@01.software/sdk 0.46.1 → 0.49.0

package/dist/server.js

@@ -2,6 +2,24 @@
 import { stringify } from "qs-esm";
 
 // src/core/errors.ts
+var SDK_ERROR_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError");
+var SDK_ERROR_TYPE_BRAND = /* @__PURE__ */ Symbol.for("@01.software/sdk/SDKError.type");
+function defineSDKErrorBrand(error) {
+  Object.defineProperty(error, SDK_ERROR_BRAND, {
+    value: true,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
+function defineSDKErrorType(error, type) {
+  Object.defineProperty(error, SDK_ERROR_TYPE_BRAND, {
+    value: type,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+}
 var SDKError = class extends Error {
   constructor(code, message, status, details, userMessage, suggestion, requestId) {
     super(message);
@@ -12,6 +30,7 @@ var SDKError = class extends Error {
     this.userMessage = userMessage;
     this.suggestion = suggestion;
     this.requestId = requestId;
+    defineSDKErrorBrand(this);
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, new.target);
     }
@@ -32,6 +51,7 @@ var SDKError = class extends Error {
       ...this.kind !== void 0 && { kind: this.kind },
       ...this.reason !== void 0 && { reason: this.reason },
       ...this.rawReason !== void 0 && { rawReason: this.rawReason },
+      ...this.apiReason !== void 0 && { apiReason: this.apiReason },
       ...this.retryable !== void 0 && { retryable: this.retryable },
       ...this.retryAfter !== void 0 && { retryAfter: this.retryAfter }
     };
@@ -39,34 +59,78 @@ var SDKError = class extends Error {
 };
 var COMMERCE_ERROR_CODES = [
   "validation_failed",
+  "bad_request",
   "unauthorized",
   "forbidden",
+  "account_suspended",
+  "key_invalid",
+  "pat_tenant_header_forbidden",
+  "tenant_mismatch",
+  "test_tenant_expired",
+  "token_invalid",
   "token_expired",
   "origin_not_allowed",
   "server_credentials_required",
+  "role_denied",
+  "scope_denied",
+  "feature_disabled",
   "not_found",
   "conflict",
+  "locked",
   "cart_revision_conflict",
   "rate_limit_exceeded",
   "usage_limit_exceeded",
   "service_unavailable",
   "idempotency_conflict",
   "idempotency_in_progress",
+  "idempotency_key_required",
+  "invalid_idempotency_key",
   "cart_not_active",
   "cart_locked",
   "cart_empty",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
+  "checkout_already_open",
   "payment_slot_held",
   "reservation_expired",
   "payment_session_not_cancelable",
+  "payment_session_conflict",
   "provider_identity_mismatch",
+  "payment_method_unavailable",
   "provider_unavailable",
   "lock_timeout",
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "reservation_conflict",
+  "stock_lock_unavailable",
+  "variant_not_found",
+  "variant_stock_write_failed",
+  "stock_invariant_violation",
+  "payment_confirmation_in_flight",
+  "checkout_reservation_release_requires_transaction",
+  "admission_metadata_invalid",
+  "admission_metadata_required",
+  "capacity_exceeded",
+  "occurrence_lock_unavailable",
+  "occurrence_not_open",
+  "admission_type_capacity_exceeded",
+  "admission_type_occurrence_mismatch",
+  "admission_hold_expired",
+  "admission_hold_checkout_item_conflict",
+  "admission_hold_checkout_conflict",
+  "admission_hold_quantity_mismatch",
+  "admission_hold_unbound",
+  "admission_hold_missing",
+  "admission_hold_checkout_item_missing",
+  "admission_hold_expiry_failed",
+  "admission_hold_expiry_requires_transaction",
+  "admission_hold_line_item_mismatch",
+  "admission_materialization_failed",
+  "variant_inactive",
+  "variant_product_mismatch",
+  "product_not_public",
   "market_not_found",
   "market_shipping_currency_unsupported",
   "missing_market_rate",
@@ -91,7 +155,11 @@ var COMMERCE_ERROR_CODES = [
   "discount_min_order_amount",
   "discount_currency_scope_required",
   "discount_allocation_method_unsupported",
-  "currency_mismatch"
+  "currency_mismatch",
+  "customer_token_required",
+  "market_required",
+  "server_derived",
+  "internal_error"
 ];
 var COMMERCE_ERROR_CODE_SET = new Set(
   COMMERCE_ERROR_CODES
@@ -117,6 +185,12 @@ function commerceProtocolError(issue, trustedRequestId) {
   );
 }
 function parseCommerceErrorEnvelope(body, headerRequestId) {
+  if (headerRequestId === void 0) {
+    throw commerceProtocolError("missing_request_id_header");
+  }
+  if (headerRequestId.length === 0) {
+    throw commerceProtocolError("empty_request_id_header");
+  }
   if (!isPlainRecord(body)) {
     throw commerceProtocolError("expected_object", headerRequestId);
   }
@@ -126,7 +200,7 @@ function parseCommerceErrorEnvelope(body, headerRequestId) {
   if (typeof body.error !== "string" || body.error.length === 0 || typeof body.reason !== "string" || body.reason.length === 0 || typeof body.requestId !== "string" || body.requestId.length === 0 || body.retryable !== void 0 && typeof body.retryable !== "boolean" || body.details !== void 0 && !isPlainRecord(body.details)) {
     throw commerceProtocolError("invalid_field", headerRequestId);
   }
-  if (headerRequestId && headerRequestId !== body.requestId) {
+  if (headerRequestId !== void 0 && headerRequestId !== body.requestId) {
     throw commerceProtocolError("request_id_mismatch", headerRequestId);
   }
   return {
@@ -151,8 +225,16 @@ function enhanceCommerceError(error, body, headerRequestId) {
   });
   return error;
 }
+function enhanceNonCommerceError(error, reason) {
+  if (typeof reason === "string") Object.assign(error, { apiReason: reason });
+  return error;
+}
+function getSDKErrorReason(error) {
+  if (error.kind !== "commerce") return error.apiReason;
+  return error.reason === "unknown_commerce_error" ? error.rawReason : error.reason;
+}
 function isCommerceSDKError(error) {
-  if (!(error instanceof SDKError) || error.kind !== "commerce") return false;
+  if (!isSDKError(error) || error.kind !== "commerce") return false;
   if (typeof error.requestId !== "string" || typeof error.retryable !== "boolean" || error.retryAfter !== void 0 && (!Number.isSafeInteger(error.retryAfter) || error.retryAfter < 0) || typeof error.reason !== "string") {
     return false;
   }
@@ -162,12 +244,14 @@ var NetworkError = class extends SDKError {
   constructor(message, status, details, userMessage, suggestion) {
     super("NETWORK_ERROR", message, status, details, userMessage, suggestion);
     this.name = "NetworkError";
+    defineSDKErrorType(this, "NetworkError");
   }
 };
 var ValidationError = class extends SDKError {
   constructor(message, details, userMessage, suggestion, status = 400) {
     super("VALIDATION_ERROR", message, status, details, userMessage, suggestion);
     this.name = "ValidationError";
+    defineSDKErrorType(this, "ValidationError");
   }
 };
 var ApiError = class extends SDKError {
@@ -182,24 +266,28 @@ var ApiError = class extends SDKError {
       requestId
     );
     this.name = "ApiError";
+    defineSDKErrorType(this, "ApiError");
   }
 };
 var ConfigError = class extends SDKError {
   constructor(message, details, userMessage, suggestion) {
     super("CONFIG_ERROR", message, void 0, details, userMessage, suggestion);
     this.name = "ConfigError";
+    defineSDKErrorType(this, "ConfigError");
   }
 };
 var TimeoutError = class extends SDKError {
   constructor(message = "Request timed out.", details, userMessage, suggestion) {
     super("TIMEOUT_ERROR", message, 408, details, userMessage, suggestion);
     this.name = "TimeoutError";
+    defineSDKErrorType(this, "TimeoutError");
   }
 };
 var GoneError = class extends SDKError {
   constructor(message = "The requested resource is no longer available.", details, userMessage, suggestion) {
     super("GONE_ERROR", message, 410, details, userMessage, suggestion);
     this.name = "GoneError";
+    defineSDKErrorType(this, "GoneError");
   }
 };
 var ServiceUnavailableError = class extends SDKError {
@@ -214,6 +302,7 @@ var ServiceUnavailableError = class extends SDKError {
     );
     this.name = "ServiceUnavailableError";
     this.retryAfter = retryAfter;
+    defineSDKErrorType(this, "ServiceUnavailableError");
   }
 };
 var UsageLimitError = class extends SDKError {
@@ -221,6 +310,7 @@ var UsageLimitError = class extends SDKError {
     super("USAGE_LIMIT_ERROR", message, 429, details, userMessage, suggestion);
     this.name = "UsageLimitError";
     this.usage = usage;
+    defineSDKErrorType(this, "UsageLimitError");
   }
   toJSON() {
     return {
@@ -241,6 +331,7 @@ var AuthError = class extends SDKError {
       requestId
     );
     this.name = "AuthError";
+    defineSDKErrorType(this, "AuthError");
   }
 };
 var PermissionError = class extends SDKError {
@@ -255,6 +346,7 @@ var PermissionError = class extends SDKError {
       requestId
     );
     this.name = "PermissionError";
+    defineSDKErrorType(this, "PermissionError");
   }
 };
 var NotFoundError = class extends SDKError {
@@ -269,12 +361,14 @@ var NotFoundError = class extends SDKError {
       requestId
     );
     this.name = "NotFoundError";
+    defineSDKErrorType(this, "NotFoundError");
   }
 };
 var ConflictError = class extends SDKError {
   constructor(message, details, userMessage, suggestion, requestId) {
     super("conflict", message, 409, details, userMessage, suggestion, requestId);
     this.name = "ConflictError";
+    defineSDKErrorType(this, "ConflictError");
   }
 };
 var RateLimitError = class extends SDKError {
@@ -290,8 +384,64 @@ var RateLimitError = class extends SDKError {
     );
     this.name = "RateLimitError";
     this.retryAfter = retryAfter;
+    defineSDKErrorType(this, "RateLimitError");
   }
 };
+function hasBrandedSDKErrorShape(error) {
+  if (error === null || typeof error !== "object") return false;
+  const candidate = error;
+  return candidate[SDK_ERROR_BRAND] === true && typeof candidate.name === "string" && typeof candidate.code === "string" && typeof candidate.message === "string" && (candidate.status === void 0 || typeof candidate.status === "number") && (candidate.userMessage === void 0 || typeof candidate.userMessage === "string") && (candidate.suggestion === void 0 || typeof candidate.suggestion === "string") && (candidate.requestId === void 0 || typeof candidate.requestId === "string") && (candidate.kind === void 0 || candidate.kind === "commerce") && (candidate.reason === void 0 || typeof candidate.reason === "string") && (candidate.rawReason === void 0 || typeof candidate.rawReason === "string") && (candidate.apiReason === void 0 || typeof candidate.apiReason === "string") && (candidate.retryable === void 0 || typeof candidate.retryable === "boolean") && (candidate.retryAfter === void 0 || typeof candidate.retryAfter === "number") && typeof candidate.getUserMessage === "function" && typeof candidate.toJSON === "function";
+}
+function hasSDKErrorType(error, type) {
+  return hasBrandedSDKErrorShape(error) && error[SDK_ERROR_TYPE_BRAND] === type;
+}
+function isSDKError(error) {
+  return error instanceof SDKError || hasBrandedSDKErrorShape(error);
+}
+function isNetworkError(error) {
+  return error instanceof NetworkError || hasSDKErrorType(error, "NetworkError");
+}
+function isValidationError(error) {
+  if (error instanceof ValidationError || hasSDKErrorType(error, "ValidationError")) {
+    return true;
+  }
+  if (error == null || typeof error !== "object") return false;
+  const candidate = error;
+  return candidate.name === "ValidationError" && candidate.code === "VALIDATION_ERROR" && typeof candidate.message === "string" && typeof candidate.getUserMessage === "function" && typeof candidate.toJSON === "function";
+}
+function isApiError(error) {
+  return error instanceof ApiError || hasSDKErrorType(error, "ApiError");
+}
+function isConfigError(error) {
+  return error instanceof ConfigError || hasSDKErrorType(error, "ConfigError");
+}
+function isTimeoutError(error) {
+  return error instanceof TimeoutError || hasSDKErrorType(error, "TimeoutError");
+}
+function isGoneError(error) {
+  return error instanceof GoneError || hasSDKErrorType(error, "GoneError");
+}
+function isServiceUnavailableError(error) {
+  return error instanceof ServiceUnavailableError || hasSDKErrorType(error, "ServiceUnavailableError");
+}
+function isUsageLimitError(error) {
+  return error instanceof UsageLimitError || hasSDKErrorType(error, "UsageLimitError");
+}
+function isAuthError(error) {
+  return error instanceof AuthError || hasSDKErrorType(error, "AuthError");
+}
+function isPermissionError(error) {
+  return error instanceof PermissionError || hasSDKErrorType(error, "PermissionError");
+}
+function isNotFoundError(error) {
+  return error instanceof NotFoundError || hasSDKErrorType(error, "NotFoundError");
+}
+function isConflictError(error) {
+  return error instanceof ConflictError || hasSDKErrorType(error, "ConflictError");
+}
+function isRateLimitError(error) {
+  return error instanceof RateLimitError || hasSDKErrorType(error, "RateLimitError");
+}
 var createNetworkError = (message, status, details, userMessage, suggestion) => new NetworkError(message, status, details, userMessage, suggestion);
 var createValidationError = (message, details, userMessage, suggestion, status) => new ValidationError(message, details, userMessage, suggestion, status);
 var createApiError = (message, status, details, userMessage, suggestion, requestId) => new ApiError(message, status, details, userMessage, suggestion, requestId);
@@ -501,7 +651,7 @@ function mapResponseToError(status, parsed, details, requestId, retryAfter, erro
     if (retryAfter !== void 0) {
       Object.assign(withRequestId, { retryAfter });
     }
-    return errorFamily === "commerce" ? enhanceCommerceError(withRequestId, parsed.body, requestId) : withRequestId;
+    return errorFamily === "commerce" ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(withRequestId, parsed.reason);
   };
   if (status === 400 || status === 422) {
     return finalize(
@@ -688,7 +838,7 @@ async function httpFetch(url, options) {
             ),
             requestId
           );
-          throw errorFamily === "commerce" ? enhanceCommerceError(usageError, parsed.body, requestId) : usageError;
+          throw errorFamily === "commerce" ? enhanceCommerceError(usageError, parsed.body, requestId) : enhanceNonCommerceError(usageError, parsed.reason);
         }
         if (response.status === 401 && onUnauthorized && customerToken && !hasRetried401 && (commerceEnvelope?.reason ?? parsed.reason) === "token_expired") {
           hasRetried401 = true;
@@ -1378,7 +1528,10 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     return parsed;
   }
   const data = parsed;
-  if (data.error) {
+  const hasCommerceEnvelopeSignal = options.errorFamily === "commerce" && ["error", "reason", "requestId", "retryable", "details"].some(
+    (key) => Object.prototype.hasOwnProperty.call(data, key)
+  );
+  if (data.error || hasCommerceEnvelopeSignal) {
     const errorMessage = typeof data.error === "string" ? data.error : "Unknown API error";
     const reason = typeof data.reason === "string" ? data.reason : void 0;
     const requestId = response.headers.get("x-request-id") ?? void 0;
@@ -1407,19 +1560,21 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     }
     const withRequestId = attachRequestId(error, requestId);
     if (retryAfter !== void 0) Object.assign(withRequestId, { retryAfter });
-    throw options.errorFamily === "commerce" ? enhanceCommerceError(withRequestId, data, requestId) : withRequestId;
+    throw options.errorFamily === "commerce" ? enhanceCommerceError(withRequestId, data, requestId) : enhanceNonCommerceError(withRequestId, reason);
   }
   return data;
 }
 
 // ../../internal/http-contracts/src/index.ts
 var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
-var operation = (collection, method, path) => Object.freeze({
+var operation = (collection, method, path, errorFamily) => Object.freeze({
   [operationBrand]: true,
   collection,
   method,
-  path
+  path,
+  ...errorFamily && { errorFamily }
 });
+var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
 var COMMERCE_ENDPOINT_OPERATIONS = {
   products: {
     detail: operation("products", "get", "/detail"),
@@ -1452,13 +1607,13 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     byPayment: operation("orders", "get", "/by-payment"),
     cancel: operation("orders", "post", "/cancel"),
     resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
-    checkout: operation("orders", "post", "/checkout"),
+    checkout: strictCommerceOperation("orders", "post", "/checkout"),
     createFulfillment: operation("orders", "post", "/create-fulfillment"),
     updateFulfillment: operation("orders", "post", "/update-fulfillment")
   },
   checkouts: {
-    detail: operation("checkouts", "post", "/detail"),
-    query: operation("checkouts", "post", "/query")
+    detail: strictCommerceOperation("checkouts", "post", "/detail"),
+    query: strictCommerceOperation("checkouts", "post", "/query")
   },
   transactions: {
     update: operation("transactions", "post", "/update")
@@ -1479,29 +1634,58 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     bulkImport: operation("fulfillments", "post", "/bulk-import")
   },
   carts: {
-    create: operation("carts", "post", "/create"),
-    retrieve: operation("carts", "post", "/retrieve"),
-    mine: operation("carts", "post", "/mine"),
-    merge: operation("carts", "post", "/merge"),
-    addItem: operation("carts", "post", "/add-item"),
-    updateItem: operation("carts", "post", "/update-item"),
-    removeItem: operation("carts", "post", "/remove-item"),
-    updateDiscountCodes: operation("carts", "post", "/update-discount-codes"),
-    updateAttributes: operation("carts", "post", "/update-attributes"),
-    clear: operation("carts", "post", "/clear")
+    create: strictCommerceOperation("carts", "post", "/create"),
+    retrieve: strictCommerceOperation("carts", "post", "/retrieve"),
+    mine: strictCommerceOperation("carts", "post", "/mine"),
+    merge: strictCommerceOperation("carts", "post", "/merge"),
+    addItem: strictCommerceOperation("carts", "post", "/add-item"),
+    updateItem: strictCommerceOperation("carts", "post", "/update-item"),
+    removeItem: strictCommerceOperation("carts", "post", "/remove-item"),
+    updateDiscountCodes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-discount-codes"
+    ),
+    updateAttributes: strictCommerceOperation(
+      "carts",
+      "post",
+      "/update-attributes"
+    ),
+    clear: strictCommerceOperation("carts", "post", "/clear")
   },
   paymentSessions: {
-    create: operation("payment-sessions", "post", "/create"),
-    retrieve: operation("payment-sessions", "post", "/retrieve"),
-    cancel: operation("payment-sessions", "post", "/cancel"),
+    create: strictCommerceOperation("payment-sessions", "post", "/create"),
+    retrieve: strictCommerceOperation("payment-sessions", "post", "/retrieve"),
+    cancel: strictCommerceOperation("payment-sessions", "post", "/cancel"),
     server: {
-      create: operation("payment-sessions", "post", "/server/create"),
-      retrieve: operation("payment-sessions", "post", "/server/retrieve"),
-      cancel: operation("payment-sessions", "post", "/server/cancel"),
-      confirm: operation("payment-sessions", "post", "/server/confirm")
+      create: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/create"
+      ),
+      retrieve: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/retrieve"
+      ),
+      cancel: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/cancel"
+      ),
+      confirm: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/confirm"
+      )
     },
     custom: {
       create: operation("orders", "post", "/custom-payment-sessions"),
+      retrieve: operation(
+        "orders",
+        "post",
+        "/custom-payment-sessions/retrieve"
+      ),
       confirm: operation("orders", "post", "/custom-payment-sessions/confirm")
     }
   },
@@ -1527,6 +1711,11 @@ var EVENTS_ENDPOINT_OPERATIONS = {
     )
   }
 };
+var COMMUNITY_ENDPOINT_OPERATIONS = {
+  posts: {
+    detail: operation("posts", "get", "/detail")
+  }
+};
 function resolveOperationTemplate(descriptor) {
   return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
 }
@@ -1558,6 +1747,9 @@ var sharedEndpoint = (descriptor) => descriptor;
 function resolveOperationMethod2(descriptor) {
   return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
 }
+function resolveOperationErrorFamily(descriptor) {
+  return "collection" in descriptor ? descriptor.errorFamily : void 0;
+}
 function resolveOperationPath2(descriptor, options) {
   if ("collection" in descriptor) {
     return resolveOperationPath(descriptor, options);
@@ -1592,12 +1784,12 @@ var COMMERCE_ENDPOINTS = {
     updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
   },
   checkouts: {
-    create: endpoint("POST", "/api/orders/checkout"),
-    retrieve: endpoint("POST", "/api/checkouts/detail"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+    retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
     server: {
-      create: endpoint("POST", "/api/orders/checkout"),
-      retrieve: endpoint("POST", "/api/checkouts/detail"),
-      query: endpoint("POST", "/api/checkouts/query")
+      create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
+      retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.detail),
+      query: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.checkouts.query)
     }
   },
   returns: {
@@ -1615,10 +1807,10 @@ var COMMERCE_ENDPOINTS = {
     bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
   },
   carts: {
-    create: endpoint("POST", "/api/carts/create"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
     retrieve: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.retrieve),
-    mine: endpoint("POST", "/api/carts/mine"),
-    merge: endpoint("POST", "/api/carts/merge"),
+    mine: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.mine),
+    merge: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.merge),
     server: {
       // Server credentials are an authorization lane, not a second Cart
       // transport. These must stay bound to the registered shared operations.
@@ -1638,29 +1830,46 @@ var COMMERCE_ENDPOINTS = {
       clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
     },
     addItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.addItem),
-    updateItem: endpoint("POST", "/api/carts/update-item"),
-    removeItem: endpoint("POST", "/api/carts/remove-item"),
-    updateDiscountCodes: endpoint("POST", "/api/carts/update-discount-codes"),
-    updateAttributes: endpoint("POST", "/api/carts/update-attributes"),
-    clear: endpoint("POST", "/api/carts/clear")
+    updateItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.updateItem),
+    removeItem: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.removeItem),
+    updateDiscountCodes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateDiscountCodes
+    ),
+    updateAttributes: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.carts.updateAttributes
+    ),
+    clear: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.clear)
   },
   paymentSessions: {
-    create: endpoint("POST", "/api/payment-sessions/create"),
-    retrieve: endpoint("POST", "/api/payment-sessions/retrieve"),
-    cancel: endpoint("POST", "/api/payment-sessions/cancel"),
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create),
+    retrieve: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve
+    ),
+    cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.cancel),
     custom: {
       create: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.create
       ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.retrieve
+      ),
       confirm: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.custom.confirm
       )
     },
     server: {
-      create: endpoint("POST", "/api/payment-sessions/server/create"),
-      retrieve: endpoint("POST", "/api/payment-sessions/server/retrieve"),
-      cancel: endpoint("POST", "/api/payment-sessions/server/cancel"),
-      confirm: endpoint("POST", "/api/payment-sessions/server/confirm")
+      create: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create
+      ),
+      retrieve: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
+      ),
+      cancel: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.cancel
+      ),
+      confirm: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
+      )
     }
   },
   shippingPolicies: {
@@ -1751,7 +1960,8 @@ var CustomerScopedApi = class {
     return this.transport.request(resolveOperationPath2(endpoint2, options), {
       method: resolveOperationMethod2(endpoint2),
       body,
-      headers: options?.headers
+      headers: options?.headers,
+      errorFamily: resolveOperationErrorFamily(endpoint2)
     });
   }
 };
@@ -1773,15 +1983,33 @@ function unwrapPayloadDoc(value) {
   }
   return value;
 }
+function hasCanonicalNotFoundReason(error) {
+  return getSDKErrorReason(error) === "not_found";
+}
 var CommunityClient = class extends RawCustomerScopedApi {
   constructor(options) {
     super("CommunityClient", { ...options, requiresCredential: false });
+    this.requiresSafePublicRawReads = !options.secretKey;
   }
   buildQuery(params) {
     if (!params) return "";
     const entries = Object.entries(params).filter((e) => e[1] !== void 0).map(([k, v]) => [k, String(v)]);
     return entries.length ? `?${new URLSearchParams(entries).toString()}` : "";
   }
+  withSafePublicRawReadQuery(query) {
+    if (!this.requiresSafePublicRawReads) return query;
+    if (!query) return "?depth=0&joins=false";
+    return `?depth=0&joins=false&${query.slice(1)}`;
+  }
+  buildSafePublicRawListQuery(params) {
+    if (!this.requiresSafePublicRawReads) {
+      return this.buildQuery(params);
+    }
+    const queryParams = {};
+    if (params?.page !== void 0) queryParams.page = params.page;
+    if (params?.limit !== void 0) queryParams.limit = params.limit;
+    return this.withSafePublicRawReadQuery(this.buildQuery(queryParams));
+  }
   buildPostsListQuery(params) {
     const urlParams = new URLSearchParams();
     const sort = params?.sort ?? DEFAULT_POST_LIST_SORT;
@@ -1841,15 +2069,35 @@ var CommunityClient = class extends RawCustomerScopedApi {
       "GET"
     );
   }
+  /**
+   * Public post detail projected by the same allowlist as the public feed.
+   * Missing, hidden, and cross-tenant posts all resolve to `null`.
+   */
+  async getPost(params) {
+    const query = new URLSearchParams({ postId: params.postId });
+    try {
+      return await this.execute(
+        resolveOperationPath(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail, {
+          query
+        }),
+        resolveOperationMethod(COMMUNITY_ENDPOINT_OPERATIONS.posts.detail)
+      );
+    } catch (error) {
+      if (error instanceof NotFoundError && hasCanonicalNotFoundReason(error)) {
+        return null;
+      }
+      throw error;
+    }
+  }
   listPostCategories(params) {
     return this.execute(
-      `/api/post-categories${this.buildQuery(params)}`,
+      `/api/post-categories${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
   listPostTags(params) {
     return this.execute(
-      `/api/post-tags${this.buildQuery(params)}`,
+      `/api/post-tags${this.buildSafePublicRawListQuery(params)}`,
       "GET"
     );
   }
@@ -2015,7 +2263,7 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   getReactionTypes() {
     return this.execute(
-      "/api/reaction-types?limit=100",
+      `/api/reaction-types${this.buildSafePublicRawListQuery({ limit: 100 })}`,
       "GET"
     );
   }
@@ -2043,11 +2291,17 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   // Profiles
   listProfileLists(params) {
-    return this.execute(`/api/customer-profile-lists${this.buildQuery(params)}`, "GET");
+    return this.execute(
+      `/api/customer-profile-lists${this.buildSafePublicRawListQuery(params)}`,
+      "GET"
+    );
   }
   async getProfileList(params) {
     const query = "slug" in params ? `?where[slug][equals]=${encodeURIComponent(params.slug)}&limit=1` : `?where[id][equals]=${encodeURIComponent(params.id)}&limit=1`;
-    const res = await this.execute(`/api/customer-profile-lists${query}`, "GET");
+    const res = await this.execute(
+      `/api/customer-profile-lists${this.withSafePublicRawReadQuery(query)}`,
+      "GET"
+    );
     return res.docs[0] ?? null;
   }
   updatePublicProfile(body) {
@@ -2107,7 +2361,8 @@ var BaseApi = class {
       body,
       {
         method: resolveOperationMethod2(endpoint2),
-        headers: options?.headers
+        headers: options?.headers,
+        errorFamily: resolveOperationErrorFamily(endpoint2)
       }
     );
   }
@@ -2164,7 +2419,7 @@ var MAX_COMMERCE_CAPABILITY_LENGTH = 512;
 var MAX_CART_DISCOUNT_CODE_LENGTH = 128;
 var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
 var ABANDONED_REASONS = ["expired", "customer", "operator"];
-var PAYMENT_PROVIDERS = ["toss"];
+var PAYMENT_PROVIDERS = ["toss", "portone"];
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2247,6 +2502,21 @@ function nullableString(value, resource, path) {
     fail(resource, path, "string or null");
   }
 }
+function nonBlankString(value, resource, path) {
+  const parsed = string(value, resource, path);
+  if (parsed.trim().length === 0) {
+    fail(resource, path, "non-blank string");
+  }
+  return parsed;
+}
+function nullableNonBlankString(value, resource, path) {
+  if (value !== null) nonBlankString(value, resource, path);
+}
+function nullableResourceId(value, resource, path) {
+  if (value !== null) {
+    boundedString(value, MAX_COMMERCE_RESOURCE_ID_LENGTH, resource, path);
+  }
+}
 function cartLineQuantity(value, resource, path) {
   const quantity = positiveInteger(value, resource, path);
   if (quantity > MAX_CART_LINE_QUANTITY) {
@@ -3068,6 +3338,59 @@ function validateCustomPaymentSession(value) {
   validateMoney(session.money, resource, "$.money");
   return value;
 }
+function validateRetrievedCustomPaymentSession(value) {
+  const resource = "retrieved custom PaymentSession";
+  const session = record(value, resource, "$");
+  exact(
+    session,
+    [
+      "id",
+      "provider",
+      "providerSessionId",
+      "providerPaymentId",
+      "status",
+      "providerStatus",
+      "finalizationStatus",
+      "money",
+      "orderId"
+    ],
+    [],
+    resource,
+    "$"
+  );
+  boundedString(session.id, MAX_COMMERCE_RESOURCE_ID_LENGTH, resource, "$.id");
+  const provider = string(session.provider, resource, "$.provider");
+  if (!/^[a-z0-9][a-z0-9_-]{0,63}$/i.test(provider)) {
+    fail(resource, "$.provider", "provider slug");
+  }
+  nonBlankString(session.providerSessionId, resource, "$.providerSessionId");
+  nullableNonBlankString(
+    session.providerPaymentId,
+    resource,
+    "$.providerPaymentId"
+  );
+  enumValue(
+    session.status,
+    ["pending", "captured", "failed", "canceled"],
+    resource,
+    "$.status"
+  );
+  enumValue(
+    session.providerStatus,
+    PAYMENT_PROVIDER_STATUSES,
+    resource,
+    "$.providerStatus"
+  );
+  enumValue(
+    session.finalizationStatus,
+    ["not_ready", "pending", "committed"],
+    resource,
+    "$.finalizationStatus"
+  );
+  validateMoney(session.money, resource, "$.money");
+  nullableResourceId(session.orderId, resource, "$.orderId");
+  return value;
+}
 function validateConfirmCustomPaymentSessionResponse(value) {
   const resource = "custom PaymentSession confirmation";
   const result = record(value, resource, "$");
@@ -3118,8 +3441,101 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
     previous = current;
   });
 }
-function validateNextAction(value, resource, path) {
+function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "portone") {
+    if (action.type === "portone_sdk") {
+      exact(
+        action,
+        [
+          "type",
+          "version",
+          "storeId",
+          "channelKey",
+          "paymentId",
+          "orderName",
+          "totalAmount",
+          "currency",
+          "payMethod",
+          "redirectUrl"
+        ],
+        [],
+        resource,
+        path
+      );
+      if (action.version !== "v2") fail(resource, `${path}.version`, "v2");
+      for (const key of ["storeId", "channelKey"]) {
+        boundedString(action[key], 255, resource, `${path}.${key}`);
+      }
+      const paymentId = boundedString(
+        action.paymentId,
+        40,
+        resource,
+        `${path}.paymentId`
+      );
+      if (!/^[A-Za-z0-9]{6,40}$/.test(paymentId)) {
+        fail(
+          resource,
+          `${path}.paymentId`,
+          "6-40 ASCII alphanumeric characters"
+        );
+      }
+      boundedString(
+        action.orderName,
+        MAX_COMMERCE_SHORT_TEXT_LENGTH,
+        resource,
+        `${path}.orderName`
+      );
+      positiveInteger(action.totalAmount, resource, `${path}.totalAmount`);
+      if (action.currency !== "CURRENCY_KRW") {
+        fail(resource, `${path}.currency`, "CURRENCY_KRW");
+      }
+      if (action.payMethod !== "CARD")
+        fail(resource, `${path}.payMethod`, "CARD");
+      const redirectUrl = boundedString(
+        action.redirectUrl,
+        2048,
+        resource,
+        `${path}.redirectUrl`
+      );
+      try {
+        const parsed = new URL(redirectUrl);
+        const loopback = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+        if (!loopback && parsed.protocol !== "https:" || parsed.username || parsed.password)
+          throw new Error("unsafe redirect URL");
+      } catch {
+        fail(
+          resource,
+          `${path}.redirectUrl`,
+          "HTTPS or loopback URL without embedded credentials"
+        );
+      }
+      return;
+    }
+    exact(action, ["type", "checkoutUrl"], [], resource, path);
+    if (action.type !== "portone_checkout") {
+      fail(resource, `${path}.type`, "portone_checkout | portone_sdk");
+    }
+    const checkoutUrl = boundedString(
+      action.checkoutUrl,
+      2048,
+      resource,
+      `${path}.checkoutUrl`
+    );
+    try {
+      const parsed = new URL(checkoutUrl);
+      if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "") {
+        throw new Error("unsafe checkout URL");
+      }
+    } catch {
+      fail(
+        resource,
+        `${path}.checkoutUrl`,
+        "absolute HTTPS URL without embedded credentials"
+      );
+    }
+    return;
+  }
   exact(
     action,
     [
@@ -3170,10 +3586,18 @@ function validateNextAction(value, resource, path) {
   if (action.customerEmail !== void 0)
     validateCustomer({ email: action.customerEmail }, resource, path);
 }
-function validatePublicPaymentSession(value) {
+function validatePublicPaymentSession(value, expectedProvider) {
   const resource = "PaymentSession";
   const session = record(value, resource, "$");
-  enumValue(session.provider, PAYMENT_PROVIDERS, resource, "$.provider");
+  const provider = enumValue(
+    session.provider,
+    PAYMENT_PROVIDERS,
+    resource,
+    "$.provider"
+  );
+  if (expectedProvider !== void 0 && provider !== expectedProvider) {
+    fail(resource, "$.provider", expectedProvider);
+  }
   const status = enumValue(
     session.providerStatus,
     PAYMENT_PROVIDER_STATUSES,
@@ -3210,7 +3634,12 @@ function validatePublicPaymentSession(value) {
       }
       if (!("nextAction" in session))
         fail(resource, "$.nextAction", "required field");
-      validateNextAction(session.nextAction, resource, "$.nextAction");
+      validateNextAction(
+        session.nextAction,
+        provider,
+        resource,
+        "$.nextAction"
+      );
     } else if (session.sessionRole === "residual") {
       if (session.presentationStatus !== "suppressed" || session.finalizationStatus !== "not_ready") {
         fail(resource, "$", "suppressed residual not-ready state");
@@ -4482,21 +4911,11 @@ var PRODUCT_DETAIL_UNAVAILABLE_REASONS = /* @__PURE__ */ new Set([
   "not_published",
   "feature_disabled"
 ]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function readProductDetailUnavailableReason(value) {
-  if (!isRecord(value)) return void 0;
-  const directReason = value.reason ?? value.code;
-  if (typeof directReason === "string" && PRODUCT_DETAIL_UNAVAILABLE_REASONS.has(directReason)) {
-    return directReason;
-  }
-  return readProductDetailUnavailableReason(value.body);
-}
 function productDetailResultFromError(error) {
   if (!(error instanceof SDKError) || error.status !== 404) return void 0;
-  const reason = readProductDetailUnavailableReason(error.details);
-  if (!reason) return void 0;
+  const reason = getSDKErrorReason(error);
+  if (!reason || !PRODUCT_DETAIL_UNAVAILABLE_REASONS.has(reason))
+    return void 0;
   return { found: false, reason };
 }
 var MARKET_PRICE_QUERY_UNSUPPORTED_MESSAGE = "Market listing pages do not support base price filters or price sorts.";
@@ -4929,8 +5348,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
       }
     });
   }
-  async paymentSession(result) {
-    return validatePublicPaymentSession(await result);
+  async paymentSession(result, expectedProvider) {
+    return validatePublicPaymentSession(await result, expectedProvider);
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
@@ -4940,18 +5359,53 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
+    );
+  }
+  createPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    return this.paymentSession(
+      this.post(
+        this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
+        body,
+        idempotencyKey
+      ),
+      "portone"
     );
   }
   retrieve(params) {
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
-    return this.paymentSession(this.post(endpoint2, params));
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "toss"
+    );
+  }
+  retrievePortOne(params) {
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
+    return this.paymentSession(
+      this.post(endpoint2, params),
+      "portone"
+    );
   }
   cancel(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
     const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
-    return this.paymentSession(this.post(endpoint2, body, idempotencyKey));
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "toss"
+    );
+  }
+  cancelPortOne(params) {
+    const { idempotencyKey, ...body } = params;
+    assertCommerceIdempotencyKey(idempotencyKey);
+    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
+    return this.paymentSession(
+      this.post(endpoint2, body, idempotencyKey),
+      "portone"
+    );
   }
   confirm(params) {
     const { idempotencyKey, ...body } = params;
@@ -4961,7 +5415,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
         COMMERCE_ENDPOINTS.paymentSessions.server.confirm,
         body,
         idempotencyKey
-      )
+      ),
+      "toss"
     );
   }
 };
@@ -4982,6 +5437,15 @@ var CustomPaymentSessionApi = class extends BaseApi {
     );
     return validateCustomPaymentSession(result);
   }
+  async retrieve(params) {
+    const result = await this.requestEndpoint(
+      COMMERCE_ENDPOINTS.paymentSessions.custom.retrieve,
+      params
+    );
+    return validateRetrievedCustomPaymentSession(
+      result
+    );
+  }
   async confirm(params, options = {}) {
     const body = {
       provider: params.provider,
@@ -5129,11 +5593,17 @@ var ServerCommerceClient = class {
     };
     this.paymentSessions = {
       create: paymentSessionApi.create.bind(paymentSessionApi),
+      createPortOne: paymentSessionApi.createPortOne.bind(paymentSessionApi),
       retrieve: (params) => paymentSessionApi.retrieve(params),
+      retrievePortOne: (params) => paymentSessionApi.retrievePortOne(params),
       cancel: (params) => paymentSessionApi.cancel(params),
+      cancelPortOne: (params) => paymentSessionApi.cancelPortOne(params),
       confirm: paymentSessionApi.confirm.bind(paymentSessionApi),
       custom: {
         create: customPaymentSessionApi.create.bind(customPaymentSessionApi),
+        retrieve: customPaymentSessionApi.retrieve.bind(
+          customPaymentSessionApi
+        ),
         confirm: customPaymentSessionApi.confirm.bind(customPaymentSessionApi)
       }
     };
@@ -5504,6 +5974,21 @@ export {
   ServerCommerceClient,
   ServerPreviewClient,
   TenantIntrospectionApi,
-  createServerClient
+  createServerClient,
+  isApiError,
+  isAuthError,
+  isCommerceSDKError,
+  isConfigError,
+  isConflictError,
+  isGoneError,
+  isNetworkError,
+  isNotFoundError,
+  isPermissionError,
+  isRateLimitError,
+  isSDKError,
+  isServiceUnavailableError,
+  isTimeoutError,
+  isUsageLimitError,
+  isValidationError
 };
 //# sourceMappingURL=server.js.map