endpoint("POST", "/api/checkouts/query")
+      create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+      retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
+      query: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.query)
     }
   },
   returns: {
@@ -1537,10 +1633,10 @@ var COMMERCE_ENDPOINTS = {
     bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
   },
   carts: {
-    create: endpoint("POST", "/api/carts/create"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
     retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.retrieve),
-    mine: endpoint("POST", "/api/carts/mine"),
-    merge: endpoint("POST", "/api/carts/merge"),
+    mine: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.mine),
+    merge: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.merge),
     server: {
       // Server credentials are an authorization lane, not a second Cart
       // transport. These must stay bound to the registered shared operations.
@@ -1560,29 +1656,46 @@ var COMMERCE_ENDPOINTS = {
       clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
     },
     addItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.addItem),
-    updateItem: endpoint("POST", "/api/carts/update-item"),
-    removeItem: endpoint("POST", "/api/carts/remove-item"),
-    updateDiscountCodes: endpoint("POST", "/api/carts/update-discount-codes"),
-    updateAttributes: endpoint("POST", "/api/carts/update-attributes"),
-    clear: endpoint("POST", "/api/carts/clear")
+    updateItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.updateItem),
+    removeItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.removeItem),
+    updateDiscountCodes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateDiscountCodes
+    ),
+    updateAttributes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateAttributes
+    ),
+    clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
   },
   paymentSessions: {
-    create: endpoint("POST", "/api/payment-sessions/create"),
-    retrieve: endpoint("POST", "/api/payment-sessions/retrieve"),
-    cancel: endpoint("POST", "/api/payment-sessions/cancel"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create),
+    retrieve: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve
+    ),
+    cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.cancel),
     custom: {
       create: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.create
       ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.retrieve
+      ),
       confirm: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.confirm
       )
     },
     server: {
-      create: endpoint("POST", "/api/payment-sessions/server/create"),
-      retrieve: endpoint("POST", "/api/payment-sessions/server/retrieve"),
-      cancel: endpoint("POST", "/api/payment-sessions/server/cancel"),
-      confirm: endpoint("POST", "/api/payment-sessions/server/confirm")
+      create: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create
+      ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
+      ),
+      cancel: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.cancel
+      ),
+      confirm: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
+      )
     }
   },
   shippingPolicies: {
@@ -1673,7 +1786,8 @@ var CustomerScopedApi = class {
     return this.transport.request(resolveOperationPath2(endpoint2, options), {
       method: resolveOperationMethod2(endpoint2),
       body,
-      headers: options?.headers
+      headers: options?.headers,
+      errorFamily: resolveOperationErrorFamily(endpoint2)
     });
   }
 };
@@ -1695,15 +1809,39 @@ function unwrapPayloadDoc(value) {
   }
   return value;
 }
+function hasCanonicalNotFoundReason(error) {
+  const details = error.details;
+  if (typeof details !== "object" || details === null) return false;
+  if ("reason" in details && details.reason === "not_found") return true;
+  if (!("body" in details) || typeof details.body !== "object" || details.body === null) {
+    return false;
+  }
+  return "reason" in details.body && details.body.reason === "not_found";
+}
 var CommunityClient = class extends RawCustomerScopedApi {
   constructor(options) {
     super("CommunityClient", { ...options, requiresCredential: false });
+    this.requiresSafePublicRawReads = !options.secretKey;
   }
   buildQuery(params) {
     if (!params) return "";
     const entries = Object.entries(params).filter((e) => e[1] !== void 0).map(([k, v]) => [k, String(v)]);
     return entries.length ? `?${new URLSearchParams(entries).toString()}` : "";
   }
+  withSafePublicRawReadQuery(query) {
+    if (!this.requiresSafePublicRawReads) return query;
+    if (!query) return "?depth=0&joins=false";
+    return `?depth=0&joins=false&${query.slice(1)}`;
+  }
+  buildSafePublicRawListQuery(params) {
+    if (!this.requiresSafePublicRawReads) {
+      return this.buildQuery(params);
+    }
+    const queryParams = {};
+    if (params?.page !== void 0) queryParams.page = params.page;
+    if (params?.limit !== void 0) queryParams.limit = params.limit;
+    return this.withSafePublicRawReadQuery(this.buildQuery(queryParams));
+  }
   buildPostsListQuery(params) {
     const urlParams = new URLSearchParams();
     const sort = params?.sort ?? DEFAULT_POST_LIST_SORT;
@@ -1763,15 +1901,35 @@ var CommunityClient = class extends RawCustomerScopedApi {
       "GET"
     );
   }
+  /**
+   * Public post detail projected by the same allowlist as the public feed.
+   * Missing, hidden, and cross-tenant posts all resolve to `null`.
+   */
+  async getPost(params) {
+    const query = new URLSearchParams({ postId: params.postId });
+    try {
+      return await this.execute(
+        resolveOperationPath(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail, {
+          query
+        }),
+        resolveOperationMethod(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail)
+      );
+    } catch (error) {
+      if (error instanceof NotFoundError && hasCanonicalNotFoundReason(error)) {
+        return null;
+      }
+      throw error;
+    }
+  }
   listPostCategories(params) {
     return this.execute(
-      `/api/post-categories${this.buildQuery(params)}`,
+      `/api/post-categories${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
   listPostTags(params) {
     return this.execute(
-      `/api/post-tags${this.buildQuery(params)}`,
+      `/api/post-tags${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
@@ -1937,7 +2095,7 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   getReactionTypes() {
     return this.execute(
-      "/api/reaction-types?limit=100",
+      `/api/reaction-types${this.buildSafePublicRawListQuery({ limit: 100 })}`,
       "GET"
     );
   }
@@ -1965,11 +2123,17 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   // Profiles
   listProfileLists(params) {
-    return this.execute(`/api/customer-profile-lists${this.buildQuery(params)}`, "GET");
+    return this.execute(
+      `/api/customer-profile-lists${this.buildSafePublicRawListQuery(params)}`,
+      "GET"
+    );
   }
   async getProfileList(params) {
     const query = "slug" in params ? `?where[slug][equals]=${encodeURIComponent(params.slug)}&limit=1` : `?where[id][equals]=${encodeURIComponent(params.id)}&limit=1`;
-    const res = await this.execute(`/api/customer-profile-lists${query}`, "GET");
+    const res = await this.execute(
+      `/api/customer-profile-lists${this.withSafePublicRawReadQuery(query)}`,
+      "GET"
+    );
     return res.docs[0] ?? null;
   }
   updatePublicProfile(body) {
@@ -2082,7 +2246,7 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
 ];
 var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
 var ABANDONED_REASONS = ["expired", "customer", "operator"];
-var PAYMENT_PROVIDERS = ["toss"];
+var PAYMENT_PROVIDERS = ["toss", "portone"];
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -3255,8 +3419,33 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
     previous = current;
   });
 }
-function validateNextAction(value, resource, path) {
+function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "portone") {
+    exact(action, ["type", "checkoutUrl"], [], resource, path);
+    if (action.type !== "portone_checkout") {
+      fail(resource, `${path}.type`, "portone_checkout");
+    }
+    const checkoutUrl = boundedString(
+      action.checkoutUrl,
+      2048,
+      resource,
+      `${path}.checkoutUrl`
+    );
+    try {
+      const parsed = new URL(checkoutUrl);
+      if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
+        throw new Error("unsafe checkout URL");
+      }
+    } catch {
+      fail(
+        resource,
+        `${path}.checkoutUrl`,
+        "absolute HTTPS URL without embedded credentials"
+      );
+    }
+    return;
+  }
   exact(
     action,
     [
@@ -3307,10 +3496,18 @@ function validateNextAction(value, resource, path) {
   if (action.customerEmail !== void 0)
     validateCustomer({ email: action.customerEmail }, resource, path);
 }
-function validatePublicPaymentSession(value) {
+function validatePublicPaymentSession(value, expectedProvider) {
   const resource = "PaymentSession";
   const session = record(value, resource, "$");
-  enumValue(session.provider, PAYMENT_PROVIDERS, resource, "$.provider");
+  const provider = enumValue(
+    session.provider,
+    PAYMENT_PROVIDERS,
+    resource,
+    "$.provider"
+  );
+  if (expectedProvider !== void 0 && provider !== expectedProvider) {
+    fail(resource, "$.provider", expectedProvider);
+  }
   const status = enumValue(
     session.providerStatus,
     PAYMENT_PROVIDER_STATUSES,
@@ -3347,7 +3544,12 @@ function validatePublicPaymentSession(value) {
       }
       if (!("nextAction" in session))
         fail(resource, "$.nextAction", "required field");
-      validateNextAction(session.nextAction, resource, "$.nextAction");
+      validateNextAction(
+        session.nextAction,
+        provider,
+        resource,
+        "$.nextAction"
+      );
     } else if (session.sessionRole === "residual") {
       if (session.presentationStatus !== "suppressed" || session.finalizationStatus !== "not_ready") {
         fail(resource, "$", "suppressed residual not-ready state");
@@ -4090,8 +4292,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
       }
     });
   }
-  async paymentSession(result) {
-    return validatePublicPaymentSession(await result);
+  async paymentSession(result, expectedProvider) {
+    return validatePublicPaymentSession(await result, expectedProvider);
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
@@ -4101,18 +4303,53 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
+    );
+  }
+  createPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    return this.paymentSession(
+      this.post(
+        this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
+        body,
+        idempotencyKey
+      ),
+      "portone"
     );
   }
   retrieve(params) {
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
-    return this.paymentSession(this.post(endpoint2, params));
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "toss"
+    );
+  }
+  retrievePortOne(params) {
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "portone"
+    );
   }
   cancel(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
-    return this.paymentSession(this.post(endpoint2, body, idempotencyKey));
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "toss"
+    );
+  }
+  cancelPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "portone"
+    );
   }
   confirm(params) {
     const { idempotencyKey, ...body } = params;
@@ -4122,7 +4359,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         COMMERCE_ENDPOINTS.paymentSessions.server.confirm,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
     );
   }
 };
@@ -6092,8 +6330,11 @@ var CommerceClient = class {
     };
     this.paymentSessions = {
       create: paymentSessionApi.create.bind(paymentSessionApi),
+      createPortOne: paymentSessionApi.createPortOne.bind(paymentSessionApi),
       retrieve: (params) => paymentSessionApi.retrieve(params),
-      cancel: (params) => paymentSessionApi.cancel(params)
+      retrievePortOne: (params) => paymentSessionApi.retrievePortOne(params),
+      cancel: (params) => paymentSessionApi.cancel(params),
+      cancelPortOne: (params) => paymentSessionApi.cancelPortOne(params)
     };
     this.discounts = {
       validate: (params) => api.requestEndpoint(
@@ -6754,7 +6995,6 @@ var INTERNAL_COLLECTIONS = [
   "payment-provider-customer-aliases"
 ];
 var COLLECTIONS = [
-  "tenants",
   "tenant-metadata",
   "products",
   "product-variants",
@@ -6814,6 +7054,10 @@ var COLLECTIONS = [
   "customer-memberships"
 ];
 var SERVER_ONLY_COLLECTIONS = [
+  // The tenant record itself denies reads without an authenticated user, so a
+  // publishable key never reaches it; `tenant-metadata` is the browser-public
+  // tenant identity surface.
+  "tenants",
   "tenant-logos",
   "brand-logos",
   "images",