@01.software/sdk 0.49.0 → 0.56.1

package/dist/index.js

@@ -97,6 +97,7 @@ var COMMERCE_ERROR_CODES = [
   "payment_session_not_cancelable",
   "payment_session_conflict",
   "provider_identity_mismatch",
+  "managed_refund_attestation_forbidden",
   "payment_method_unavailable",
   "provider_unavailable",
   "lock_timeout",
@@ -639,11 +640,11 @@ function parseRetryAfter(response) {
     permitsAutomaticRetry: seconds <= MAX_AUTOMATIC_RETRY_AFTER_SECONDS
   };
 }
-function mapResponseToError(status, parsed, details, requestId, retryAfter, errorFamily) {
+function mapResponseToError(status, parsed, details, requestId, retryAfter, canonicalCommerceError) {
   const errorDetails = {
     ...details,
     ...parsed.errors && { errors: parsed.errors },
-    ...errorFamily !== "commerce" && parsed.body && { body: parsed.body }
+    ...!canonicalCommerceError && parsed.body && { body: parsed.body }
   };
   const suggestion = getParsedErrorSuggestion(status, parsed);
   const finalize = (error) => {
@@ -651,7 +652,7 @@ function mapResponseToError(status, parsed, details, requestId, retryAfter, erro
     if (retryAfter !== void 0) {
       Object.assign(withRequestId, { retryAfter });
     }
-    return errorFamily === "commerce" ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(withRequestId, parsed.reason);
+    return canonicalCommerceError ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(withRequestId, parsed.reason);
   };
   if (status === 400 || status === 422) {
     return finalize(
@@ -757,6 +758,7 @@ async function httpFetch(url, options) {
     retry,
     onUnauthorized,
     errorFamily,
+    typedCommerceErrorReasons,
     ...requestInit
   } = options || {};
   const baseUrl = resolveApiUrl(apiUrl);
@@ -810,7 +812,8 @@ async function httpFetch(url, options) {
       });
       if (!response.ok) {
         const parsed = await parseErrorBody(response);
-        const commerceEnvelope = errorFamily === "commerce" ? parseCommerceErrorEnvelope(parsed.body, requestId) : void 0;
+        const canonicalCommerceError = errorFamily === "commerce" || typeof parsed.reason === "string" && typedCommerceErrorReasons?.includes(parsed.reason) === true;
+        const commerceEnvelope = canonicalCommerceError ? parseCommerceErrorEnvelope(parsed.body, requestId) : void 0;
         if (isUsageLimitExceededResponse(response)) {
           const limit = parseInt(
             response.headers.get("X-Usage-Limit") || "0",
@@ -838,7 +841,7 @@ async function httpFetch(url, options) {
             ),
             requestId
           );
-          throw errorFamily === "commerce" ? enhanceCommerceError(usageError, parsed.body, requestId) : enhanceNonCommerceError(usageError, parsed.reason);
+          throw canonicalCommerceError ? enhanceCommerceError(usageError, parsed.body, requestId) : enhanceNonCommerceError(usageError, parsed.reason);
         }
         if (response.status === 401 && onUnauthorized && customerToken && !hasRetried401 && (commerceEnvelope?.reason ?? parsed.reason) === "token_expired") {
           hasRetried401 = true;
@@ -863,7 +866,7 @@ async function httpFetch(url, options) {
           details,
           requestId,
           retryAfter.seconds,
-          errorFamily
+          canonicalCommerceError
         );
         const method2 = (requestInit.method || "GET").toUpperCase();
         const isTerminal = error instanceof RateLimitError || error instanceof UsageLimitError;
@@ -1041,15 +1044,15 @@ var HttpClient = class {
       throw err;
     }
   }
-  buildUrl(endpoint2, options) {
-    if (!options) return endpoint2;
+  buildUrl(endpoint, options) {
+    if (!options) return endpoint;
     const { fallbackLocale, ...rest } = options;
     const queryOptions = fallbackLocale === void 0 ? rest : {
       ...rest,
       "fallback-locale": fallbackLocale === false ? "none" : fallbackLocale
     };
     const queryString = stringify(queryOptions, { addQueryPrefix: true });
-    return queryString ? `${endpoint2}${queryString}` : endpoint2;
+    return queryString ? `${endpoint}${queryString}` : endpoint;
   }
   assertJsonResponse(response) {
     const contentType = response.headers.get("content-type");
@@ -1198,39 +1201,39 @@ var ReadOnlyCollectionClient = class extends HttpClient {
   from(collection) {
     return new ReadOnlyCollectionQueryBuilder(this, collection);
   }
-  async requestFind(endpoint2, options) {
-    const url = this.buildUrl(endpoint2, options);
+  async requestFind(endpoint, options) {
+    const url = this.buildUrl(endpoint, options);
     const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "GET"
     });
     return this.parseFindResponse(response);
   }
-  async requestFindEndpoint(endpoint2, data) {
-    const response = await this.fetchWithTracking(endpoint2, {
+  async requestFindEndpoint(endpoint, data) {
+    const response = await this.fetchWithTracking(endpoint, {
       ...this.defaultOptions,
       method: "POST",
       body: data ? JSON.stringify(data) : void 0
     });
     return this.parseFindResponse(response);
   }
-  async requestFindEndpointGet(endpoint2) {
-    const response = await this.fetchWithTracking(endpoint2, {
+  async requestFindEndpointGet(endpoint) {
+    const response = await this.fetchWithTracking(endpoint, {
       ...this.defaultOptions,
       method: "GET"
     });
     return this.parseFindResponse(response);
   }
-  async requestFindById(endpoint2, options) {
-    const url = this.buildUrl(endpoint2, options);
+  async requestFindById(endpoint, options) {
+    const url = this.buildUrl(endpoint, options);
     const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "GET"
     });
     return this.parseDocumentResponse(response);
   }
-  async requestCount(endpoint2, options) {
-    const url = this.buildUrl(endpoint2, options);
+  async requestCount(endpoint, options) {
+    const url = this.buildUrl(endpoint, options);
     const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "GET"
@@ -1240,7 +1243,7 @@ var ReadOnlyCollectionClient = class extends HttpClient {
 };
 
 // src/core/api/parse-response.ts
-async function parseApiResponse(response, endpoint2, options = {}) {
+async function parseApiResponse(response, endpoint, options = {}) {
   if (response.status === 204 || response.headers.get("content-length") === "0") {
     return void 0;
   }
@@ -1249,7 +1252,7 @@ async function parseApiResponse(response, endpoint2, options = {}) {
     parsed = await response.json();
   } catch {
     throw createApiError(
-      `Invalid JSON response from ${endpoint2}`,
+      `Invalid JSON response from ${endpoint}`,
       response.status,
       void 0,
       "Server returned an invalid response.",
@@ -1299,6 +1302,7 @@ async function parseApiResponse(response, endpoint2, options = {}) {
 
 // ../../internal/http-contracts/src/index.ts
 var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
+var PORTONE_STANDARD_ACTION_CAPABILITIES_MEDIA_TYPE = "application/vnd.01software.portone-action-capabilities.v1+json";
 var operation = (collection, method, path, errorFamily) => Object.freeze({
   [operationBrand]: true,
   collection,
@@ -1307,6 +1311,10 @@ var operation = (collection, method, path, errorFamily) => Object.freeze({
   ...errorFamily && { errorFamily }
 });
 var strictCommerceOperation = (collection, method, path) => operation(collection, method, path, "commerce");
+var selectiveCommerceOperation = (collection, method, path, typedCommerceErrorReasons) => Object.freeze({
+  ...operation(collection, method, path),
+  typedCommerceErrorReasons: Object.freeze([...typedCommerceErrorReasons])
+});
 var COMMERCE_ENDPOINT_OPERATIONS = {
   products: {
     detail: operation("products", "get", "/detail"),
@@ -1338,7 +1346,12 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     confirmPayment: operation("orders", "post", "/confirm-payment"),
     byPayment: operation("orders", "get", "/by-payment"),
     cancel: operation("orders", "post", "/cancel"),
-    resolveCancelRefund: operation("orders", "post", "/resolve-cancel-refund"),
+    resolveCancelRefund: selectiveCommerceOperation(
+      "orders",
+      "post",
+      "/resolve-cancel-refund",
+      ["managed_refund_attestation_forbidden"]
+    ),
     checkout: strictCommerceOperation("orders", "post", "/checkout"),
     createFulfillment: operation("orders", "post", "/create-fulfillment"),
     updateFulfillment: operation("orders", "post", "/update-fulfillment")
@@ -1347,6 +1360,11 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     detail: strictCommerceOperation("checkouts", "post", "/detail"),
     query: strictCommerceOperation("checkouts", "post", "/query")
   },
+  draftOrders: {
+    calculate: operation("draft-orders", "post", "/:id/calculate"),
+    complete: operation("draft-orders", "post", "/:id/complete"),
+    finalize: operation("draft-orders", "post", "/:id/finalize")
+  },
   transactions: {
     update: operation("transactions", "post", "/update")
   },
@@ -1409,6 +1427,16 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
         "payment-sessions",
         "post",
         "/server/confirm"
+      ),
+      findPortOne: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/portone/find"
+      ),
+      reconcilePortOne: strictCommerceOperation(
+        "payment-sessions",
+        "post",
+        "/server/portone/reconcile"
       )
     },
     custom: {
@@ -1428,12 +1456,34 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     validate: operation("discounts", "post", "/validate")
   }
 };
+var portOneStandardActionCapabilityOperations = /* @__PURE__ */ new Set([
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.create,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.retrieve,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.create,
+  COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.retrieve
+]);
 var MEMBERSHIP_ENDPOINT_OPERATIONS = {
   subscribe: operation(null, "post", "/memberships/subscribe"),
   cancel: operation(null, "post", "/memberships/:id/cancel"),
-  me: operation(null, "get", "/memberships/me")
+  me: operation(null, "get", "/memberships/me"),
+  chargeResult: operation(null, "post", "/memberships/:id/charge-result"),
+  refundResult: operation(null, "post", "/memberships/:id/refund-result"),
+  revoke: operation(null, "post", "/memberships/:id/revoke")
+};
+var CUSTOMER_GROUP_ENDPOINT_OPERATIONS = {
+  members: operation("customer-groups", "get", "/:id/members"),
+  grant: operation("customer-groups", "post", "/:id/members/grant"),
+  revoke: operation("customer-groups", "post", "/:id/members/revoke")
+};
+var EMBEDDED_ADMIN_ENDPOINT_OPERATIONS = {
+  show: operation("tenants", "get", "/embedded-admin-app"),
+  configure: operation("tenants", "patch", "/embedded-admin-app"),
+  disable: operation("tenants", "delete", "/embedded-admin-app")
 };
 var EVENTS_ENDPOINT_OPERATIONS = {
+  events: {
+    convertSchedule: operation("events", "post", "/:id/schedule")
+  },
   occurrences: {
     range: operation("event-occurrences", "get", "/range"),
     admissionAvailability: operation(
@@ -1474,46 +1524,51 @@ function resolveOperationMethod(descriptor) {
 }
 
 // src/core/api/endpoints.ts
-var endpoint = (method, path) => ({ method, path });
 var sharedEndpoint = (descriptor) => descriptor;
-function resolveOperationMethod2(descriptor) {
-  return "collection" in descriptor ? resolveOperationMethod(descriptor) : descriptor.method;
-}
 function resolveOperationErrorFamily(descriptor) {
-  return "collection" in descriptor ? descriptor.errorFamily : void 0;
-}
-function resolveOperationPath2(descriptor, options) {
-  if ("collection" in descriptor) {
-    return resolveOperationPath(descriptor, options);
-  }
-  const query = options?.query?.toString().replace(/^\?/, "");
-  return query ? `${descriptor.path}?${query}` : descriptor.path;
+  return descriptor.errorFamily;
 }
 var COMMERCE_ENDPOINTS = {
   products: {
-    detail: endpoint("GET", "/api/products/detail"),
-    detailCatalog: endpoint("GET", "/api/products/detail/catalog"),
-    listingGroups: endpoint("GET", "/api/products/listing-groups"),
-    listingGroupsCatalog: endpoint(
-      "GET",
-      "/api/products/listing-groups/catalog"
+    detail: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.products.detail),
+    detailCatalog: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.detailCatalog
+    ),
+    listingGroups: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.listingGroups
+    ),
+    listingGroupsCatalog: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.listingGroupsCatalog
+    ),
+    // The manifest keeps the GET read and the POST body-query apart; this
+    // semantic name has always resolved to the GET one.
+    listingGroupsQuery: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.listingGroupsQueryGet
+    ),
+    listingGroupsQueryCatalog: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.listingGroupsQueryCatalog
     ),
-    listingGroupsQuery: endpoint("GET", "/api/products/listing-groups/query"),
-    listingGroupsQueryCatalog: endpoint(
-      "GET",
-      "/api/products/listing-groups/query/catalog"
+    stockCheck: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.stockCheck
     ),
-    stockCheck: endpoint("POST", "/api/products/stock-check"),
-    stockSnapshot: endpoint("GET", "/api/products/stock"),
-    upsert: endpoint("POST", "/api/products/upsert")
+    stockSnapshot: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.products.stockSnapshot
+    ),
+    upsert: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.products.upsert)
   },
   orders: {
-    update: endpoint("POST", "/api/orders/update"),
-    byPayment: endpoint("GET", "/api/orders/by-payment"),
-    cancel: endpoint("POST", "/api/orders/cancel"),
-    resolveCancelRefund: endpoint("POST", "/api/orders/resolve-cancel-refund"),
-    createFulfillment: endpoint("POST", "/api/orders/create-fulfillment"),
-    updateFulfillment: endpoint("POST", "/api/orders/update-fulfillment")
+    update: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.update),
+    byPayment: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.byPayment),
+    cancel: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.cancel),
+    resolveCancelRefund: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.orders.resolveCancelRefund
+    ),
+    createFulfillment: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.orders.createFulfillment
+    ),
+    updateFulfillment: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.orders.updateFulfillment
+    )
   },
   checkouts: {
     create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.orders.checkout),
@@ -1525,18 +1580,21 @@ var COMMERCE_ENDPOINTS = {
     }
   },
   returns: {
-    create: endpoint("POST", "/api/returns/create"),
-    update: endpoint("POST", "/api/returns/update"),
-    returnRefund: endpoint("POST", "/api/returns/return-refund")
+    create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.returns.create),
+    update: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.returns.update),
+    returnRefund: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.returns.returnRefund
+    )
   },
   fulfillmentOrders: {
-    prepare: endpoint(
-      "POST",
-      "/api/fulfillment-orders/prepare-fulfillment-order"
+    prepare: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.fulfillmentOrders.prepare
     )
   },
   fulfillments: {
-    bulkImport: endpoint("POST", "/api/fulfillments/bulk-import")
+    bulkImport: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.fulfillments.bulkImport
+    )
   },
   carts: {
     create: sharedEndpoint(COMMERCE_ENDPOINT_OPERATIONS.carts.create),
@@ -1601,42 +1659,21 @@ var COMMERCE_ENDPOINTS = {
       ),
       confirm: sharedEndpoint(
         COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.confirm
+      ),
+      findPortOne: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.findPortOne
+      ),
+      reconcilePortOne: sharedEndpoint(
+        COMMERCE_ENDPOINT_OPERATIONS.paymentSessions.server.reconcilePortOne
       )
     }
   },
   shippingPolicies: {
-    calculate: endpoint("POST", "/api/shipping-policies/calculate")
+    calculate: sharedEndpoint(
+      COMMERCE_ENDPOINT_OPERATIONS.shippingPolicies.calculate
+    )
   }
 };
-function isCommerceEndpointDescriptor(value) {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return typeof candidate.method === "string" && typeof candidate.path === "string";
-}
-function flattenEndpointPaths(value) {
-  if (isCommerceEndpointDescriptor(value)) return [resolveOperationPath2(value)];
-  if (!value || typeof value !== "object") return [];
-  return Object.values(value).flatMap((entry) => flattenEndpointPaths(entry));
-}
-function flattenEndpointDescriptors(value) {
-  if (isCommerceEndpointDescriptor(value)) return [value];
-  if (!value || typeof value !== "object") return [];
-  return Object.values(value).flatMap(
-    (entry) => flattenEndpointDescriptors(entry)
-  );
-}
-var COMMERCE_ENDPOINT_PATHS = flattenEndpointPaths(COMMERCE_ENDPOINTS);
-var COMMERCE_ENDPOINT_DESCRIPTORS = flattenEndpointDescriptors(COMMERCE_ENDPOINTS);
-var MEMBERSHIP_ENDPOINTS = {
-  subscribe: "/api/memberships/subscribe",
-  cancel: (id) => `/api/memberships/${id}/cancel`,
-  me: "/api/memberships/me"
-};
-var MEMBERSHIP_ENDPOINT_PATHS = [
-  MEMBERSHIP_ENDPOINTS.subscribe,
-  MEMBERSHIP_ENDPOINTS.cancel(":id"),
-  MEMBERSHIP_ENDPOINTS.me
-];
 
 // src/core/api/customer-scoped-api.ts
 var CustomerScopedTransport = class {
@@ -1657,10 +1694,10 @@ var CustomerScopedTransport = class {
     this.onUnauthorized = options.onUnauthorized;
     this.onRequestId = options.onRequestId;
   }
-  async request(endpoint2, options) {
+  async request(endpoint, options) {
     const token = typeof this.customerToken === "function" ? this.customerToken() : this.customerToken;
     try {
-      const response = await httpFetch(endpoint2, {
+      const response = await httpFetch(endpoint, {
         method: options.method,
         apiUrl: this.apiUrl,
         publishableKey: this.publishableKey,
@@ -1674,7 +1711,7 @@ var CustomerScopedTransport = class {
         ...options.errorFamily && { errorFamily: options.errorFamily }
       });
       this.onRequestId?.(response.headers.get("x-request-id") ?? null);
-      return parseApiResponse(response, endpoint2, {
+      return parseApiResponse(response, endpoint, {
         errorFamily: options.errorFamily
       });
     } catch (err) {
@@ -1688,12 +1725,12 @@ var CustomerScopedApi = class {
   constructor(apiName, options) {
     this.transport = new CustomerScopedTransport(apiName, options);
   }
-  requestEndpoint(endpoint2, body, options) {
-    return this.transport.request(resolveOperationPath2(endpoint2, options), {
-      method: resolveOperationMethod2(endpoint2),
+  requestEndpoint(endpoint, body, options) {
+    return this.transport.request(resolveOperationPath(endpoint, options), {
+      method: resolveOperationMethod(endpoint),
       body,
       headers: options?.headers,
-      errorFamily: resolveOperationErrorFamily(endpoint2)
+      errorFamily: resolveOperationErrorFamily(endpoint)
     });
   }
 };
@@ -1701,8 +1738,8 @@ var RawCustomerScopedApi = class {
   constructor(apiName, options) {
     this.transport = new CustomerScopedTransport(apiName, options);
   }
-  request(endpoint2, options) {
-    return this.transport.request(endpoint2, options);
+  request(endpoint, options) {
+    return this.transport.request(endpoint, options);
   }
 };
 
@@ -1777,11 +1814,11 @@ var CommunityClient = class extends RawCustomerScopedApi {
     if (params.page !== void 0) urlParams.set("page", String(params.page));
     return `/api/comments/public?${urlParams.toString()}`;
   }
-  async execute(endpoint2, method, body) {
-    return this.request(endpoint2, { method, body });
+  async execute(endpoint, method, body) {
+    return this.request(endpoint, { method, body });
   }
-  async executeDoc(endpoint2, method, body) {
-    const response = await this.execute(endpoint2, method, body);
+  async executeDoc(endpoint, method, body) {
+    const response = await this.execute(endpoint, method, body);
     return unwrapPayloadDoc(response);
   }
   createPost(params) {
@@ -2047,8 +2084,8 @@ var CommunityClient = class extends RawCustomerScopedApi {
 
 // src/core/content/content-client.ts
 var PublicContentApi = class extends RawCustomerScopedApi {
-  get(endpoint2) {
-    return this.request(endpoint2, { method: "GET" });
+  get(endpoint) {
+    return this.request(endpoint, { method: "GET" });
   }
 };
 function appendCommonParams(search, options, defaultSort) {
@@ -2146,7 +2183,10 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
 ];
 var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
 var ABANDONED_REASONS = ["expired", "customer", "operator"];
-var PAYMENT_PROVIDERS = ["toss", "portone"];
+function managedPaymentProviders(providers) {
+  return providers;
+}
+var PAYMENT_PROVIDERS = managedPaymentProviders(["toss", "portone"]);
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2194,6 +2234,26 @@ function invalidCanonicalResponse(resource, details) {
 function fail(resource, path, expected) {
   invalidCanonicalResponse(resource, { path, expected });
 }
+function providerMismatch(resource, expected, actual, operation2) {
+  if (operation2 === "cancel") {
+    const method = {
+      toss: "cancel()",
+      portone: "cancelPortOne()"
+    }[actual];
+    throw createApiError(
+      `Canonical ${resource} response provider mismatch: expected ${expected}, received ${actual}.`,
+      502,
+      { resource, path: "$.provider", expected, actual },
+      `The server applied the cancellation to a ${actual} PaymentSession, but this SDK method expects ${expected}.`,
+      `Re-invoke ${method} with the same idempotencyKey; do not create a new key.`
+    );
+  }
+  invalidCanonicalResponse(resource, {
+    path: "$.provider",
+    expected,
+    actual
+  });
+}
 function record(value, resource, path) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     fail(resource, path, "object");
@@ -2229,6 +2289,9 @@ function nullableString(value, resource, path) {
     fail(resource, path, "string or null");
   }
 }
+function nullableNonEmptyString(value, resource, path) {
+  if (value !== null) string(value, resource, path);
+}
 function cartLineQuantity(value, resource, path) {
   const quantity = positiveInteger(value, resource, path);
   if (quantity > MAX_CART_LINE_QUANTITY) {
@@ -2738,8 +2801,8 @@ function validatePublicOrderItem(value, resource, path) {
     validateReference(item.variant, resource, `${path}.variant`);
   }
   string(item.productTitle, resource, `${path}.productTitle`);
-  nullableString(item.variantTitle, resource, `${path}.variantTitle`);
-  nullableString(item.sku, resource, `${path}.sku`);
+  nullableNonEmptyString(item.variantTitle, resource, `${path}.variantTitle`);
+  nullableNonEmptyString(item.sku, resource, `${path}.sku`);
   validateAdmissions(item.admissions, resource, `${path}.admissions`);
   const quantity = positiveInteger(item.quantity, resource, `${path}.quantity`);
   const unitPrice = safeMinor(
@@ -2990,8 +3053,8 @@ function validateCheckoutItem(value, resource, path) {
   validateReference(item.product, resource, `${path}.product`);
   validateReference(item.variant, resource, `${path}.variant`);
   string(item.productTitle, resource, `${path}.productTitle`);
-  nullableString(item.variantTitle, resource, `${path}.variantTitle`);
-  nullableString(item.sku, resource, `${path}.sku`);
+  nullableNonEmptyString(item.variantTitle, resource, `${path}.variantTitle`);
+  nullableNonEmptyString(item.sku, resource, `${path}.sku`);
   validateAdmissions(item.admissions, resource, `${path}.admissions`);
   cartLineQuantity(item.quantity, resource, `${path}.quantity`);
   const unitPrice = safeMinor(
@@ -3323,11 +3386,21 @@ function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
   if (provider === "portone") {
     if (action.type === "portone_sdk") {
+      const hasCancelable = "cancelable" in action;
+      const hasRetryPolicy = "retryPolicy" in action;
+      if (hasCancelable !== hasRetryPolicy) {
+        fail(
+          resource,
+          path,
+          "exact released action or exact negotiated capability action"
+        );
+      }
       exact(
         action,
         [
           "type",
           "version",
+          ...hasCancelable ? ["cancelable", "retryPolicy"] : [],
           "storeId",
           "channelKey",
           "paymentId",
@@ -3342,6 +3415,11 @@ function validateNextAction(value, provider, resource, path) {
         path
       );
       if (action.version !== "v2") fail(resource, `${path}.version`, "v2");
+      if (hasCancelable && action.cancelable !== false)
+        fail(resource, `${path}.cancelable`, "false");
+      if (hasRetryPolicy && action.retryPolicy !== "same_action_only") {
+        fail(resource, `${path}.retryPolicy`, "same_action_only");
+      }
       for (const key of ["storeId", "channelKey"]) {
         boundedString(action[key], 255, resource, `${path}.${key}`);
       }
@@ -3388,6 +3466,10 @@ function validateNextAction(value, provider, resource, path) {
           "HTTPS or loopback URL without embedded credentials"
         );
       }
+      if (!hasCancelable) {
+        action.cancelable = false;
+        action.retryPolicy = "same_action_only";
+      }
       return;
     }
     exact(action, ["type", "checkoutUrl"], [], resource, path);
@@ -3464,7 +3546,7 @@ function validateNextAction(value, provider, resource, path) {
   if (action.customerEmail !== void 0)
     validateCustomer({ email: action.customerEmail }, resource, path);
 }
-function validatePublicPaymentSession(value, expectedProvider) {
+function validatePublicPaymentSession(value, expectedProvider, operation2) {
   const resource = "PaymentSession";
   const session = record(value, resource, "$");
   const provider = enumValue(
@@ -3473,9 +3555,6 @@ function validatePublicPaymentSession(value, expectedProvider) {
     resource,
     "$.provider"
   );
-  if (expectedProvider !== void 0 && provider !== expectedProvider) {
-    fail(resource, "$.provider", expectedProvider);
-  }
   const status = enumValue(
     session.providerStatus,
     PAYMENT_PROVIDER_STATUSES,
@@ -3679,44 +3758,128 @@ function validatePublicPaymentSession(value, expectedProvider) {
       "$.cancellationReason"
     );
   }
+  if (expectedProvider !== void 0 && provider !== expectedProvider) {
+    if (operation2 === "cancel" && status !== "canceling" && status !== "canceled") {
+      fail(
+        resource,
+        "$.providerStatus",
+        "canceling or canceled after a successful cancellation"
+      );
+    }
+    providerMismatch(resource, expectedProvider, provider, operation2);
+  }
   return value;
 }
 
 // src/core/customer/customer-auth.ts
 var DEFAULT_TIMEOUT2 = 15e3;
-function safeGetItem(key) {
+var REFRESH_LOCK_TIMEOUT = DEFAULT_TIMEOUT2 * 3;
+var SESSION_RECORD_VERSION = 1;
+var STORAGE_UNUSABLE = /* @__PURE__ */ Symbol("storage-unusable");
+function canonicalApiIdentity(apiUrl) {
   try {
-    return localStorage.getItem(key);
+    const url = new URL(apiUrl);
+    return `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return apiUrl.trim().toLowerCase().replace(/\/+$/, "");
+  }
+}
+function buildRefreshLockName(apiUrl, publishableKey, storageKey) {
+  return `01software:customer-auth-refresh:${canonicalApiIdentity(apiUrl)}:${publishableKey}:${storageKey}`;
+}
+function getRefreshLockRequester() {
+  try {
+    if (typeof navigator === "undefined") return null;
+    const locks = navigator.locks;
+    if (!locks || typeof locks.request !== "function") return null;
+    return (name, options, callback) => locks.request(
+      name,
+      options,
+      () => callback()
+    );
   } catch {
     return null;
   }
 }
+function parseSessionRecord(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return null;
+    const candidate = parsed;
+    if (candidate.v !== SESSION_RECORD_VERSION) return null;
+    if (typeof candidate.rev !== "number" || !Number.isFinite(candidate.rev)) {
+      return null;
+    }
+    const token = candidate.token;
+    const refreshToken = candidate.refreshToken;
+    if (token !== null && typeof token !== "string") return null;
+    if (refreshToken !== null && typeof refreshToken !== "string") return null;
+    return {
+      v: SESSION_RECORD_VERSION,
+      rev: candidate.rev,
+      token,
+      refreshToken
+    };
+  } catch {
+    return null;
+  }
+}
+function readSessionRecord(recordKey, mirrorKey, mirrorRefreshKey) {
+  let raw;
+  try {
+    raw = localStorage.getItem(recordKey);
+  } catch {
+    return STORAGE_UNUSABLE;
+  }
+  if (raw !== null) {
+    const parsed = parseSessionRecord(raw);
+    return parsed ? { record: parsed, stored: true } : STORAGE_UNUSABLE;
+  }
+  try {
+    return {
+      record: {
+        v: SESSION_RECORD_VERSION,
+        rev: 0,
+        token: localStorage.getItem(mirrorKey),
+        refreshToken: localStorage.getItem(mirrorRefreshKey)
+      },
+      stored: false
+    };
+  } catch {
+    return STORAGE_UNUSABLE;
+  }
+}
 var CustomerAuth = class {
   constructor(publishableKey, options, apiUrl) {
     this.refreshPromise = null;
+    /** Canonical record key; null unless persistence is active in a browser. */
+    this.persistRecordKey = null;
+    /** Advisory single-value access mirror, plus the retired refresh mirror. */
+    this.persistMirrorKey = null;
+    this.persistMirrorRefreshKey = null;
+    /** Cross-context refresh lock name; null when there is no shared storage. */
+    this.refreshLockName = null;
+    /** Revision of the canonical record this instance last observed. */
+    this.sessionRev = 0;
     this.publishableKey = publishableKey;
     this.baseUrl = resolveApiUrl(apiUrl);
     const persist = options?.persist ?? true;
     if (persist) {
       const key = typeof persist === "string" ? persist : "customer-token";
-      const refreshKey = `${key}:refresh`;
       const isBrowser = typeof window !== "undefined";
-      this.token = isBrowser ? safeGetItem(key) : null;
-      this.refreshTokenValue = isBrowser ? safeGetItem(refreshKey) : null;
-      this.onTokenChange = isBrowser ? (token) => {
-        try {
-          if (token) localStorage.setItem(key, token);
-          else localStorage.removeItem(key);
-        } catch {
-        }
-      } : void 0;
-      this.onRefreshTokenChange = isBrowser ? (refreshToken) => {
-        try {
-          if (refreshToken) localStorage.setItem(refreshKey, refreshToken);
-          else localStorage.removeItem(refreshKey);
-        } catch {
-        }
-      } : void 0;
+      this.token = null;
+      this.refreshTokenValue = null;
+      if (isBrowser) {
+        this.persistRecordKey = `${key}:session`;
+        this.persistMirrorKey = key;
+        this.persistMirrorRefreshKey = `${key}:refresh`;
+        this.refreshLockName = buildRefreshLockName(
+          this.baseUrl,
+          publishableKey,
+          key
+        );
+        this.syncFromPersistedStorage();
+      }
     } else {
       this.token = options?.token ?? null;
       this.refreshTokenValue = options?.refreshToken ?? null;
@@ -3744,66 +3907,299 @@ var CustomerAuth = class {
         body: JSON.stringify(data)
       }
     );
-    this.setToken(result.token);
-    if (result.refreshToken) this.setRefreshToken(result.refreshToken);
+    if (result.refreshToken) this.setSession(result.token, result.refreshToken);
+    else this.setToken(result.token);
     return result;
   }
   /**
    * Refresh the current token. Uses a refresh token when available, otherwise
    * falls back to the legacy bearer-token compatibility path.
+   *
+   * Refresh tokens are single-use, so a persisted session shared by several
+   * tabs or SDK instances must rotate at most once: concurrent rotations of the
+   * same token are replay from the server's point of view and revoke the whole
+   * family. Persisted browser sessions therefore serialize rotation across
+   * contexts and re-read the canonical persisted credentials inside the lock.
    */
   async refreshToken() {
+    this.syncFromPersistedStorage();
     if (!this.refreshTokenValue && !this.token) {
       throw new ApiError("Not authenticated", 401);
     }
     if (this.refreshPromise) return this.refreshPromise;
-    this.refreshPromise = this._doRefreshToken();
+    const intended = this.currentFence();
+    this.refreshPromise = this.rotateAcrossContexts(intended);
     try {
       return await this.refreshPromise;
     } finally {
       this.refreshPromise = null;
     }
   }
-  async _doRefreshToken() {
-    const init = this.refreshTokenValue ? {
+  /**
+   * Re-read the canonical persisted session. In persisted mode the shared
+   * record — not this instance's memory — is the source of truth, so another
+   * context's rotation, login, or logout is observed before the next credential
+   * use. Change callbacks are deliberately not invoked: this is a read.
+   */
+  syncFromPersistedStorage() {
+    const canonical = this.readCanonicalSession();
+    if (canonical === STORAGE_UNUSABLE) {
+      this.disablePersistence();
+      return;
+    }
+    if (!canonical) return;
+    this.sessionRev = canonical.record.rev;
+    this.token = canonical.record.token;
+    this.refreshTokenValue = canonical.record.refreshToken;
+  }
+  /** `null` when this instance does not persist. */
+  readCanonicalSession() {
+    if (!this.persistRecordKey || !this.persistMirrorKey || !this.persistMirrorRefreshKey) {
+      return null;
+    }
+    return readSessionRecord(
+      this.persistRecordKey,
+      this.persistMirrorKey,
+      this.persistMirrorRefreshKey
+    );
+  }
+  /**
+   * Publish a change to canonical storage.
+   *
+   * The canonical pair is re-read immediately before the single record write so
+   * that a field this call does not change is taken from that read rather than
+   * from this instance's possibly stale copy. That merge is BEST-EFFORT: it
+   * removes the stale counterpart an instance would otherwise carry, but it is
+   * not a compare-and-swap. Web Storage offers none, and the synchronous public
+   * mutators cannot await the refresh lease, so a commit that lands between
+   * this read and the store operation is lost by ordering — including the
+   * counterpart just read, which is then republished stale. The window is one
+   * store operation wide and the server remains authoritative; see
+   * `CUST-AUTH-033` for the stated limit.
+   *
+   * Returns `false` only when `requireLiveSession` refused a write because the
+   * canonical session had already been cleared.
+   */
+  commitPersistedSession(change, options) {
+    const recordKey = this.persistRecordKey;
+    const mirrorKey = this.persistMirrorKey;
+    const mirrorRefreshKey = this.persistMirrorRefreshKey;
+    const canonical = this.readCanonicalSession();
+    if (canonical === null || !recordKey || !mirrorKey || !mirrorRefreshKey) {
+      return true;
+    }
+    if (canonical === STORAGE_UNUSABLE) {
+      this.disablePersistence();
+      return true;
+    }
+    const current = canonical.record;
+    if (options?.requireLiveSession && !current.token && !current.refreshToken) {
+      return false;
+    }
+    const next = {
+      v: SESSION_RECORD_VERSION,
+      rev: current.rev + 1,
+      token: "token" in change ? change.token ?? null : current.token,
+      refreshToken: "refreshToken" in change ? change.refreshToken ?? null : current.refreshToken
+    };
+    if (
+      // Only a state that is genuinely persisted can already say what this
+      // write would say. An absent record reads as an empty pair, and treating
+      // that as a no-op would drop the very tombstone that stops a later
+      // migration from resurrecting the session out of the earlier layout.
+      canonical.stored && next.token === current.token && next.refreshToken === current.refreshToken
+    ) {
+      this.sessionRev = current.rev;
+      this.token = current.token;
+      this.refreshTokenValue = current.refreshToken;
+      return true;
+    }
+    try {
+      localStorage.setItem(recordKey, JSON.stringify(next));
+    } catch {
+      this.disablePersistence();
+      return true;
+    }
+    this.sessionRev = next.rev;
+    this.token = next.token;
+    this.refreshTokenValue = next.refreshToken;
+    try {
+      localStorage.removeItem(mirrorRefreshKey);
+    } catch {
+      return true;
+    }
+    try {
+      if (next.token) localStorage.setItem(mirrorKey, next.token);
+      else localStorage.removeItem(mirrorKey);
+    } catch {
+    }
+    return true;
+  }
+  /**
+   * Storage rejected a write or a read, so it is not a canonical store for this
+   * instance. Fall back to the memory-only session and take no lease: there is
+   * no shared state left to coordinate. Nothing is purged — the record commit
+   * is atomic, so no inconsistent state was published, and another context's
+   * valid session must not be destroyed by this instance's local failure.
+   */
+  disablePersistence() {
+    this.persistRecordKey = null;
+    this.persistMirrorKey = null;
+    this.persistMirrorRefreshKey = null;
+    this.refreshLockName = null;
+  }
+  /**
+   * Compare the canonical record with the fence this call captured before it
+   * left. Every persisted decision — rotate, converge, or fail closed — goes
+   * through this one comparison. The revision catches a logout, a fresh login,
+   * or a manual setter even when token values coincide; the value comparison
+   * additionally catches a mirror-only writer that cannot bump a revision.
+   */
+  classifyCanonicalState(intended) {
+    if (!this.persistRecordKey) return "current";
+    this.syncFromPersistedStorage();
+    if (!this.persistRecordKey) return "current";
+    if (!this.token && !this.refreshTokenValue) return "cleared";
+    if (intended.refreshToken !== null) {
+      return this.refreshTokenValue === intended.refreshToken ? "current" : "superseded";
+    }
+    return this.token === intended.token && !this.refreshTokenValue ? "current" : "superseded";
+  }
+  /** The canonical persisted pair, as a refresh result. */
+  canonicalPair(token) {
+    return {
+      token,
+      ...this.refreshTokenValue ? { refreshToken: this.refreshTokenValue } : {}
+    };
+  }
+  /** Current credentials plus the revision they were observed at. */
+  currentFence() {
+    return { token: this.token, refreshToken: this.refreshTokenValue };
+  }
+  /**
+   * Clear an access credential a 401 just proved unusable — but only while it
+   * is still the canonical one. A rotation committed by another context while
+   * the request was in flight is newer than this 401, so it must survive; the
+   * instance adopts it instead. The refresh entry is never touched here: a
+   * rejected access token says nothing about the refresh family.
+   */
+  invalidateAccessToken(spentToken) {
+    this.syncFromPersistedStorage();
+    if (this.token !== spentToken) return;
+    this.setToken(null);
+  }
+  /** Commit both credentials in one canonical write. */
+  setSession(token, refreshToken, options) {
+    this.token = token;
+    this.refreshTokenValue = refreshToken;
+    const committed = this.commitPersistedSession(
+      { token, refreshToken },
+      options
+    );
+    if (!committed) return false;
+    this.onTokenChange?.(this.token);
+    this.onRefreshTokenChange?.(this.refreshTokenValue);
+    return true;
+  }
+  /**
+   * Serialize rotation against every other context sharing the same storage
+   * key and API/tenant identity. Coordination is best-effort: when it is
+   * unavailable or times out the rotation still happens, so server-side reuse
+   * detection is never bypassed by a client that failed to coordinate.
+   */
+  async rotateAcrossContexts(intended) {
+    const lockName = this.refreshLockName;
+    const requestLock = lockName ? getRefreshLockRequester() : null;
+    if (!lockName || !requestLock) {
+      return this.rotateWithCanonicalState(intended);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REFRESH_LOCK_TIMEOUT);
+    let entered = false;
+    try {
+      return await requestLock(
+        lockName,
+        { signal: controller.signal },
+        async () => {
+          entered = true;
+          return this.rotateWithCanonicalState(intended);
+        }
+      );
+    } catch (error) {
+      if (entered) throw error;
+      return this.rotateWithCanonicalState(intended);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Decide, against freshly re-read canonical state, whether this context still
+   * owns the rotation.
+   */
+  async rotateWithCanonicalState(intended) {
+    let fence = intended;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const state = this.classifyCanonicalState(fence);
+      if (state === "cleared") throw new ApiError("Not authenticated", 401);
+      if (state === "current") return this._doRefreshToken(fence);
+      if (this.token) return this.canonicalPair(this.token);
+      fence = this.currentFence();
+    }
+    throw new ApiError("Not authenticated", 401);
+  }
+  async _doRefreshToken(intended) {
+    const init = intended.refreshToken ? {
       method: "POST",
-      body: JSON.stringify({ refreshToken: this.refreshTokenValue })
+      body: JSON.stringify({ refreshToken: intended.refreshToken })
     } : {
       method: "POST",
-      headers: { Authorization: `Bearer ${this.token}` }
+      headers: { Authorization: `Bearer ${intended.token}` }
     };
     const result = await this.requestJson(
       "/api/customers/refresh",
       init
     );
-    this.setToken(result.token);
-    if (result.refreshToken) this.setRefreshToken(result.refreshToken);
-    return result;
+    const state = this.classifyCanonicalState(intended);
+    if (state === "cleared") throw new ApiError("Not authenticated", 401);
+    if (state === "superseded") {
+      if (this.token) return this.canonicalPair(this.token);
+      throw new ApiError("Not authenticated", 401);
+    }
+    const replacedAccessToken = this.token !== null && this.token !== intended.token ? this.token : null;
+    const nextToken = replacedAccessToken ?? result.token;
+    const nextRefresh = result.refreshToken ?? null;
+    if (!this.setSession(nextToken, nextRefresh, { requireLiveSession: true })) {
+      throw new ApiError("Not authenticated", 401);
+    }
+    return {
+      token: nextToken,
+      ...nextRefresh ? { refreshToken: nextRefresh } : {}
+    };
   }
   /**
    * Clear the stored token
    */
   logout() {
-    this.setToken(null);
-    this.setRefreshToken(null);
+    this.setSession(null, null);
   }
   /**
    * Get the current authenticated customer's profile
    */
   async me() {
-    if (!this.token) return null;
+    const token = this.getToken();
+    if (!token) return null;
     try {
       const data = await this.requestJson(
         "/api/customers/me",
         {
           method: "GET",
-          headers: { Authorization: `Bearer ${this.token}` }
+          headers: { Authorization: `Bearer ${token}` }
         }
       );
       return data.customer ?? null;
     } catch (error) {
       if (error instanceof SDKError && error.status === 401) {
-        this.setToken(null);
+        this.invalidateAccessToken(token);
         return null;
       }
       throw error;
@@ -3831,12 +4227,13 @@ var CustomerAuth = class {
    * Update the authenticated customer's profile (name, phone, marketingConsent)
    */
   async updateProfile(data) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     const result = await this.requestJson(
       "/api/customers/me",
       {
         method: "PATCH",
-        headers: { Authorization: `Bearer ${this.token}` },
+        headers: { Authorization: `Bearer ${token}` },
         body: JSON.stringify(data)
       }
     );
@@ -3846,10 +4243,11 @@ var CustomerAuth = class {
    * Change the password of the currently authenticated customer
    */
   async changePassword(currentPassword, newPassword) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     await this.requestJson("/api/customers/change-password", {
       method: "POST",
-      headers: { Authorization: `Bearer ${this.token}` },
+      headers: { Authorization: `Bearer ${token}` },
       body: JSON.stringify({ currentPassword, newPassword })
     });
   }
@@ -3857,7 +4255,8 @@ var CustomerAuth = class {
    * Get the authenticated customer's orders with pagination and optional status filter
    */
   async getMyOrders(options) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     const params = new URLSearchParams();
     if (options?.page) params.set("page", String(options.page));
     if (options?.limit) params.set("limit", String(options.limit));
@@ -3879,21 +4278,27 @@ var CustomerAuth = class {
       `/api/customers/me/orders${qs ? `?${qs}` : ""}`,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${this.token}` }
+        headers: { Authorization: `Bearer ${token}` }
       }
     );
     return validatePublicOrderList(result);
   }
   /**
-   * Get the current token (or null if not authenticated)
+   * Get the current token (or null if not authenticated).
+   *
+   * In persisted mode this re-reads shared storage first, so a rotation or
+   * logout performed by another tab is observed before the token is used.
    */
   getToken() {
+    this.syncFromPersistedStorage();
     return this.token;
   }
   /**
-   * Get the current refresh token (or null if unavailable)
+   * Get the current refresh token (or null if unavailable). Persisted mode
+   * re-reads shared storage first, like {@link CustomerAuth.getToken}.
    */
   getRefreshToken() {
+    this.syncFromPersistedStorage();
     return this.refreshTokenValue;
   }
   /**
@@ -3901,6 +4306,7 @@ var CustomerAuth = class {
    */
   setToken(token) {
     this.token = token;
+    this.commitPersistedSession({ token });
     this.onTokenChange?.(token);
   }
   /**
@@ -3908,13 +4314,14 @@ var CustomerAuth = class {
    */
   setRefreshToken(refreshToken) {
     this.refreshTokenValue = refreshToken;
+    this.commitPersistedSession({ refreshToken });
     this.onRefreshTokenChange?.(refreshToken);
   }
   /**
    * Check if the customer is currently authenticated
    */
   isAuthenticated() {
-    return this.token !== null;
+    return this.getToken() !== null;
   }
   /**
    * Internal: make a request with timeout and error handling.
@@ -4122,8 +4529,8 @@ var CartApi = class extends CustomerScopedApi {
   endpoint(key) {
     return this.serverTransport ? COMMERCE_ENDPOINTS.carts.server[key] : COMMERCE_ENDPOINTS.carts[key];
   }
-  execute(endpoint2, body, idempotencyKey) {
-    return this.requestEndpoint(endpoint2, body, {
+  execute(endpoint, body, idempotencyKey) {
+    return this.requestEndpoint(endpoint, body, {
       ...idempotencyKey && {
         headers: { "X-Idempotency-Key": idempotencyKey }
       }
@@ -4140,26 +4547,26 @@ var CartApi = class extends CustomerScopedApi {
     );
   }
   mine(params = {}) {
-    const endpoint2 = this.endpoint("mine");
-    return this.execute(endpoint2, params).then(
+    const endpoint = this.endpoint("mine");
+    return this.execute(endpoint, params).then(
       (value) => validateCartMineResult(value)
     );
   }
   merge(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
-    const endpoint2 = this.endpoint("merge");
-    return this.execute(endpoint2, body, idempotencyKey).then(
+    const endpoint = this.endpoint("merge");
+    return this.execute(endpoint, body, idempotencyKey).then(
       (value) => validateCartMergeResult(value)
     );
   }
   addItem(params) {
     return this.mutate(this.endpoint("addItem"), params);
   }
-  mutate(endpoint2, params) {
+  mutate(endpoint, params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
-    return this.execute(endpoint2, body, idempotencyKey).then(
+    return this.execute(endpoint, body, idempotencyKey).then(
       (value) => validateCartMutationResult(value)
     );
   }
@@ -4185,8 +4592,8 @@ var CheckoutApi = class extends CustomerScopedApi {
   constructor(options) {
     super("CheckoutApi", { ...options, requiresCredential: false });
   }
-  post(endpoint2, body, idempotencyKey) {
-    return this.requestEndpoint(endpoint2, body, {
+  post(endpoint, body, idempotencyKey) {
+    return this.requestEndpoint(endpoint, body, {
       ...idempotencyKey && {
         headers: { "X-Idempotency-Key": idempotencyKey }
       }
@@ -4253,15 +4660,23 @@ var PaymentSessionApi = class extends CustomerScopedApi {
     super("PaymentSessionApi", { ...options, requiresCredential: false });
     this.serverTransport = Boolean(options.secretKey);
   }
-  post(endpoint2, body, idempotencyKey) {
-    return this.requestEndpoint(endpoint2, body, {
-      ...idempotencyKey && {
-        headers: { "X-Idempotency-Key": idempotencyKey }
+  post(endpoint, body, idempotencyKey, negotiateStandardActionCapabilities = false) {
+    const headers = {
+      ...idempotencyKey && { "X-Idempotency-Key": idempotencyKey },
+      ...negotiateStandardActionCapabilities && {
+        Accept: PORTONE_STANDARD_ACTION_CAPABILITIES_MEDIA_TYPE
       }
+    };
+    return this.requestEndpoint(endpoint, body, {
+      ...Object.keys(headers).length > 0 && { headers }
     });
   }
-  async paymentSession(result, expectedProvider) {
-    return validatePublicPaymentSession(await result, expectedProvider);
+  async paymentSession(result, expectedProvider, operation2) {
+    return validatePublicPaymentSession(
+      await result,
+      expectedProvider,
+      operation2
+    );
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
@@ -4282,41 +4697,44 @@ var PaymentSessionApi = class extends CustomerScopedApi {
       this.post(
         this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.create : COMMERCE_ENDPOINTS.paymentSessions.create,
         body,
-        idempotencyKey
+        idempotencyKey,
+        body.providerOptions.profile === "standard_v2"
       ),
       "portone"
     );
   }
   retrieve(params) {
-    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
+    const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
     return this.paymentSession(
-      this.post(endpoint2, params),
+      this.post(endpoint, params),
       "toss"
     );
   }
   retrievePortOne(params) {
-    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
+    const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.retrieve : COMMERCE_ENDPOINTS.paymentSessions.retrieve;
     return this.paymentSession(
-      this.post(endpoint2, params),
+      this.post(endpoint, params, void 0, true),
       "portone"
     );
   }
   cancel(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
-    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
+    const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
     return this.paymentSession(
-      this.post(endpoint2, body, idempotencyKey),
-      "toss"
+      this.post(endpoint, body, idempotencyKey),
+      "toss",
+      "cancel"
     );
   }
   cancelPortOne(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
-    const endpoint2 = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
+    const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
     return this.paymentSession(
-      this.post(endpoint2, body, idempotencyKey),
-      "portone"
+      this.post(endpoint, body, idempotencyKey),
+      "portone",
+      "cancel"
     );
   }
   confirm(params) {
@@ -4394,9 +4812,9 @@ function resolveVariantImageItems(variant, poolById) {
       if (pooled) resolved.push(pooled);
       continue;
     }
-    const mediaId2 = getMediaId(entry);
-    if (mediaId2) {
-      const pooled = poolById.get(mediaId2);
+    const mediaId = getMediaId(entry);
+    if (mediaId) {
+      const pooled = poolById.get(mediaId);
       if (pooled) {
         resolved.push(pooled);
       }
@@ -4587,11 +5005,11 @@ function getFirstMediaId(values) {
   }
   return null;
 }
-function inProductMediaPool(product, mediaId2) {
-  if (mediaId2 == null) return null;
+function inProductMediaPool(product, mediaId) {
+  if (mediaId == null) return null;
   const images = Array.isArray(product?.images) ? product.images : [];
   for (const image of images) {
-    if (extractEntityId(image) === mediaId2) return mediaId2;
+    if (extractEntityId(image) === mediaId) return mediaId;
   }
   return null;
 }
@@ -6172,8 +6590,8 @@ function isProductUpsertFieldValidationErrorBody(value) {
 
 // src/core/commerce/commerce-client.ts
 var BrowserCommerceApi = class extends CustomerScopedApi {
-  requestEndpoint(endpoint2, body, options) {
-    return super.requestEndpoint(endpoint2, body, options);
+  requestEndpoint(endpoint, body, options) {
+    return super.requestEndpoint(endpoint, body, options);
   }
 };
 var CommerceClient = class {
@@ -6373,11 +6791,11 @@ var EventsClient = class {
       { useCustomerAuth: false }
     );
   }
-  async execute(endpoint2, method, body, options = {}) {
+  async execute(endpoint, method, body, options = {}) {
     const useCustomerAuth = options.useCustomerAuth === true;
     const token = useCustomerAuth ? typeof this.customerToken === "function" ? this.customerToken() : this.customerToken : void 0;
     try {
-      const response = await httpFetch(endpoint2, {
+      const response = await httpFetch(endpoint, {
         method,
         apiUrl: this.apiUrl,
         publishableKey: this.publishableKey,
@@ -6386,7 +6804,7 @@ var EventsClient = class {
         ...body !== void 0 && { body: JSON.stringify(body) }
       });
       this.onRequestId?.(response.headers.get("x-request-id") ?? null);
-      return parseApiResponse(response, endpoint2);
+      return parseApiResponse(response, endpoint);
     } catch (err) {
       const id = err instanceof SDKError ? err.requestId ?? null : null;
       this.onRequestId?.(id);
@@ -6644,13 +7062,106 @@ function mergeProductDetailWithStock(catalog, snapshot) {
   };
 }
 
+// src/core/webhook/validation.ts
+function isValidWebhookEventData(data) {
+  if (typeof data !== "object" || data === null) return false;
+  const event = data;
+  return typeof event.collection === "string" && typeof event.operation === "string" && event.operation.length > 0 && typeof event.data === "object" && event.data !== null;
+}
+
+// src/core/webhook/receiver.ts
+async function verifySignature(rawBody, secret, signature, timestamp2, deliveryId) {
+  const encoder = new TextEncoder();
+  const signedPrefix = encoder.encode(`${timestamp2}.${deliveryId}.`);
+  const signedPayload = new Uint8Array(signedPrefix.length + rawBody.length);
+  signedPayload.set(signedPrefix);
+  signedPayload.set(rawBody, signedPrefix.length);
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  if (signature.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(signature)) {
+    return false;
+  }
+  const sigBytes = new Uint8Array(
+    (signature.match(/.{2}/g) ?? []).map((byte) => parseInt(byte, 16))
+  );
+  return crypto.subtle.verify("HMAC", key, sigBytes, signedPayload);
+}
+function timestampIsFresh(timestamp2, toleranceSeconds) {
+  if (!/^\d+$/.test(timestamp2)) return false;
+  const timestampMs = Number(timestamp2);
+  if (!Number.isFinite(timestampMs)) return false;
+  const skewMs = Math.abs(Date.now() - timestampMs);
+  return skewMs <= toleranceSeconds * 1e3;
+}
+var MAX_TOLERANCE_SECONDS = 86400;
+function toleranceIsValid(toleranceSeconds) {
+  return typeof toleranceSeconds === "number" && Number.isFinite(toleranceSeconds) && toleranceSeconds >= 0 && toleranceSeconds <= MAX_TOLERANCE_SECONDS;
+}
+async function processWebhookRequest(request, handler, verify) {
+  try {
+    const rawBody = new Uint8Array(await request.arrayBuffer());
+    const verificationFailure = await verify?.(rawBody);
+    if (verificationFailure) return verificationFailure;
+    const body = JSON.parse(new TextDecoder().decode(rawBody));
+    if (!isValidWebhookEventData(body)) {
+      return new Response(
+        JSON.stringify({ error: "Invalid webhook event format" }),
+        { status: 400, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    await handler(body);
+    return new Response(
+      JSON.stringify({ success: true, message: "Webhook processed" }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  } catch (error) {
+    console.error("Webhook processing error:", error);
+    return new Response(JSON.stringify({ error: "Internal server error" }), {
+      status: 500,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+}
+async function handleSignedWebhook(request, handler, options) {
+  const secret = options?.secret;
+  const configuredTolerance = options?.toleranceSeconds;
+  const toleranceSeconds = configuredTolerance ?? 300;
+  if (typeof secret !== "string" || secret.trim().length === 0) {
+    return new Response(
+      JSON.stringify({ error: "Webhook signing secret is not configured" }),
+      { status: 500, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  if (!toleranceIsValid(toleranceSeconds)) {
+    return new Response(
+      JSON.stringify({ error: "Webhook signature tolerance is not valid" }),
+      { status: 500, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  return processWebhookRequest(request, handler, async (rawBody) => {
+    const signature = request.headers.get("x-webhook-signature") || "";
+    const timestamp2 = request.headers.get("x-webhook-timestamp") || "";
+    const deliveryId = request.headers.get("x-webhook-delivery-id") || "";
+    const valid = Boolean(timestamp2 && deliveryId) && timestampIsFresh(timestamp2, toleranceSeconds) && await verifySignature(rawBody, secret, signature, timestamp2, deliveryId);
+    if (!valid) {
+      return new Response(
+        JSON.stringify({ error: "Invalid webhook signature" }),
+        { status: 401, headers: { "Content-Type": "application/json" } }
+      );
+    }
+  });
+}
+
 // src/core/webhook/index.ts
 var ORDER_CHANGED_EVENT_TYPE = "collection.orderChanged";
 var COMMERCE_NOTIFICATION_EVENT_TYPE = "commerce.notification";
 function isValidWebhookEvent(data) {
-  if (typeof data !== "object" || data === null) return false;
-  const obj = data;
-  return typeof obj.collection === "string" && typeof obj.operation === "string" && obj.operation.length > 0 && typeof obj.data === "object" && obj.data !== null;
+  return isValidWebhookEventData(data);
 }
 var COMMERCE_NOTIFICATION_OPERATION = "notification";
 var COMMERCE_NOTIFICATION_EVENTS = [
@@ -6662,7 +7173,13 @@ var COMMERCE_NOTIFICATION_EVENTS = [
   "returnApproved",
   "returnRejected",
   "returnCanceled",
-  "returnCompleted"
+  "returnCompleted",
+  "paymentReconciliationRequired",
+  "paymentRefundRequiresAttention",
+  "membershipActivated",
+  "membershipPastDue",
+  "membershipExpired",
+  "membershipCancelled"
 ];
 function isStringOrNumber(value) {
   return typeof value === "string" || typeof value === "number";
@@ -6692,18 +7209,29 @@ function isCommerceNotificationEventName(value) {
   return typeof value === "string" && COMMERCE_NOTIFICATION_EVENTS.includes(value);
 }
 function isCommerceNotificationSourceCollection(value) {
-  return value === "orders" || value === "fulfillments" || value === "returns";
+  return value === "orders" || value === "fulfillments" || value === "returns" || value === "payment-sessions" || value === "payment-refund-attempts" || value === "customer-memberships";
 }
 function isCommerceNotificationData(value) {
   if (!isRecord(value)) return false;
   if (value.source !== void 0 && (!isRecord(value.source) || !isCommerceNotificationSourceCollection(value.source.collection) || !isStringOrNumber(value.source.id))) {
     return false;
   }
-  return (value.orderId === void 0 || isStringOrNumber(value.orderId)) && (value.orderNumber === void 0 || typeof value.orderNumber === "string") && (value.status === void 0 || typeof value.status === "string") && (value.totalAmount === void 0 || typeof value.totalAmount === "number") && (value.currency === void 0 || typeof value.currency === "string") && (value.fulfillmentId === void 0 || isStringOrNumber(value.fulfillmentId)) && (value.fulfillmentStatus === void 0 || typeof value.fulfillmentStatus === "string") && (value.shippedAt === void 0 || typeof value.shippedAt === "string") && (value.returnId === void 0 || isStringOrNumber(value.returnId)) && (value.returnStatus === void 0 || typeof value.returnStatus === "string") && (value.refundAmount === void 0 || typeof value.refundAmount === "number") && (value.completedAt === void 0 || typeof value.completedAt === "string");
+  return (value.orderId === void 0 || isStringOrNumber(value.orderId)) && (value.orderNumber === void 0 || typeof value.orderNumber === "string") && (value.status === void 0 || typeof value.status === "string") && (value.totalAmount === void 0 || typeof value.totalAmount === "number") && (value.currency === void 0 || typeof value.currency === "string") && (value.fulfillmentId === void 0 || isStringOrNumber(value.fulfillmentId)) && (value.fulfillmentStatus === void 0 || typeof value.fulfillmentStatus === "string") && (value.shippedAt === void 0 || typeof value.shippedAt === "string") && (value.returnId === void 0 || isStringOrNumber(value.returnId)) && (value.returnStatus === void 0 || typeof value.returnStatus === "string") && (value.refundAmount === void 0 || typeof value.refundAmount === "number") && (value.completedAt === void 0 || typeof value.completedAt === "string") && (value.paymentSessionId === void 0 || typeof value.paymentSessionId === "string") && (value.checkoutId === void 0 || typeof value.checkoutId === "string") && (value.refundAttemptId === void 0 || typeof value.refundAttemptId === "string") && (value.reason === void 0 || typeof value.reason === "string") && (value.observedAt === void 0 || typeof value.observedAt === "string") && (value.providerObject === void 0 || isRecord(value.providerObject) && typeof value.providerObject.provider === "string" && (value.providerObject.kind === "payment" || value.providerObject.kind === "refund") && typeof value.providerObject.id === "string") && (value.money === void 0 || isRecord(value.money) && Number.isSafeInteger(value.money.amountMinor) && Number(value.money.amountMinor) > 0 && typeof value.money.currency === "string");
 }
 function isCommerceNotification(value) {
   if (!isRecord(value)) return false;
-  return isCommerceNotificationEventName(value.event) && typeof value.intentId === "string" && value.intentId.length > 0 && typeof value.dedupeKey === "string" && value.dedupeKey.length > 0 && (value.orderId === void 0 || typeof value.orderId === "string") && (value.fulfillmentId === void 0 || typeof value.fulfillmentId === "string") && (value.returnId === void 0 || typeof value.returnId === "string");
+  return isCommerceNotificationEventName(value.event) && typeof value.intentId === "string" && value.intentId.length > 0 && typeof value.dedupeKey === "string" && value.dedupeKey.length > 0 && (value.orderId === void 0 || typeof value.orderId === "string") && (value.fulfillmentId === void 0 || typeof value.fulfillmentId === "string") && (value.returnId === void 0 || typeof value.returnId === "string") && (value.paymentSessionId === void 0 || typeof value.paymentSessionId === "string") && (value.refundAttemptId === void 0 || typeof value.refundAttemptId === "string");
+}
+function isPaymentIncidentNotificationData(value, event) {
+  const reconciliation = event === "paymentReconciliationRequired";
+  const expectedCollection = reconciliation ? "payment-sessions" : "payment-refund-attempts";
+  const expectedStatus = reconciliation ? "reconciliation_required" : "requires_attention";
+  const expectedReason = reconciliation ? "orderless_capture" : "local_commit_ambiguous";
+  return value.source?.collection === expectedCollection && typeof value.source.id === "string" && value.source.id.length > 0 && typeof value.paymentSessionId === "string" && value.paymentSessionId.length > 0 && isRecord(value.providerObject) && typeof value.providerObject.provider === "string" && value.providerObject.provider.length > 0 && (value.providerObject.kind === "payment" || value.providerObject.kind === "refund") && typeof value.providerObject.id === "string" && value.providerObject.id.length > 0 && isRecord(value.money) && Number.isSafeInteger(value.money.amountMinor) && Number(value.money.amountMinor) > 0 && typeof value.money.currency === "string" && value.money.currency.length > 0 && value.status === expectedStatus && value.reason === expectedReason && typeof value.observedAt === "string" && value.observedAt.length > 0 && !Number.isNaN(Date.parse(value.observedAt)) && (value.checkoutId === void 0 || typeof value.checkoutId === "string" && value.checkoutId.length > 0) && (value.orderId === void 0 || typeof value.orderId === "string" && value.orderId.length > 0) && (reconciliation ? value.source.id === value.paymentSessionId && value.providerObject.kind === "payment" && value.refundAttemptId === void 0 : typeof value.refundAttemptId === "string" && value.refundAttemptId.length > 0 && value.source.id === value.refundAttemptId);
+}
+function isMembershipNotificationData(value, event) {
+  const expectedStatus = event === "membershipActivated" ? "active" : event === "membershipPastDue" ? "past_due" : event === "membershipExpired" ? "expired" : "cancelled";
+  return typeof value.membershipId === "string" && value.membershipId.length > 0 && typeof value.planId === "string" && value.planId.length > 0 && typeof value.customerId === "string" && value.customerId.length > 0 && typeof value.fromStatus === "string" && value.fromStatus.length > 0 && value.fromStatus !== value.toStatus && value.toStatus === expectedStatus && typeof value.occurredAt === "string" && !Number.isNaN(Date.parse(value.occurredAt));
 }
 function isWebhookCommerceNotificationChange(value) {
   if (!isRecord(value)) return false;
@@ -6744,6 +7272,18 @@ function isCommerceNotificationWebhookEvent(event) {
     if (!matchesOptionalId(change.sourceId, sourceId)) return false;
   }
   const changeSourceId = isWebhookCommerceNotificationChange(change) ? change.sourceId : void 0;
+  if (notification.event === "paymentReconciliationRequired" || notification.event === "paymentRefundRequiresAttention") {
+    if (!isPaymentIncidentNotificationData(data, notification.event)) {
+      return false;
+    }
+    const incidentData = data;
+    const expectedCollection = notification.event === "paymentReconciliationRequired" ? "payment-sessions" : "payment-refund-attempts";
+    const notificationSourceId = notification.event === "paymentReconciliationRequired" ? notification.paymentSessionId : notification.refundAttemptId;
+    return sourceCollection === expectedCollection && typeof notification.paymentSessionId === "string" && notification.paymentSessionId === incidentData.paymentSessionId && typeof notificationSourceId === "string" && notificationSourceId === incidentData.source.id && matchesOptionalId(changeSourceId, incidentData.source.id);
+  }
+  if (notification.event === "membershipActivated" || notification.event === "membershipPastDue" || notification.event === "membershipExpired" || notification.event === "membershipCancelled") {
+    return sourceCollection === "customer-memberships" && isMembershipNotificationData(data, notification.event) && typeof notification.membershipId === "string" && notification.membershipId === data.membershipId && matchesOptionalId(changeSourceId, data.membershipId);
+  }
   if (notification.event === "orderPaid" || notification.event === "orderCanceled" || notification.event === "orderDelivered") {
     return sourceCollection === "orders" && typeof notification.orderId === "string" && notification.orderId.length > 0 && matchesOptionalId(data.orderId, sourceId) && matchesOptionalId(notification.orderId, sourceId) && matchesOptionalId(data.orderId, notification.orderId) && matchesOptionalId(changeSourceId, data.orderId ?? notification.orderId);
   }
@@ -6812,80 +7352,8 @@ function createCustomerAuthWebhookHandler(handlers) {
     await handlers.unhandled?.(event);
   };
 }
-async function verifySignature(payload, secret, signature, timestamp2, deliveryId) {
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  if (signature.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(signature)) {
-    return false;
-  }
-  const sigBytes = new Uint8Array(
-    (signature.match(/.{2}/g) ?? []).map((byte) => parseInt(byte, 16))
-  );
-  return crypto.subtle.verify(
-    "HMAC",
-    key,
-    sigBytes,
-    encoder.encode(`${timestamp2}.${deliveryId}.${payload}`)
-  );
-}
-function timestampIsFresh(timestamp2, toleranceSeconds) {
-  if (!/^\d+$/.test(timestamp2)) return false;
-  const timestampMs = Number(timestamp2);
-  if (!Number.isFinite(timestampMs)) return false;
-  const skewMs = Math.abs(Date.now() - timestampMs);
-  return skewMs <= toleranceSeconds * 1e3;
-}
 async function handleWebhook(request, handler, options) {
-  try {
-    const rawBody = await request.text();
-    if (options?.secret) {
-      const signature = request.headers.get("x-webhook-signature") || "";
-      const timestamp2 = request.headers.get("x-webhook-timestamp") || "";
-      const deliveryId = request.headers.get("x-webhook-delivery-id") || "";
-      const toleranceSeconds = options.toleranceSeconds ?? 300;
-      const valid = Boolean(timestamp2 && deliveryId) && timestampIsFresh(timestamp2, toleranceSeconds) && await verifySignature(
-        rawBody,
-        options.secret,
-        signature,
-        timestamp2,
-        deliveryId
-      );
-      if (!valid) {
-        return new Response(
-          JSON.stringify({ error: "Invalid webhook signature" }),
-          { status: 401, headers: { "Content-Type": "application/json" } }
-        );
-      }
-    } else {
-      console.warn(
-        "[@01.software/sdk] Webhook signature verification is disabled. Set { secret } in handleWebhook() options to enable HMAC-SHA256 verification."
-      );
-    }
-    const body = JSON.parse(rawBody);
-    if (!isValidWebhookEvent(body)) {
-      return new Response(
-        JSON.stringify({ error: "Invalid webhook event format" }),
-        { status: 400, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    await handler(body);
-    return new Response(
-      JSON.stringify({ success: true, message: "Webhook processed" }),
-      { status: 200, headers: { "Content-Type": "application/json" } }
-    );
-  } catch (error) {
-    console.error("Webhook processing error:", error);
-    return new Response(JSON.stringify({ error: "Internal server error" }), {
-      status: 500,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
+  return handleSignedWebhook(request, handler, options);
 }
 function createTypedWebhookHandler(collection, handler) {
   return async (event) => {
@@ -6925,6 +7393,7 @@ var INTERNAL_COLLECTIONS = [
   "payment-event-inbox",
   "payment-refund-attempts",
   "portone-payment-interactions",
+  "commerce-payment-webhook-routes",
   "commerce-notification-intents",
   "commerce-idempotency-records",
   "product-collection-items",
@@ -6932,6 +7401,7 @@ var INTERNAL_COLLECTIONS = [
   "fulfillment-events",
   "tenant-commerce-config",
   "customer-oauth-clients",
+  "customer-group-grants",
   "api-keys",
   "personal-access-tokens",
   "tenant-entitlements",
@@ -6965,7 +7435,6 @@ var COLLECTIONS = [
   "brands",
   "customer-profiles",
   "customer-profile-stats",
-  "discounts",
   "shipping-policies",
   "shipping-zones",
   "documents",
@@ -7041,6 +7510,9 @@ var SERVER_ONLY_COLLECTIONS = [
   "cart-items",
   "checkouts",
   "checkout-items",
+  // Raw discount definitions require a server credential. Browser discount
+  // validation is exposed through the shaped POST /api/discounts/validate path.
+  "discounts",
   "draft-orders",
   "draft-order-items",
   "posts",
@@ -7206,160 +7678,6 @@ var RealtimeConnection = class {
   }
 };
 
-// src/utils/product-media.ts
-function mediaPointerOptionValues(values) {
-  return (values ?? []).filter((value) => value != null && value !== "").map((value) => ({
-    swatch: {
-      type: "media",
-      mediaItemId: value
-    }
-  }));
-}
-function resolveProductMedia(input) {
-  const resolved = resolveProductSelectionMedia({
-    ...input,
-    selectedVariant: input.selectedVariant ?? (input.variantFeaturedMediaItemId ? { images: [input.variantFeaturedMediaItemId] } : null),
-    selectedOptionValues: input.selectedOptionValues ?? mediaPointerOptionValues(input.selectedOptionValueMediaItemIds)
-  });
-  if (resolved.source !== "none") {
-    return {
-      ...resolved,
-      source: resolved.source === "variant_media_selected" ? "variant_featured" : resolved.source
-    };
-  }
-  const display = resolveProductDisplayMedia({
-    productMediaPool: input.productMediaPool
-  });
-  return {
-    primaryImage: display.primaryImage,
-    images: display.images,
-    source: display.source
-  };
-}
-
-// src/utils/product-gallery.ts
-function mediaId(value) {
-  if (typeof value === "string" || typeof value === "number") {
-    return String(value);
-  }
-  if (typeof value === "object" && value !== null && "id" in value) {
-    const id = value.id;
-    if (typeof id === "string" || typeof id === "number") return String(id);
-  }
-  return null;
-}
-function relationshipIds(values) {
-  if (!Array.isArray(values)) return [];
-  return values.map((value) => mediaId(value)).filter((value) => Boolean(value));
-}
-function buildPoolById2(pool) {
-  const poolById = /* @__PURE__ */ new Map();
-  for (const item of pool) {
-    const id = mediaId(item);
-    if (id) poolById.set(id, item);
-  }
-  return poolById;
-}
-function mediaSetItemsInPool(mediaSet, poolById) {
-  const seen = /* @__PURE__ */ new Set();
-  const items = [];
-  const primaryId = mediaId(mediaSet.primaryMediaItemId);
-  if (primaryId) {
-    const primary = poolById.get(primaryId);
-    if (primary) {
-      seen.add(primaryId);
-      items.push(primary);
-    }
-  }
-  for (const itemId of relationshipIds(mediaSet.items)) {
-    if (seen.has(itemId)) continue;
-    const item = poolById.get(itemId);
-    if (!item) continue;
-    seen.add(itemId);
-    items.push(item);
-  }
-  return items;
-}
-function resolveLegacyMediaSet(input) {
-  if (!Array.isArray(input.mediaSets)) return null;
-  const pool = input.productMediaPool ?? input.pool ?? [];
-  const poolById = buildPoolById2(pool);
-  const selectedVariantId = mediaId(input.selectedVariantId);
-  if (selectedVariantId) {
-    const exactSet = input.mediaSets.find(
-      (set) => set.matchType === "exact-variant" && relationshipIds(set.variantIds).includes(selectedVariantId)
-    );
-    if (exactSet) {
-      const images = mediaSetItemsInPool(exactSet, poolById);
-      if (images.length > 0) {
-        return {
-          primaryImage: images[0] ?? null,
-          images,
-          source: "exact_variant_set"
-        };
-      }
-    }
-  }
-  const selectedOptionValueIds = new Set(
-    relationshipIds(input.selectedOptionValueIds)
-  );
-  const optionSetMatches = input.mediaSets.filter((set) => set.matchType === "option-values").map((set) => {
-    const optionValueIds = relationshipIds(set.optionValueIds);
-    if (optionValueIds.length === 0) return null;
-    if (!optionValueIds.every((id) => selectedOptionValueIds.has(id))) {
-      return null;
-    }
-    const images = mediaSetItemsInPool(set, poolById);
-    if (images.length === 0) return null;
-    return { optionValueCount: optionValueIds.length, images };
-  }).filter(
-    (match) => Boolean(match)
-  ).sort((a, b) => b.optionValueCount - a.optionValueCount);
-  if (optionSetMatches.length > 0) {
-    const images = optionSetMatches[0].images;
-    return {
-      primaryImage: images[0] ?? null,
-      images,
-      source: "option_value_set"
-    };
-  }
-  const defaultSet = input.mediaSets.find((set) => set.matchType === "default");
-  if (defaultSet) {
-    const images = mediaSetItemsInPool(defaultSet, poolById);
-    if (images.length > 0) {
-      return {
-        primaryImage: images[0] ?? null,
-        images,
-        source: "default_set"
-      };
-    }
-  }
-  return {
-    primaryImage: null,
-    images: [],
-    source: "none"
-  };
-}
-function resolveProductGallery(input) {
-  const selectedVariantId = mediaId(input.selectedVariantId);
-  const selectedOptionValueIds = relationshipIds(input.selectedOptionValueIds);
-  const selection = resolveProductSelectionMedia({
-    ...input,
-    productMediaPool: input.productMediaPool ?? input.pool ?? null,
-    selectedVariant: input.selectedVariant ?? (selectedVariantId ? { id: selectedVariantId } : null),
-    selectedOptionValues: input.selectedOptionValues ?? selectedOptionValueIds.map((id) => ({ id }))
-  });
-  if (selection.source !== "none") {
-    return selection;
-  }
-  const legacyResolved = resolveLegacyMediaSet(input);
-  if (legacyResolved && legacyResolved.source !== "none") return legacyResolved;
-  return resolveProductDisplayMedia({
-    productMediaPool: input.productMediaPool ?? input.pool ?? null,
-    featuredImage: input.featuredImage
-  });
-}
-
 // src/utils/image.ts
 var IMAGE_SIZES = [200, 400, 800, 1200, 1600];
 function imageSizeCandidates(sizes) {
@@ -7491,7 +7809,7 @@ function createAnalytics(config) {
     }, destroy() {
     } };
   }
-  const endpoint2 = config.endpoint ?? `${resolveApiUrl()}/api/analytics/collect`;
+  const endpoint = config.endpoint ?? `${resolveApiUrl()}/api/analytics/collect`;
   const respectDnt = config.respectDnt !== false;
   function isDntActive() {
     if (!respectDnt) return false;
@@ -7532,10 +7850,10 @@ function createAnalytics(config) {
     try {
       if (typeof navigator.sendBeacon === "function") {
         const blob = new Blob([body], { type: "text/plain" });
-        const sent = navigator.sendBeacon(endpoint2, blob);
+        const sent = navigator.sendBeacon(endpoint, blob);
         if (sent) return;
       }
-      fetch(endpoint2, {
+      fetch(endpoint, {
         method: "POST",
         keepalive: true,
         headers: { "Content-Type": "application/json" },
@@ -7792,8 +8110,6 @@ export {
   projectProductToListingShape,
   resolveFeaturedImagePointer,
   resolveProductDisplayMedia,
-  resolveProductGallery,
-  resolveProductMedia,
   resolveProductSelection,
   resolveProductSelectionFromMatrix,
   resolveProductSelectionMedia,