@01.software/sdk 0.51.0 → 0.65.0

package/CHANGELOG.md

@@ -1,5 +1,318 @@
 # @01.software/sdk
 
+## 0.65.0
+
+### Minor Changes
+
+- 49d3944: Add optional image/video gallery item descriptors to storefront content reads, with safe thumbnails and explicit ready, processing, or unavailable states. Keep existing image responses and gallery ordering compatible; video playback continues through the server-only admission helper.
+
+### Patch Changes
+
+- 210e4a8: Sync generated tenant types with the optional Console menu display-name preference. Saved preferences remain restricted to Console operators.
+
+## 0.64.1
+
+### Patch Changes
+
+- 94917e1: Align the SDK's Payload development dependencies with the stable 3.90.0 security fixes used by Console.
+- 72131ac: Refresh the generated video types to reflect the chapter editor's placement in the General tab. Existing chapter data and playback behavior are unchanged.
+
+## 0.64.0
+
+### Minor Changes
+
+- 6ec64b3: Preserve collection filter meaning for browser and server `find`/`count` and
+  server bulk mutations. Null equality filters were not filtered correctly before
+  for fields such as text: null became an empty string. `equals: null` and
+  `not_equals: null` now retain null through Payload's native JSON `where` query
+  parameter; date null filters, including the documented `publishedAt` example,
+  remain supported. Bulk mutations now also accept these null equality filters.
+
+  BREAKING (0.x minor): reads now share bulk's pre-request `ValidationError`
+  rejection. Newly rejected read inputs explicitly include `where: {}`,
+  `and: []`, `or: []`, an empty condition object such as `{ id: {} }`,
+  `not_in: []`, `in: []`, and undefined filter values. Nesting beyond 10 and
+  arrays above 1000 elements are also rejected. Null outside equality operators
+  remains rejected. This narrows the accepted read inputs, including empty forms
+  that previously succeeded. When no conditions remain, omit `where` instead of
+  passing `where: {}`. Remove undefined conditions explicitly or return an empty
+  result for an empty ID selection. Collection access rules stay unchanged.
+
+### Patch Changes
+
+- 9a86409: Expose the server-only Membership renewal benefit hold field in generated collection types.
+- e4d1efe: Fix collection updateMany and removeMany filters to use Payload query encoding.
+  Send update fields directly as JSON so authorized bulk mutations reach the existing
+  collection access checks and hooks.
+
+  Calls that previously failed with 400 now actually run.
+  Review existing bulk callers before upgrading. Filters with null/undefined values,
+  empty condition objects, empty arrays, nesting beyond 10 levels, or arrays over
+  1000 elements are rejected
+  before sending a mutation.
+
+- 745bd40: Classify unapplied membership paid evidence as an internal Console collection.
+- 7caa6cc: Document unapplied membership payment evidence in generated payload types.
+
+## 0.63.0
+
+### Minor Changes
+
+- a8f7691: Add `customer.auth.withdraw(currentPassword)` for password-reauthenticated self-withdrawal. Successful withdrawal archives the account and clears the local SDK session; active memberships and passwordless-only accounts return explicit refusal reasons.
+
+### Patch Changes
+
+- 741b7d8: Synchronize the generated Payload type description for customer consent receipts.
+- a33e6ea: Clarify in the generated Link field documentation that expiration removes a link from storefront lists while leaving stored state and direct collection reads unchanged.
+- 4e47268: Clarify the generated audit-log payload documentation: audit summaries contain structural evidence, not personal-data values, secrets or request/response bodies.
+- 0e80819: Synchronize generated internal usage types with the Console's separate email observation field. Public collection buckets and billing meters remain unchanged.
+
+## 0.62.2
+
+### Patch Changes
+
+- e10f77f: Sync generated tenant customer-auth settings and the internal hosted consent receipt type. The receipt collection remains outside published collection clients and HTTP contracts.
+- ee4176a: Clarify generated Customer consent field documentation as tenant self-reports while the hosted server receipt remains the authority for hosted reconsent.
+
+## 0.62.1
+
+### Patch Changes
+
+- 676c69f: Add nullable usage invoice minimum-charge exemption evidence to generated types.
+- bb4d0e2: Update API key scope guidance and generated types after retiring the stored web analytics scope.
+
+## 0.62.0
+
+### Minor Changes
+
+- 4c023aa: BREAKING (0.x minor): Orders raw bulk updates now fail before document mutation.
+  Generic Orders `updateMany` and Admin Panel bulk edit are rejected. Keep top-ID
+  updates for unconditional edits; conditional callers must preserve the complete
+  where query and an at-most-one bound using raw HTTP or the Console Local API.
+  Document native admission/failure codes and retain the SDK's terminal HTTP 400
+  handling. Other collections and SDK transport signatures are unchanged.
+  Transaction-disabled Orders updates without a live external transaction also
+  fail before mutation with a localized HTTP 400; normal and sequential external
+  transactions continue to work.
+
+### Patch Changes
+
+- 5a372d8: Correct the form submissions collection description to match its available actions.
+- 87b450e: Synchronize generated Payload types for internal personal saved order views. Published collection addressability is unchanged.
+- 2bcf3ae: Sync generated customer OAuth client types with implemented-only social provider
+  selection and validation in Console. Previously saved unimplemented providers
+  remain readable but are omitted from hosted login.
+
+## 0.61.1
+
+### Patch Changes
+
+- 4283bcd: Synchronize generated Payload type documentation for hidden event locations. SDK field shapes remain unchanged.
+
+## 0.61.0
+
+### Minor Changes
+
+- 22061d6: BREAKING (0.x minor): `useCustomerLogout()` now awaits direct refresh-family revocation and can report a server failure after local credentials are cleared. Use `customer.auth.logoutAsync()` for server logout; the synchronous `logout()` remains local-only compatibility.
+- 418cdca: Add server-only external Customer link helpers with bounded previous-state snapshots, version-fenced mutations, and explicit request replay identity.
+
+### Patch Changes
+
+- 0b1704a: Expose the existing billing custody method on the server client factory and withMarket return types.
+
+## 0.60.0
+
+### Minor Changes
+
+- 1fea398: Add server-only delegated Membership ciphertext custody operations.
+- cad9245: Add a server-only API for purpose-bound tenant-encrypted installation credentials.
+
+## 0.59.2
+
+### Patch Changes
+
+- 936c20a: Include the tenant password-registration setting in generated Payload types. The existing Customer registration method preserves the new `registration_disabled` API reason.
+
+## 0.59.1
+
+### Patch Changes
+
+- 259d977: Sync the internal generated Payload result type for the reconciled ticket payment outcome. No public SDK API changes.
+
+## 0.59.0
+
+### Minor Changes
+
+- ad385ac: Add the server-only external-effect claims API for tenant-owned provider work. Require redacted report evidence and a remote operation identity before reporting no effect.
+
+## 0.58.0
+
+### Minor Changes
+
+- d558727: Add server Customer delegation inputs for Customer Group restricted paid admission purchases across Cart, Checkout, and PaymentSession APIs.
+- 6ce7cf3: BREAKING (0.x minor): Remove the three retired analytics collection slugs from
+  the exported `INTERNAL_COLLECTIONS` list and `InternalCollection` union, along
+  with their generated SDK types.
+
+### Patch Changes
+
+- 26f94eb: Expose the tenant-wide timezone field in generated Payload collection types.
+
+## 0.57.0
+
+### Minor Changes
+
+- 1b0deb7: BREAKING (0.x minor): Remove the SDK `createAnalytics`, `Analytics`, and `AnalyticsConfig` root exports and the `@01.software/sdk/analytics` and `/analytics/react` subpaths. Existing integrations should use an external analytics tool such as GA4, Plausible, or Vercel Analytics instead. The init CLI no longer generates or advertises an analytics helper.
+- b91e56a: Add server-only `video.playback(videoId)` and `VideoPlayer.streamUrl` for signed,
+  quota-metered VOD playback. BREAKING for assets explicitly migrated to signed
+  playback: a stored legacy `muxPlaybackId` remains historical usage evidence,
+  but raw Mux HLS, thumbnail, and MP4 URLs built from it stop working. Existing
+  unmigrated paid assets retain their public playback path.
+
+### Patch Changes
+
+- 6ab5331: Synchronize generated Payload types and collection ordering for the internal MCP daily usage collection.
+- eb1e49f: Sync internal generated Payload types for the objectless ticket payment kernel result. No public SDK API changes.
+
+## 0.56.3
+
+### Patch Changes
+
+- ef686ff: Synchronize generated entitlement types for explicit tenant-local Project Free grants and their server-owned activation key.
+
+## 0.56.2
+
+### Patch Changes
+
+- ee75768: Synchronize the SDK Payload types with the TicketPurchase kernel obligation schema.
+
+## 0.56.1
+
+### Patch Changes
+
+- d7ac700: Sync the shipping policy free-shipping field description from Console schemas.
+- e15348a: The generated `Article` type now documents `slug` as the URL slug that stays fixed once an article is created.
+- c3ab3b9: Sync the product slug field description, which now notes that the slug is fixed after creation.
+
+## 0.56.0
+
+### Minor Changes
+
+- bab54b6: BREAKING (0.x minor): Make paid membership subscribe return a first-charge prepare instruction instead of accepting a caller payment identifier. Tenant billing now uses the returned idempotency key and the existing signed charge-result flow.
+
+## 0.55.1
+
+### Patch Changes
+
+- 9ee5438: Synchronize generated Payload event hold and internal TicketPurchase draft types
+  with the Console schema.
+
+## 0.55.0
+
+### Minor Changes
+
+- 3ddc653: BREAKING (0.x minor): Generated Membership payment method and credential types
+  now expose delegated-only fields. Legacy connect and backend-charge metadata is
+  removed from the SDK type surface; stored database columns remain intact.
+
+### Patch Changes
+
+- 4732259: Sync event registration provenance fields from Console schemas.
+- 313ed5b: Synchronize generated Payload membership-charge types with normalized terminal
+  decline evidence fields.
+
+## 0.54.2
+
+### Patch Changes
+
+- c040018: Add typed webhook support for thin membership lifecycle notifications.
+
+## 0.54.1
+
+### Patch Changes
+
+- d09060b: Add generated internal usage-attribution fields for Project environment billing evidence.
+
+## 0.54.0
+
+### Minor Changes
+
+- 1e2f5ce: Add server-only source-aware Customer Group member listing, grant, and revoke helpers.
+
+### Patch Changes
+
+- 5d183fd: Add optional Checkout and Order discount snapshot fields for canonical
+  condition digests and private customer-eligibility evidence.
+
+## 0.53.0
+
+### Minor Changes
+
+- b3b3878: Synchronize generated Payload types for Project-scoped subscription authority.
+  `Project.authorityMode` now includes `project-billing`, and `Subscription` gains
+  an optional `project` relationship while retaining its required Live tenant
+  anchor.
+
+  This is additive only: no collection becomes publicly addressable, existing
+  tenant identifiers keep their meaning, and tenant-scoped SDK behavior is
+  unchanged.
+
+## 0.52.2
+
+### Patch Changes
+
+- e808fb7: Improve PaymentSession provider-mismatch cancellation recovery guidance after
+  validating the complete actual-provider response and cancellation state.
+
+  **BREAKING (0.x minor):** `01 payment-session retrieve` and `01 payment-session cancel` now require `--provider toss` or `--provider portone`; the CLI no longer assumes Toss when it is omitted.
+
+## 0.52.1
+
+### Patch Changes
+
+- 1f62cb3: Keep managed payment-provider response validation aligned with the SDK's public checkout provider type.
+- 2848ab8: Remove retired stg smoke reconciliation wording from the generated PAT type mirror.
+
+## 0.52.0
+
+### Minor Changes
+
+- ebd2544: Synchronize generated types for the Project environment expand phase (ADR 0056). A `Project` interface is added, and `Tenant` gains five optional, nullable fields describing its Project/environment binding: `project`, `environmentKind`, `environmentGeneration`, `environmentState`, and `environmentIsCurrent`.
+
+  Additive only. Every new field is optional, no existing field becomes nullable, and `tenantId` keeps its exact meaning. The `projects` slug is deliberately absent from `COLLECTIONS`, `SERVER_ONLY_COLLECTIONS`, and `INTERNAL_COLLECTIONS`, so no collection is newly addressable and no runtime behavior changes; the additive public client context is owned by a later issue.
+
+### Patch Changes
+
+- 9620154: Keep generated SDK collection metadata and Payload types aligned with the Console customer-group grant authority.
+
+## 0.51.2
+
+### Patch Changes
+
+- 6f08721: Align the generated Order field order with the Admin Panel order information tab.
+- 18c9eb7: Synchronize the generated Payload types after the Console `customers`
+  collection declares `email` before `name`: `Customer` and `CustomersSelect`
+  change property order only. This does not add, remove, or retype any SDK
+  surface.
+- 6d2e6ac: Update the audited Next runtime dependencies used by SDK verification and the
+  published app templates.
+- 7eb25b2: Payload CMS 3.89.0 선행 업그레이드에 맞춰 SDK 검증용 개발 의존성을 갱신하고,
+  upstream 실제 수정 전까지 보상 통제를 유지합니다.
+
+## 0.51.1
+
+### Patch Changes
+
+- ff7a716: Serialize persisted `CustomerAuth` refresh rotation across browser contexts and make the persisted session atomic.
+
+  The canonical session now lives in a single versioned JSON record at `<key>:session` holding the access/refresh pair plus a monotonic revision. Writing the pair in one store operation removes the torn write that could publish a new access token beside an already-consumed refresh token, and every write re-reads the record first and carries forward the field it does not change, which keeps a stale instance from carrying its own outdated counterpart into the write. That merge is best-effort, not a compare-and-swap.
+
+  Refresh-token rotation — and only rotation — is serialized through a Web Locks lease keyed by the storage key plus the canonical API/tenant identity (equivalent URL spellings share one namespace; token material never appears in a lease name). Inside the lease the rotation re-reads canonical state and classifies it on the credential it will present, so it never replays a credential the record already replaced, never strands the successor it already paid for, and preserves an access token another context deliberately replaced while committing the successor refresh in the same write. `getToken()` / `getRefreshToken()` re-read canonical state before use, so another tab's rotation or logout is observed before the next credential use.
+
+  Limits, stated rather than implied: Web Storage has no compare-and-swap, so the read preceding a write is not atomic with it, and the synchronous mutators (`logout`, `setToken`, `setRefreshToken`) cannot await the lease. A commit landing inside that window is lost by ordering — including a counterpart the merge just read, which is then republished stale. Those interleavings are last-writer-wins; server-side single-use rotation and refresh-family reuse detection remain the only authority. Browsers without Web Locks, a throwing `navigator.locks` accessor, a failed acquisition, an expired bounded wait, or storage that denies access all degrade to a per-instance or memory-only session while still presenting the canonical credential.
+
+  Storage compatibility: `<key>` still holds the current access token as a single-value publication for code that reads it directly, and an existing pair under the older `<key>` / `<key>:refresh` layout is migrated on first read — but only while `<key>:session` is absent. `logout()` writes a cleared record even against empty storage, so an ended session cannot be migrated back out of the older keys. The older refresh entry is retired before any newer access token is mirrored, so those two are never published together, and if that retirement fails the newer access token is not mirrored beside it; such a reader falls back to the bearer refresh path, and server-side reuse detection resolves an older pair it may still hold. A record this version cannot interpret fails closed to a memory-only session rather than being reinterpreted through the older keys. A context running an SDK version that predates the record is outside the coordination guarantee. `persist: false` and SSR behavior are unchanged.
+
 ## 0.51.0
 
 ### Minor Changes