@01.software/sdk 0.46.1 → 0.49.0

package/dist/index.js

@@ -2,6 +2,24 @@
 import { stringify } from "qs-esm";
 
 // src/core/errors.ts
+var SDK_ERROR_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError");
+var SDK_ERROR_TYPE_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError.type");
+function defineSDKErrorBrand(error) {
+  Object.defineProperty(error, SDK_ERROR_BRAND, {
+    value: true,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
+function defineSDKErrorType(error, type) {
+  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {
+    value: type,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
 var SDKError = class extends Error {
   constructor(code, message, status, details, userMessage, suggestion, requestId) {
     super(message);
@@ -12,6 +30,7 @@ var SDKError = class extends Error {
     this.userMessage = userMessage;
     this.suggestion = suggestion;
     this.requestId = requestId;
+    defineSDKErrorBrand(this);
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, new.target);
     }
@@ -32,6 +51,7 @@ var SDKError = class extends Error {
       ...this.kind !== void 0 && { kind: this.kind },
       ...this.reason !== void 0 && { reason: this.reason },
       ...this.rawReason !== void 0 && { rawReason: this.rawReason },
+      ...this.apiReason !== void 0 && { apiReason: this.apiReason },
       ...this.retryable !== void 0 && { retryable: this.retryable },
       ...this.retryAfter !== void 0 && { retryAfter: this.retryAfter }
     };
@@ -39,34 +59,78 @@ var SDKError = class extends Error {
 };
 var COMMERCE_ERROR_CODES = [
   "validation_failed",
+  "bad_request",
   "unauthorized",
   "forbidden",
+  "account_suspended",
+  "key_invalid",
+  "pat_tenant_header_forbidden",
+  "tenant_mismatch",
+  "test_tenant_expired",
+  "token_invalid",
   "token_expired",
   "origin_not_allowed",
   "server_credentials_required",
+  "role_denied",
+  "scope_denied",
+  "feature_disabled",
   "not_found",
   "conflict",
+  "locked",
   "cart_revision_conflict",
   "rate_limit_exceeded",
   "usage_limit_exceeded",
   "service_unavailable",
   "idempotency_conflict",
   "idempotency_in_progress",
+  "idempotency_key_required",
+  "invalid_idempotency_key",
   "cart_not_active",
   "cart_locked",
   "cart_empty",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
+  "checkout_already_open",
   "payment_slot_held",
   "reservation_expired",
   "payment_session_not_cancelable",
+  "payment_session_conflict",
   "provider_identity_mismatch",
+  "payment_method_unavailable",
   "provider_unavailable",
   "lock_timeout",
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "reservation_conflict",
+  "stock_lock_unavailable",
+  "variant_not_found",
+  "variant_stock_write_failed",
+  "stock_invariant_violation",
+  "payment_confirmation_in_flight",
+  "checkout_reservation_release_requires_transaction",
+  "admission_metadata_invalid",
+  "admission_metadata_required",
+  "capacity_exceeded",
+  "occurrence_lock_unavailable",
+  "occurrence_not_open",
+  "admission_type_capacity_exceeded",
+  "admission_type_occurrence_mismatch",
+  "admission_hold_expired",
+  "admission_hold_checkout_item_conflict",
+  "admission_hold_checkout_conflict",
+  "admission_hold_quantity_mismatch",
+  "admission_hold_unbound",
+  "admission_hold_missing",
+  "admission_hold_checkout_item_missing",
+  "admission_hold_expiry_failed",
+  "admission_hold_expiry_requires_transaction",
+  "admission_hold_line_item_mismatch",
+  "admission_materialization_failed",
+  "variant_inactive",
+  "variant_product_mismatch",
+  "product_not_public",
   "market_not_found",
   "market_shipping_currency_unsupported",
   "missing_market_rate",
@@ -91,7 +155,11 @@ var COMMERCE_ERROR_CODES = [
   "discount_min_order_amount",
   "discount_currency_scope_required",
   "discount_allocation_method_unsupported",
-  "currency_mismatch"
+  "currency_mismatch",
+  "customer_token_required",
+  "market_required",
+  "server_derived",
+  "internal_error"
 ];
 var COMMERCE_ERROR_CODE_SET = new Set(
   COMMERCE_ERROR_CODES
@@ -117,6 +185,12 @@ function commerceProtocolError(issue, trustedRequestId) {
   );
 }
 function parseCommerceErrorEnvelope(body, headerRequestId) {
+  if (headerRequestId === void 0) {
+    throw commerceProtocolError("missing_request_id_header");
+  }
+  if (headerRequestId.length === 0) {
+    throw commerceProtocolError("empty_request_id_header");
+  }
   if (!isPlainRecord(body)) {
     throw commerceProtocolError("expected_object", headerRequestId);
   }
@@ -126,7 +200,7 @@ function parseCommerceErrorEnvelope(body, headerRequestId) {
   if (typeof body.error !== "string" || body.error.length === 0 || typeof body.reason !== "string" || body.reason.length === 0 || typeof body.requestId !== "string" || body.requestId.length === 0 || body.retryable !== void 0 && typeof body.retryable !== "boolean" || body.details !== void 0 && !isPlainRecord(body.details)) {
     throw commerceProtocolError("invalid_field", headerRequestId);
   }
-  if (headerRequestId && headerRequestId !== body.requestId) {
+  if (headerRequestId !== void 0 && headerRequestId !== body.requestId) {
     throw commerceProtocolError("request_id_mismatch", headerRequestId);
   }
   return {
@@ -151,8 +225,16 @@ function enhanceCommerceError(error, body, headerRequestId) {
   });
   return error;
 }
+function enhanceNonCommerceError(error, reason) {
+  if (typeof reason === "string") Object.assign(error, { apiReason: reason });
+  return error;
+}
+function getSDKErrorReason(error) {
+  if (error.kind !== "commerce") return error.apiReason;
+  return error.reason === "unknown_commerce_error" ? error.rawReason : error.reason;
+}
 function isCommerceSDKError(error) {
-  if (!(error instanceof SDKError) || error.kind !== "commerce") return false;
+  if (!isSDKError(error) || error.kind !== "commerce") return false;
   if (typeof error.requestId !== "string" || typeof error.retryable !== "boolean" || error.retryAfter !== void 0 && (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0) || typeof error.reason !== "string") {
     return false;
   }
@@ -162,12 +244,14 @@ var NetworkError = class extends SDKError {
   constructor(message, status, details, userMessage, suggestion) {
     super("NETWORK_ERROR", message, status, details, userMessage, suggestion);
     this.name = "NetworkError";
+    defineSDKErrorType(this, "NetworkError");
   }
 };
 var ValidationError = class extends SDKError {
   constructor(message, details, userMessage, suggestion, status = 400) {
     super("VALIDATION_ERROR", message, status, details, userMessage, suggestion);
     this.name = "ValidationError";
+    defineSDKErrorType(this, "ValidationError");
   }
 };
 var ApiError = class extends SDKError {
@@ -182,24 +266,28 @@ var ApiError = class extends SDKError {
       requestId
     );
     this.name = "ApiError";
+    defineSDKErrorType(this, "ApiError");
   }
 };
 var ConfigError = class extends SDKError {
   constructor(message, details, userMessage, suggestion) {
     super("CONFIG_ERROR", message, void 0, details, userMessage, suggestion);
     this.name = "ConfigError";
+    defineSDKErrorType(this, "ConfigError");
   }
 };
 var TimeoutError = class extends SDKError {
   constructor(message = "Request timed out.", details, userMessage, suggestion) {
     super("TIMEOUT_ERROR", message, 408, details, userMessage, suggestion);
     this.name = "TimeoutError";
+    defineSDKErrorType(this, "TimeoutError");
   }
 };
 var GoneError = class extends SDKError {
   constructor(message = "The requested resource is no longer available.", details, userMessage, suggestion) {
     super("GONE_ERROR", message, 410, details, userMessage, suggestion);
     this.name = "GoneError";
+    defineSDKErrorType(this, "GoneError");
   }
 };
 var ServiceUnavailableError = class extends SDKError {
@@ -214,6 +302,7 @@ var ServiceUnavailableError = class extends SDKError {
     );
     this.name = "ServiceUnavailableError";
     this.retryAfter = retryAfter;
+    defineSDKErrorType(this, "ServiceUnavailableError");
   }
 };
 var UsageLimitError = class extends SDKError {
@@ -221,6 +310,7 @@ var UsageLimitError = class extends SDKError {
     super("USAGE_LIMIT_ERROR", message, 429, details, userMessage, suggestion);
     this.name = "UsageLimitError";
     this.usage = usage;
+    defineSDKErrorType(this, "UsageLimitError");
   }
   toJSON() {
     return {
@@ -241,6 +331,7 @@ var AuthError = class extends SDKError {
       requestId
     );
     this.name = "AuthError";
+    defineSDKErrorType(this, "AuthError");
   }
 };
 var PermissionError = class extends SDKError {
@@ -255,6 +346,7 @@ var PermissionError = class extends SDKError {
       requestId
     );
     this.name = "PermissionError";
+    defineSDKErrorType(this, "PermissionError");
   }
 };
 var NotFoundError = class extends SDKError {
@@ -269,12 +361,14 @@ var NotFoundError = class extends SDKError {
       requestId
     );
     this.name = "NotFoundError";
+    defineSDKErrorType(this, "NotFoundError");
   }
 };
 var ConflictError = class extends SDKError {
   constructor(message, details, userMessage, suggestion, requestId) {
     super("conflict", message, 409, details, userMessage, suggestion, requestId);
     this.name = "ConflictError";
+    defineSDKErrorType(this, "ConflictError");
   }
 };
 var RateLimitError = class extends SDKError {
@@ -290,52 +384,63 @@ var RateLimitError = class extends SDKError {
     );
     this.name = "RateLimitError";
     this.retryAfter = retryAfter;
+    defineSDKErrorType(this, "RateLimitError");
   }
 };
+function hasBrandedSDKErrorShape(error) {
+  if (error === null || typeof error !== "object") return false;
+  const candidate = error;
+  return candidate[SDK_ERROR_BRAND] === true && typeof candidate.name === "string" && typeof candidate.code === "string" && typeof candidate.message === "string" && (candidate.status === void 0 || typeof candidate.status === "number") && (candidate.userMessage === void 0 || typeof candidate.userMessage === "string") && (candidate.suggestion === void 0 || typeof candidate.suggestion === "string") && (candidate.requestId === void 0 || typeof candidate.requestId === "string") && (candidate.kind === void 0 || candidate.kind === "commerce") && (candidate.reason === void 0 || typeof candidate.reason === "string") && (candidate.rawReason === void 0 || typeof candidate.rawReason === "string") && (candidate.apiReason === void 0 || typeof candidate.apiReason === "string") && (candidate.retryable === void 0 || typeof candidate.retryable === "boolean") && (candidate.retryAfter === void 0 || typeof candidate.retryAfter === "number") && typeof candidate.getUserMessage === "function" && typeof candidate.toJSON === "function";
+}
+function hasSDKErrorType(error, type) {
+  return hasBrandedSDKErrorShape(error) && error[SDK_ERROR_TYPE_BRAND] === type;
+}
 function isSDKError(error) {
-  return error instanceof SDKError;
+  return error instanceof SDKError || hasBrandedSDKErrorShape(error);
 }
 function isNetworkError(error) {
-  return error instanceof NetworkError;
+  return error instanceof NetworkError || hasSDKErrorType(error, "NetworkError");
 }
 function isValidationError(error) {
-  if (error instanceof ValidationError) return true;
+  if (error instanceof ValidationError || hasSDKErrorType(error, "ValidationError")) {
+    return true;
+  }
   if (error == null || typeof error !== "object") return false;
   const candidate = error;
   return candidate.name === "ValidationError" && candidate.code === "VALIDATION_ERROR" && typeof candidate.message === "string" && typeof candidate.getUserMessage === "function" && typeof candidate.toJSON === "function";
 }
 function isApiError(error) {
-  return error instanceof ApiError;
+  return error instanceof ApiError || hasSDKErrorType(error, "ApiError");
 }
 function isConfigError(error) {
-  return error instanceof ConfigError;
+  return error instanceof ConfigError || hasSDKErrorType(error, "ConfigError");
 }
 function isTimeoutError(error) {
-  return error instanceof TimeoutError;
+  return error instanceof TimeoutError || hasSDKErrorType(error, "TimeoutError");
 }
 function isGoneError(error) {
-  return error instanceof GoneError;
+  return error instanceof GoneError || hasSDKErrorType(error, "GoneError");
 }
 function isServiceUnavailableError(error) {
-  return error instanceof ServiceUnavailableError;
+  return error instanceof ServiceUnavailableError || hasSDKErrorType(error, "ServiceUnavailableError");
 }
 function isUsageLimitError(error) {
-  return error instanceof UsageLimitError;
+  return error instanceof UsageLimitError || hasSDKErrorType(error, "UsageLimitError");
 }
 function isAuthError(error) {
-  return error instanceof AuthError;
+  return error instanceof AuthError || hasSDKErrorType(error, "AuthError");
 }
 function isPermissionError(error) {
-  return error instanceof PermissionError;
+  return error instanceof PermissionError || hasSDKErrorType(error, "PermissionError");
 }
 function isNotFoundError(error) {
-  return error instanceof NotFoundError;
+  return error instanceof NotFoundError || hasSDKErrorType(error, "NotFoundError");
 }
 function isConflictError(error) {
-  return error instanceof ConflictError;
+  return error instanceof ConflictError || hasSDKErrorType(error, "ConflictError");
 }
 function isRateLimitError(error) {
-  return error instanceof RateLimitError;
+  return error instanceof RateLimitError || hasSDKErrorType(error, "RateLimitError");
 }
 var createNetworkError = (message, status, details, userMessage, suggestion) => new NetworkError(message, status, details, userMessage, suggestion);
 var createValidationError = (message, details, userMessage, suggestion, status) => new ValidationError(message, details, userMessage, suggestion, status);
@@ -546,7 +651,7 @@ function mapResponseToError(status, parsed, details, requestId, retryAfter, erro
     if (retryAfter !== void 0) {
       Object.assign(withRequestId, { retryAfter });
     }
-    return errorFamily === "commerce" ? enhanceCommerceError(withRequestId, parsed.body, requestId) : withRequestId;
+    return errorFamily === "commerce" ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(withRequestId, parsed.reason);
   };
   if (status === 400 || status === 422) {
     return finalize(
@@ -733,7 +838,7 @@ async function httpFetch(url, options) {
             ),
             requestId
           );
-          throw errorFamily === "commerce" ? enhanceCommerceError(usageError, parsed.body, requestId) : usageError;
+          throw errorFamily === "commerce" ? enhanceCommerceError(usageError, parsed.body, requestId) : enhanceNonCommerceError(usageError, parsed.reason);
         }
         if (response.status === 401 && onUnauthorized && customerToken && !hasRetried401 && (commerceEnvelope?.reason ?? parsed.reason) === "token_expired") {
           hasRetried401 = true;
@@ -1155,7 +1260,10 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     return parsed;
   }
   const data = parsed;
-  if (data.error) {
+  const hasCommerceEnvelopeSignal = options.errorFamily === "commerce" && ["error", "reason", "requestId", "retryable", "details"].some(
+    (key) => Object.prototype.hasOwnProperty.call(data, key)
+  );
+  if (data.error || hasCommerceEnvelopeSignal) {
     const errorMessage = typeof data.error === "string" ? data.error : "Unknown API error";
     const reason = typeof data.reason === "string" ? data.reason : void 0;
     const requestId = response.headers.get("x-request-id") ?? void 0;
@@ -1184,19 +1292,21 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     }
     const withRequestId = attachRequestId(error, requestId);
     if (retryAfter !== void 0) Object.assign(withRequestId, { retryAfter });
-    throw options.errorFamily === "commerce" ? enhanceCommerceError(withRequestId, data, requestId) : withRequestId;
+    throw options.errorFamily === "commerce" ? enhanceCommerceError(withRequestId, data, requestId) : enhanceNonCommerceError(withRequestId, reason);
   }
   return data;
 }
 
 // ../../internal/http-contracts/src/index.ts
 var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
-var operation = (collection, method, path) => Object.freeze({
+var operation = (collection, method, path, errorFamily) => Object.freeze({
   [operationBrand]: true,
   collection,
   method,
-  path
+  path,
+  ...errorFamily && { errorFamily }
 });
+var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
 var COMMERCE_ENDPOINT_OPERATIONS = {
   products: {
     detail: operation("products", "get", "/detail"),
@@ -1229,13 +1339,13 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     byPayment: operation("orders", "get", "/by-payment"),
     cancel: operation("orders", "post", "/cancel"),
     resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
-    checkout: operation("orders", "post", "/checkout"),
+    checkout: strictCommerceOperation("orders", "post", "/checkout"),
     createFulfillment: operation("orders", "post", "/create-fulfillment"),
     updateFulfillment: operation("orders", "post", "/update-fulfillment")
   },
   checkouts: {
-    detail: operation("checkouts", "post", "/detail"),
-    query: operation("checkouts", "post", "/query")
+    detail: strictCommerceOperation("checkouts", "post", "/detail"),
+    query: strictCommerceOperation("checkouts", "post", "/query")
   },
   transactions: {
     update: operation("transactions", "post", "/update")
@@ -1256,29 +1366,58 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     bulkImport: operation("fulfillments", "post", "/bulk-import")
   },
   carts: {
-    create: operation("carts", "post", "/create"),
-    retrieve: operation("carts", "post", "/retrieve"),
-    mine: operation("carts", "post", "/mine"),
-    merge: operation("carts", "post", "/merge"),
-    addItem: operation("carts", "post", "/add-item"),
-    updateItem: operation("carts", "post", "/update-item"),
-    removeItem: operation("carts", "post", "/remove-item"),
-    updateDiscountCodes: operation("carts", "post", "/update-discount-codes"),
-    updateAttributes: operation("carts", "post", "/update-attributes"),
-    clear: operation("carts", "post", "/clear")
+    create: strictCommerceOperation("carts", "post", "/create"),
+    retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
+    mine: strictCommerceOperation("carts", "post", "/mine"),
+    merge: strictCommerceOperation("carts", "post", "/merge"),
+    addItem: strictCommerceOperation("carts", "post", "/add-item"),
+    updateItem: strictCommerceOperation("carts", "post", "/update-item"),
+    removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
+    updateDiscountCodes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-discount-codes"
+    ),
+    updateAttributes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-attributes"
+    ),
+    clear: strictCommerceOperation("carts", "post", "/clear")
   },
   paymentSessions: {
-    create: operation("payment-sessions", "post", "/create"),
-    retrieve: operation("payment-sessions", "post", "/retrieve"),
-    cancel: operation("payment-sessions", "post", "/cancel"),
+    create: strictCommerceOperation("payment-sessions", "post", "/create"),
+    retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
+    cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
     server: {
-      create: operation("payment-sessions", "post", "/server/create"),
-      retrieve: operation("payment-sessions", "post", "/server/retrieve"),
-      cancel: operation("payment-sessions", "post", "/server/cancel"),
-      confirm: operation("payment-sessions", "post", "/server/confirm")
+      create: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/create"
+      ),
+      retrieve: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/retrieve"
+      ),
+      cancel: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/cancel"
+      ),
+      confirm: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/confirm"
+      )
     },
     custom: {
       create: operation("orders", "post", "/custom-payment-sessions"),
+      retrieve: operation(
+        "orders",
+        "post",
+        "/custom-payment-sessions/retrieve"
+      ),
       confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
     }
   },
@@ -1304,6 +1443,11 @@ var EVENTS_ENDPOINT_OPERATIONS = {
     )
   }
 };
+var COMMUNITY_ENDPOINT_OPERATIONS = {
+  posts: {
+    detail: operation("posts", "get", "/detail")
+  }
+};
 function resolveOperationTemplate(descriptor) {
   return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
 }
@@ -1335,6 +1479,9 @@ var sharedEndpoint = (descriptor) => descriptor;
 function resolveOperationMethod2(descriptor) {
   return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
 }
+function resolveOperationErrorFamily(descriptor) {
+  return "collection" in descriptor ? descriptor.errorFamily : void 0;
+}
 function resolveOperationPath2(descriptor, options) {
   if ("collection" in descriptor) {
     return resolveOperationPath(descriptor, options);
@@ -1369,12 +1516,12 @@ var COMMERCE_ENDPOINTS = {
     updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
   },
   checkouts: {
-    create: endpoint("POST", "/api/orders/checkout"),
-    retrieve: endpoint("POST", "/api/checkouts/detail"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+    retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
     server: {
-      create: endpoint("POST", "/api/orders/checkout"),
-      retrieve: endpoint("POST", "/api/checkouts/detail"),
-      query: endpoint("POST", "/api/checkouts/query")
+      create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+      retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
+      query: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.query)
     }
   },
   returns: {
@@ -1392,10 +1539,10 @@ var COMMERCE_ENDPOINTS = {
     bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
   },
   carts: {
-    create: endpoint("POST", "/api/carts/create"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
     retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.retrieve),
-    mine: endpoint("POST", "/api/carts/mine"),
-    merge: endpoint("POST", "/api/carts/merge"),
+    mine: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.mine),
+    merge: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.merge),
     server: {
       // Server credentials are an authorization lane, not a second Cart
       // transport. These must stay bound to the registered shared operations.
@@ -1415,29 +1562,46 @@ var COMMERCE_ENDPOINTS = {
       clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
     },
     addItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.addItem),
-    updateItem: endpoint("POST", "/api/carts/update-item"),
-    removeItem: endpoint("POST", "/api/carts/remove-item"),
-    updateDiscountCodes: endpoint("POST", "/api/carts/update-discount-codes"),
-    updateAttributes: endpoint("POST", "/api/carts/update-attributes"),
-    clear: endpoint("POST", "/api/carts/clear")
+    updateItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.updateItem),
+    removeItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.removeItem),
+    updateDiscountCodes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateDiscountCodes
+    ),
+    updateAttributes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateAttributes
+    ),
+    clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
   },
   paymentSessions: {
-    create: endpoint("POST", "/api/payment-sessions/create"),
-    retrieve: endpoint("POST", "/api/payment-sessions/retrieve"),
-    cancel: endpoint("POST", "/api/payment-sessions/cancel"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create),
+    retrieve: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve
+    ),
+    cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.cancel),
     custom: {
       create: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.create
       ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.retrieve
+      ),
       confirm: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.confirm
       )
     },
     server: {
-      create: endpoint("POST", "/api/payment-sessions/server/create"),
-      retrieve: endpoint("POST", "/api/payment-sessions/server/retrieve"),
-      cancel: endpoint("POST", "/api/payment-sessions/server/cancel"),
-      confirm: endpoint("POST", "/api/payment-sessions/server/confirm")
+      create: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create
+      ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
+      ),
+      cancel: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.cancel
+      ),
+      confirm: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
+      )
     }
   },
   shippingPolicies: {
@@ -1528,7 +1692,8 @@ var CustomerScopedApi = class {
     return this.transport.request(resolveOperationPath2(endpoint2, options), {
       method: resolveOperationMethod2(endpoint2),
       body,
-      headers: options?.headers
+      headers: options?.headers,
+      errorFamily: resolveOperationErrorFamily(endpoint2)
     });
   }
 };
@@ -1550,15 +1715,33 @@ function unwrapPayloadDoc(value) {
   }
   return value;
 }
+function hasCanonicalNotFoundReason(error) {
+  return getSDKErrorReason(error) === "not_found";
+}
 var CommunityClient = class extends RawCustomerScopedApi {
   constructor(options) {
     super("CommunityClient", { ...options, requiresCredential: false });
+    this.requiresSafePublicRawReads = !options.secretKey;
   }
   buildQuery(params) {
     if (!params) return "";
     const entries = Object.entries(params).filter((e) => e[1] !== void 0).map(([k, v]) => [k, String(v)]);
     return entries.length ? `?${new URLSearchParams(entries).toString()}` : "";
   }
+  withSafePublicRawReadQuery(query) {
+    if (!this.requiresSafePublicRawReads) return query;
+    if (!query) return "?depth=0&joins=false";
+    return `?depth=0&joins=false&${query.slice(1)}`;
+  }
+  buildSafePublicRawListQuery(params) {
+    if (!this.requiresSafePublicRawReads) {
+      return this.buildQuery(params);
+    }
+    const queryParams = {};
+    if (params?.page !== void 0) queryParams.page = params.page;
+    if (params?.limit !== void 0) queryParams.limit = params.limit;
+    return this.withSafePublicRawReadQuery(this.buildQuery(queryParams));
+  }
   buildPostsListQuery(params) {
     const urlParams = new URLSearchParams();
     const sort = params?.sort ?? DEFAULT_POST_LIST_SORT;
@@ -1618,15 +1801,35 @@ var CommunityClient = class extends RawCustomerScopedApi {
       "GET"
     );
   }
+  /**
+   * Public post detail projected by the same allowlist as the public feed.
+   * Missing, hidden, and cross-tenant posts all resolve to `null`.
+   */
+  async getPost(params) {
+    const query = new URLSearchParams({ postId: params.postId });
+    try {
+      return await this.execute(
+        resolveOperationPath(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail, {
+          query
+        }),
+        resolveOperationMethod(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail)
+      );
+    } catch (error) {
+      if (error instanceof NotFoundError && hasCanonicalNotFoundReason(error)) {
+        return null;
+      }
+      throw error;
+    }
+  }
   listPostCategories(params) {
     return this.execute(
-      `/api/post-categories${this.buildQuery(params)}`,
+      `/api/post-categories${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
   listPostTags(params) {
     return this.execute(
-      `/api/post-tags${this.buildQuery(params)}`,
+      `/api/post-tags${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
@@ -1792,7 +1995,7 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   getReactionTypes() {
     return this.execute(
-      "/api/reaction-types?limit=100",
+      `/api/reaction-types${this.buildSafePublicRawListQuery({ limit: 100 })}`,
       "GET"
     );
   }
@@ -1820,11 +2023,17 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   // Profiles
   listProfileLists(params) {
-    return this.execute(`/api/customer-profile-lists${this.buildQuery(params)}`, "GET");
+    return this.execute(
+      `/api/customer-profile-lists${this.buildSafePublicRawListQuery(params)}`,
+      "GET"
+    );
   }
   async getProfileList(params) {
     const query = "slug" in params ? `?where[slug][equals]=${encodeURIComponent(params.slug)}&limit=1` : `?where[id][equals]=${encodeURIComponent(params.id)}&limit=1`;
-    const res = await this.execute(`/api/customer-profile-lists${query}`, "GET");
+    const res = await this.execute(
+      `/api/customer-profile-lists${this.withSafePublicRawReadQuery(query)}`,
+      "GET"
+    );
     return res.docs[0] ?? null;
   }
   updatePublicProfile(body) {
@@ -1937,7 +2146,7 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
 ];
 var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
 var ABANDONED_REASONS = ["expired", "customer", "operator"];
-var PAYMENT_PROVIDERS = ["toss"];
+var PAYMENT_PROVIDERS = ["toss", "portone"];
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -3110,8 +3319,101 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
     previous = current;
   });
 }
-function validateNextAction(value, resource, path) {
+function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "portone") {
+    if (action.type === "portone_sdk") {
+      exact(
+        action,
+        [
+          "type",
+          "version",
+          "storeId",
+          "channelKey",
+          "paymentId",
+          "orderName",
+          "totalAmount",
+          "currency",
+          "payMethod",
+          "redirectUrl"
+        ],
+        [],
+        resource,
+        path
+      );
+      if (action.version !== "v2") fail(resource, `${path}.version`, "v2");
+      for (const key of ["storeId", "channelKey"]) {
+        boundedString(action[key], 255, resource, `${path}.${key}`);
+      }
+      const paymentId = boundedString(
+        action.paymentId,
+        40,
+        resource,
+        `${path}.paymentId`
+      );
+      if (!/^[A-Za-z0-9]{6,40}$/.test(paymentId)) {
+        fail(
+          resource,
+          `${path}.paymentId`,
+          "6-40 ASCII alphanumeric characters"
+        );
+      }
+      boundedString(
+        action.orderName,
+        MAX_COMMERCE_SHORT_TEXT_LENGTH,
+        resource,
+        `${path}.orderName`
+      );
+      positiveInteger(action.totalAmount, resource, `${path}.totalAmount`);
+      if (action.currency !== "CURRENCY_KRW") {
+        fail(resource, `${path}.currency`, "CURRENCY_KRW");
+      }
+      if (action.payMethod !== "CARD")
+        fail(resource, `${path}.payMethod`, "CARD");
+      const redirectUrl = boundedString(
+        action.redirectUrl,
+        2048,
+        resource,
+        `${path}.redirectUrl`
+      );
+      try {
+        const parsed = new URL(redirectUrl);
+        const loopback = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+        if (!loopback && parsed.protocol !== "https:" || parsed.username || parsed.password)
+          throw new Error("unsafe redirect URL");
+      } catch {
+        fail(
+          resource,
+          `${path}.redirectUrl`,
+          "HTTPS or loopback URL without embedded credentials"
+        );
+      }
+      return;
+    }
+    exact(action, ["type", "checkoutUrl"], [], resource, path);
+    if (action.type !== "portone_checkout") {
+      fail(resource, `${path}.type`, "portone_checkout | portone_sdk");
+    }
+    const checkoutUrl = boundedString(
+      action.checkoutUrl,
+      2048,
+      resource,
+      `${path}.checkoutUrl`
+    );
+    try {
+      const parsed = new URL(checkoutUrl);
+      if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
+        throw new Error("unsafe checkout URL");
+      }
+    } catch {
+      fail(
+        resource,
+        `${path}.checkoutUrl`,
+        "absolute HTTPS URL without embedded credentials"
+      );
+    }
+    return;
+  }
   exact(
     action,
     [
@@ -3162,10 +3464,18 @@ function validateNextAction(value, resource, path) {
   if (action.customerEmail !== void 0)
     validateCustomer({ email: action.customerEmail }, resource, path);
 }
-function validatePublicPaymentSession(value) {
+function validatePublicPaymentSession(value, expectedProvider) {
   const resource = "PaymentSession";
   const session = record(value, resource, "$");
-  enumValue(session.provider, PAYMENT_PROVIDERS, resource, "$.provider");
+  const provider = enumValue(
+    session.provider,
+    PAYMENT_PROVIDERS,
+    resource,
+    "$.provider"
+  );
+  if (expectedProvider !== void 0 && provider !== expectedProvider) {
+    fail(resource, "$.provider", expectedProvider);
+  }
   const status = enumValue(
     session.providerStatus,
     PAYMENT_PROVIDER_STATUSES,
@@ -3202,7 +3512,12 @@ function validatePublicPaymentSession(value) {
       }
       if (!("nextAction" in session))
         fail(resource, "$.nextAction", "required field");
-      validateNextAction(session.nextAction, resource, "$.nextAction");
+      validateNextAction(
+        session.nextAction,
+        provider,
+        resource,
+        "$.nextAction"
+      );
     } else if (session.sessionRole === "residual") {
       if (session.presentationStatus !== "suppressed" || session.finalizationStatus !== "not_ready") {
         fail(resource, "$", "suppressed residual not-ready state");
@@ -3945,8 +4260,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
       }
     });
   }
-  async paymentSession(result) {
-    return validatePublicPaymentSession(await result);
+  async paymentSession(result, expectedProvider) {
+    return validatePublicPaymentSession(await result, expectedProvider);
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
@@ -3956,18 +4271,53 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
+    );
+  }
+  createPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    return this.paymentSession(
+      this.post(
+        this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
+        body,
+        idempotencyKey
+      ),
+      "portone"
     );
   }
   retrieve(params) {
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
-    return this.paymentSession(this.post(endpoint2, params));
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "toss"
+    );
+  }
+  retrievePortOne(params) {
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "portone"
+    );
   }
   cancel(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
-    return this.paymentSession(this.post(endpoint2, body, idempotencyKey));
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "toss"
+    );
+  }
+  cancelPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "portone"
+    );
   }
   confirm(params) {
     const { idempotencyKey, ...body } = params;
@@ -3977,7 +4327,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         COMMERCE_ENDPOINTS.paymentSessions.server.confirm,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
     );
   }
 };
@@ -5716,21 +6067,11 @@ var PRODUCT_DETAIL_UNAVAILABLE_REASONS = /* @__PURE__ */ new Set([
   "not_published",
   "feature_disabled"
 ]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function readProductDetailUnavailableReason(value) {
-  if (!isRecord(value)) return void 0;
-  const directReason = value.reason ?? value.code;
-  if (typeof directReason === "string" && PRODUCT_DETAIL_UNAVAILABLE_REASONS.has(directReason)) {
-    return directReason;
-  }
-  return readProductDetailUnavailableReason(value.body);
-}
 function productDetailResultFromError(error) {
   if (!(error instanceof SDKError) || error.status !== 404) return void 0;
-  const reason = readProductDetailUnavailableReason(error.details);
-  if (!reason) return void 0;
+  const reason = getSDKErrorReason(error);
+  if (!reason || !PRODUCT_DETAIL_UNAVAILABLE_REASONS.has(reason))
+    return void 0;
   return { found: false, reason };
 }
 var MARKET_PRICE_QUERY_UNSUPPORTED_MESSAGE = "Market listing pages do not support base price filters or price sorts.";
@@ -5947,8 +6288,11 @@ var CommerceClient = class {
     };
     this.paymentSessions = {
       create: paymentSessionApi.create.bind(paymentSessionApi),
+      createPortOne: paymentSessionApi.createPortOne.bind(paymentSessionApi),
       retrieve: (params) => paymentSessionApi.retrieve(params),
-      cancel: (params) => paymentSessionApi.cancel(params)
+      retrievePortOne: (params) => paymentSessionApi.retrievePortOne(params),
+      cancel: (params) => paymentSessionApi.cancel(params),
+      cancelPortOne: (params) => paymentSessionApi.cancelPortOne(params)
     };
     this.discounts = {
       validate: (params) => api.requestEndpoint(
@@ -6324,7 +6668,7 @@ function isStringOrNumber(value) {
   return typeof value === "string" || typeof value === "number";
 }
 function isWebhookOrderScope(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord(value)) return false;
   if (value.kind === "collection") {
     return typeof value.collection === "string";
   }
@@ -6334,14 +6678,14 @@ function isWebhookOrderScope(value) {
   return false;
 }
 function isWebhookOrderMoved(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord(value)) return false;
   return typeof value.collection === "string" && isStringOrNumber(value.id) && (value.relatedCollection === void 0 || typeof value.relatedCollection === "string") && (value.relatedId === void 0 || isStringOrNumber(value.relatedId));
 }
 function hasOptionalOrderValue(value, key) {
   return value[key] === void 0 || value[key] === null || typeof value[key] === "string";
 }
 function isWebhookOrderChange(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord(value)) return false;
   return value.type === "order" && value.source === "payload-orderable" && (value.orderableFieldName === void 0 || typeof value.orderableFieldName === "string") && hasOptionalOrderValue(value, "previousOrder") && hasOptionalOrderValue(value, "nextOrder") && isWebhookOrderScope(value.scope) && isWebhookOrderMoved(value.moved);
 }
 function isCommerceNotificationEventName(value) {
@@ -6351,18 +6695,18 @@ function isCommerceNotificationSourceCollection(value) {
   return value === "orders" || value === "fulfillments" || value === "returns";
 }
 function isCommerceNotificationData(value) {
-  if (!isRecord2(value)) return false;
-  if (value.source !== void 0 && (!isRecord2(value.source) || !isCommerceNotificationSourceCollection(value.source.collection) || !isStringOrNumber(value.source.id))) {
+  if (!isRecord(value)) return false;
+  if (value.source !== void 0 && (!isRecord(value.source) || !isCommerceNotificationSourceCollection(value.source.collection) || !isStringOrNumber(value.source.id))) {
     return false;
   }
   return (value.orderId === void 0 || isStringOrNumber(value.orderId)) && (value.orderNumber === void 0 || typeof value.orderNumber === "string") && (value.status === void 0 || typeof value.status === "string") && (value.totalAmount === void 0 || typeof value.totalAmount === "number") && (value.currency === void 0 || typeof value.currency === "string") && (value.fulfillmentId === void 0 || isStringOrNumber(value.fulfillmentId)) && (value.fulfillmentStatus === void 0 || typeof value.fulfillmentStatus === "string") && (value.shippedAt === void 0 || typeof value.shippedAt === "string") && (value.returnId === void 0 || isStringOrNumber(value.returnId)) && (value.returnStatus === void 0 || typeof value.returnStatus === "string") && (value.refundAmount === void 0 || typeof value.refundAmount === "number") && (value.completedAt === void 0 || typeof value.completedAt === "string");
 }
 function isCommerceNotification(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord(value)) return false;
   return isCommerceNotificationEventName(value.event) && typeof value.intentId === "string" && value.intentId.length > 0 && typeof value.dedupeKey === "string" && value.dedupeKey.length > 0 && (value.orderId === void 0 || typeof value.orderId === "string") && (value.fulfillmentId === void 0 || typeof value.fulfillmentId === "string") && (value.returnId === void 0 || typeof value.returnId === "string");
 }
 function isWebhookCommerceNotificationChange(value) {
-  if (!isRecord2(value)) return false;
+  if (!isRecord(value)) return false;
   return value.type === "notification" && value.source === "commerce-notifications" && isCommerceNotificationEventName(value.event) && isCommerceNotificationSourceCollection(value.sourceCollection) && isStringOrNumber(value.sourceId);
 }
 function matchesOptionalId(actual, expected) {
@@ -6444,7 +6788,7 @@ function isWebhookOperation(event, operation2) {
   return isValidWebhookEvent(event) && event.operation === operation2;
 }
 var CUSTOMER_PASSWORD_RESET_OPERATION = "password-reset";
-function isRecord2(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
 function hasString(value, key) {
@@ -6454,7 +6798,7 @@ function hasStringOrNumber(value, key) {
   return typeof value[key] === "string" || typeof value[key] === "number";
 }
 function isCustomerPasswordResetWebhookEvent(event) {
-  if (event.collection !== "customers" || event.operation !== CUSTOMER_PASSWORD_RESET_OPERATION || !isRecord2(event.data)) {
+  if (event.collection !== "customers" || event.operation !== CUSTOMER_PASSWORD_RESET_OPERATION || !isRecord(event.data)) {
     return false;
   }
   return hasStringOrNumber(event.data, "customerId") && hasString(event.data, "email") && hasString(event.data, "name") && hasString(event.data, "resetPasswordToken") && hasString(event.data, "resetPasswordExpiresAt");
@@ -6609,7 +6953,6 @@ var INTERNAL_COLLECTIONS = [
   "payment-provider-customer-aliases"
 ];
 var COLLECTIONS = [
-  "tenants",
   "tenant-metadata",
   "products",
   "product-variants",
@@ -6669,6 +7012,10 @@ var COLLECTIONS = [
   "customer-memberships"
 ];
 var SERVER_ONLY_COLLECTIONS = [
+  // The tenant record itself denies reads without an authenticated user, so a
+  // publishable key never reaches it; `tenant-metadata` is the browser-public
+  // tenant identity surface.
+  "tenants",
   "tenant-logos",
   "brand-logos",
   "images",
@@ -7404,6 +7751,7 @@ export {
   getImageSrcSet,
   getImageUrl,
   getProductSelectionImages,
+  getSDKErrorReason,
   getSelectedValueByOptionId,
   getVariantAvailableForSale,
   getVariantAvailableStock,