@01.software/sdk 0.51.0 → 0.65.0

package/dist/index.cjs

@@ -65,7 +65,6 @@ __export(src_exports, {
   buildProductListingGroupsByOption: () => buildProductListingGroupsByOption,
   buildProductOptionMatrix: () => buildProductOptionMatrix,
   buildProductOptionMatrixFromDetail: () => buildProductOptionMatrixFromDetail,
-  createAnalytics: () => createAnalytics,
   createAuthError: () => createAuthError,
   createClient: () => createClient2,
   createCommerceEmailWebhookHandler: () => createCommerceEmailWebhookHandler,
@@ -1149,6 +1148,49 @@ function stockSnapshotSearchParams(params) {
 }
 
 // src/core/collection/http-client.ts
+function validateWhere(where) {
+  if (where === void 0) return false;
+  let hasNull = false;
+  function visit(value, depth, key) {
+    if (depth > 10) {
+      throw createValidationError(
+        "Collection where must not exceed nesting depth 10."
+      );
+    }
+    if (value === null && (key === "equals" || key === "not_equals")) {
+      hasNull = true;
+      return;
+    }
+    if (value == null) {
+      throw createValidationError(
+        "Collection where must not contain null or undefined values."
+      );
+    }
+    if (Array.isArray(value)) {
+      if (value.length === 0) {
+        throw createValidationError(
+          "Collection where must not contain empty arrays, including and/or."
+        );
+      }
+      if (value.length > 1e3) {
+        throw createValidationError(
+          "Collection where arrays must not contain more than 1000 elements."
+        );
+      }
+      for (const item of value) visit(item, depth + 1);
+    } else if (typeof value === "object" && !(value instanceof Date)) {
+      const values = Object.entries(value);
+      if (values.length === 0) {
+        throw createValidationError(
+          "Collection where must not contain empty condition objects."
+        );
+      }
+      for (const [key2, item] of values) visit(item, depth + 1, key2);
+    }
+  }
+  visit(where, 0);
+  return hasNull;
+}
 var HttpClient = class {
   constructor(publishableKey, secretKey, getCustomerToken, onUnauthorized, onRequestId, apiUrl) {
     this.publishableKey = requirePublishableKeyForSecret(
@@ -1195,7 +1237,8 @@ var HttpClient = class {
       ...rest,
       "fallback-locale": fallbackLocale === false ? "none" : fallbackLocale
     };
-    const queryString = (0, import_qs_esm.stringify)(queryOptions, { addQueryPrefix: true });
+    const encodedOptions = validateWhere(queryOptions.where) ? { ...queryOptions, where: JSON.stringify(queryOptions.where) } : queryOptions;
+    const queryString = (0, import_qs_esm.stringify)(encodedOptions, { addQueryPrefix: true });
     return queryString ? `${endpoint}${queryString}` : endpoint;
   }
   assertJsonResponse(response) {
@@ -1504,6 +1547,11 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     detail: strictCommerceOperation("checkouts", "post", "/detail"),
     query: strictCommerceOperation("checkouts", "post", "/query")
   },
+  draftOrders: {
+    calculate: operation("draft-orders", "post", "/:id/calculate"),
+    complete: operation("draft-orders", "post", "/:id/complete"),
+    finalize: operation("draft-orders", "post", "/:id/finalize")
+  },
   transactions: {
     update: operation("transactions", "post", "/update")
   },
@@ -1603,8 +1651,51 @@ var portOneStandardActionCapabilityOperations = /* @__PURE__ */ new Set([
 ]);
 var MEMBERSHIP_ENDPOINT_OPERATIONS = {
   subscribe: operation(null, "post", "/memberships/subscribe"),
+  billingCustody: operation(null, "post", "/memberships/billing-custody"),
   cancel: operation(null, "post", "/memberships/:id/cancel"),
-  me: operation(null, "get", "/memberships/me")
+  me: operation(null, "get", "/memberships/me"),
+  chargeResult: operation(null, "post", "/memberships/:id/charge-result"),
+  refundResult: operation(null, "post", "/memberships/:id/refund-result"),
+  revoke: operation(null, "post", "/memberships/:id/revoke")
+};
+var EXTERNAL_EFFECT_CLAIM_ENDPOINT_OPERATIONS = {
+  claim: operation(null, "post", "/external-effect-claims/claim"),
+  get: operation(null, "post", "/external-effect-claims/get"),
+  arm: operation(null, "post", "/external-effect-claims/arm"),
+  release: operation(null, "post", "/external-effect-claims/release"),
+  report: operation(null, "post", "/external-effect-claims/report"),
+  recovery: operation(null, "post", "/external-effect-claims/recovery")
+};
+var INSTALLATION_CREDENTIAL_ENDPOINT_OPERATIONS = {
+  create: operation(null, "post", "/installation-credentials/create"),
+  get: operation(null, "post", "/installation-credentials/get"),
+  replace: operation(null, "post", "/installation-credentials/replace"),
+  dispose: operation(null, "post", "/installation-credentials/dispose")
+};
+var EXTERNAL_CUSTOMER_LINK_ENDPOINT_OPERATIONS = {
+  connect: operation("customers", "post", "/external-links/connect"),
+  get: operation("customers", "post", "/external-links/get"),
+  list: operation("customers", "post", "/external-links/list"),
+  unlink: operation("customers", "post", "/external-links/unlink"),
+  capturePreviousState: operation(
+    "customers",
+    "post",
+    "/external-links/capture-previous-state"
+  ),
+  clearPreviousState: operation(
+    "customers",
+    "post",
+    "/external-links/clear-previous-state"
+  )
+};
+var CUSTOMER_GROUP_ENDPOINT_OPERATIONS = {
+  members: operation("customer-groups", "get", "/:id/members"),
+  grant: operation("customer-groups", "post", "/:id/members/grant"),
+  revoke: operation("customer-groups", "post", "/:id/members/revoke")
+};
+var CUSTOMER_AUTH_ENDPOINT_OPERATIONS = {
+  revokeRefresh: operation("customers", "post", "/revoke-refresh"),
+  withdraw: operation("customers", "post", "/withdraw")
 };
 var EMBEDDED_ADMIN_ENDPOINT_OPERATIONS = {
   show: operation("tenants", "get", "/embedded-admin-app"),
@@ -1629,6 +1720,14 @@ var COMMUNITY_ENDPOINT_OPERATIONS = {
     detail: operation("posts", "get", "/detail")
   }
 };
+var GALLERY_ENDPOINT_OPERATIONS = {
+  items: {
+    storefront: operation("gallery-items", "get", "/storefront")
+  }
+};
+var VIDEO_ENDPOINT_OPERATIONS = {
+  playback: operation("videos", "post", "/:id/playback")
+};
 function resolveOperationTemplate(descriptor) {
   return descriptor.collection ? `/api/${descriptor.collection}${descriptor.path}` : `/api${descriptor.path}`;
 }
@@ -2218,6 +2317,15 @@ var PublicContentApi = class extends RawCustomerScopedApi {
   get(endpoint) {
     return this.request(endpoint, { method: "GET" });
   }
+  galleryItems(options) {
+    const operation2 = GALLERY_ENDPOINT_OPERATIONS.items.storefront;
+    return this.request(
+      resolveOperationPath(operation2, {
+        query: galleryItemsListQuery(options)
+      }),
+      { method: resolveOperationMethod(operation2) }
+    );
+  }
 };
 function appendCommonParams(search, options, defaultSort) {
   search.set("sort", options?.sort ?? defaultSort);
@@ -2237,12 +2345,12 @@ function linksListPath(options) {
     search.set("featured", String(options.featured));
   return `/api/links/storefront?${search}`;
 }
-function galleryItemsListPath(options) {
+function galleryItemsListQuery(options) {
   const search = new URLSearchParams();
   appendCommonParams(search, options, "manual");
   if (options?.galleryId) search.set("galleryId", options.galleryId);
   if (options?.gallerySlug) search.set("gallerySlug", options.gallerySlug);
-  return `/api/gallery-items/storefront?${search}`;
+  return search;
 }
 var ContentClient = class {
   constructor(options) {
@@ -2256,9 +2364,7 @@ var ContentClient = class {
       list: (params) => api.get(linksListPath(params))
     };
     this.galleryItems = {
-      list: (params) => api.get(
-        galleryItemsListPath(params)
-      )
+      list: (params) => api.galleryItems(params)
     };
   }
 };
@@ -2314,7 +2420,10 @@ var ORDER_PRIMARY_DISPLAY_STATUSES = [
 ];
 var CHECKOUT_STATUSES = ["open", "placed", "abandoned"];
 var ABANDONED_REASONS = ["expired", "customer", "operator"];
-var PAYMENT_PROVIDERS = ["toss", "portone"];
+function managedPaymentProviders(providers) {
+  return providers;
+}
+var PAYMENT_PROVIDERS = managedPaymentProviders(["toss", "portone"]);
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2362,6 +2471,26 @@ function invalidCanonicalResponse(resource, details) {
 function fail(resource, path, expected) {
   invalidCanonicalResponse(resource, { path, expected });
 }
+function providerMismatch(resource, expected, actual, operation2) {
+  if (operation2 === "cancel") {
+    const method = {
+      toss: "cancel()",
+      portone: "cancelPortOne()"
+    }[actual];
+    throw createApiError(
+      `Canonical ${resource} response provider mismatch: expected ${expected}, received ${actual}.`,
+      502,
+      { resource, path: "$.provider", expected, actual },
+      `The server applied the cancellation to a ${actual} PaymentSession, but this SDK method expects ${expected}.`,
+      `Re-invoke ${method} with the same idempotencyKey; do not create a new key.`
+    );
+  }
+  invalidCanonicalResponse(resource, {
+    path: "$.provider",
+    expected,
+    actual
+  });
+}
 function record(value, resource, path) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     fail(resource, path, "object");
@@ -3654,7 +3783,7 @@ function validateNextAction(value, provider, resource, path) {
   if (action.customerEmail !== void 0)
     validateCustomer({ email: action.customerEmail }, resource, path);
 }
-function validatePublicPaymentSession(value, expectedProvider) {
+function validatePublicPaymentSession(value, expectedProvider, operation2) {
   const resource = "PaymentSession";
   const session = record(value, resource, "$");
   const provider = enumValue(
@@ -3663,9 +3792,6 @@ function validatePublicPaymentSession(value, expectedProvider) {
     resource,
     "$.provider"
   );
-  if (expectedProvider !== void 0 && provider !== expectedProvider) {
-    fail(resource, "$.provider", expectedProvider);
-  }
   const status = enumValue(
     session.providerStatus,
     PAYMENT_PROVIDER_STATUSES,
@@ -3869,44 +3995,128 @@ function validatePublicPaymentSession(value, expectedProvider) {
       "$.cancellationReason"
     );
   }
+  if (expectedProvider !== void 0 && provider !== expectedProvider) {
+    if (operation2 === "cancel" && status !== "canceling" && status !== "canceled") {
+      fail(
+        resource,
+        "$.providerStatus",
+        "canceling or canceled after a successful cancellation"
+      );
+    }
+    providerMismatch(resource, expectedProvider, provider, operation2);
+  }
   return value;
 }
 
 // src/core/customer/customer-auth.ts
 var DEFAULT_TIMEOUT2 = 15e3;
-function safeGetItem(key) {
+var REFRESH_LOCK_TIMEOUT = DEFAULT_TIMEOUT2 * 3;
+var SESSION_RECORD_VERSION = 1;
+var STORAGE_UNUSABLE = /* @__PURE__ */ Symbol("storage-unusable");
+function canonicalApiIdentity(apiUrl) {
   try {
-    return localStorage.getItem(key);
+    const url = new URL(apiUrl);
+    return `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return apiUrl.trim().toLowerCase().replace(/\/+$/, "");
+  }
+}
+function buildRefreshLockName(apiUrl, publishableKey, storageKey) {
+  return `01software:customer-auth-refresh:${canonicalApiIdentity(apiUrl)}:${publishableKey}:${storageKey}`;
+}
+function getRefreshLockRequester() {
+  try {
+    if (typeof navigator === "undefined") return null;
+    const locks = navigator.locks;
+    if (!locks || typeof locks.request !== "function") return null;
+    return (name, options, callback) => locks.request(
+      name,
+      options,
+      () => callback()
+    );
+  } catch {
+    return null;
+  }
+}
+function parseSessionRecord(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return null;
+    const candidate = parsed;
+    if (candidate.v !== SESSION_RECORD_VERSION) return null;
+    if (typeof candidate.rev !== "number" || !Number.isFinite(candidate.rev)) {
+      return null;
+    }
+    const token = candidate.token;
+    const refreshToken = candidate.refreshToken;
+    if (token !== null && typeof token !== "string") return null;
+    if (refreshToken !== null && typeof refreshToken !== "string") return null;
+    return {
+      v: SESSION_RECORD_VERSION,
+      rev: candidate.rev,
+      token,
+      refreshToken
+    };
   } catch {
     return null;
   }
 }
+function readSessionRecord(recordKey, mirrorKey, mirrorRefreshKey) {
+  let raw;
+  try {
+    raw = localStorage.getItem(recordKey);
+  } catch {
+    return STORAGE_UNUSABLE;
+  }
+  if (raw !== null) {
+    const parsed = parseSessionRecord(raw);
+    return parsed ? { record: parsed, stored: true } : STORAGE_UNUSABLE;
+  }
+  try {
+    return {
+      record: {
+        v: SESSION_RECORD_VERSION,
+        rev: 0,
+        token: localStorage.getItem(mirrorKey),
+        refreshToken: localStorage.getItem(mirrorRefreshKey)
+      },
+      stored: false
+    };
+  } catch {
+    return STORAGE_UNUSABLE;
+  }
+}
 var CustomerAuth = class {
   constructor(publishableKey, options, apiUrl) {
     this.refreshPromise = null;
+    /** Canonical record key; null unless persistence is active in a browser. */
+    this.persistRecordKey = null;
+    /** Advisory single-value access mirror, plus the retired refresh mirror. */
+    this.persistMirrorKey = null;
+    this.persistMirrorRefreshKey = null;
+    /** Cross-context refresh lock name; null when there is no shared storage. */
+    this.refreshLockName = null;
+    /** Revision of the canonical record this instance last observed. */
+    this.sessionRev = 0;
     this.publishableKey = publishableKey;
     this.baseUrl = resolveApiUrl(apiUrl);
     const persist = options?.persist ?? true;
     if (persist) {
       const key = typeof persist === "string" ? persist : "customer-token";
-      const refreshKey = `${key}:refresh`;
       const isBrowser = typeof window !== "undefined";
-      this.token = isBrowser ? safeGetItem(key) : null;
-      this.refreshTokenValue = isBrowser ? safeGetItem(refreshKey) : null;
-      this.onTokenChange = isBrowser ? (token) => {
-        try {
-          if (token) localStorage.setItem(key, token);
-          else localStorage.removeItem(key);
-        } catch {
-        }
-      } : void 0;
-      this.onRefreshTokenChange = isBrowser ? (refreshToken) => {
-        try {
-          if (refreshToken) localStorage.setItem(refreshKey, refreshToken);
-          else localStorage.removeItem(refreshKey);
-        } catch {
-        }
-      } : void 0;
+      this.token = null;
+      this.refreshTokenValue = null;
+      if (isBrowser) {
+        this.persistRecordKey = `${key}:session`;
+        this.persistMirrorKey = key;
+        this.persistMirrorRefreshKey = `${key}:refresh`;
+        this.refreshLockName = buildRefreshLockName(
+          this.baseUrl,
+          publishableKey,
+          key
+        );
+        this.syncFromPersistedStorage();
+      }
     } else {
       this.token = options?.token ?? null;
       this.refreshTokenValue = options?.refreshToken ?? null;
@@ -3934,66 +4144,334 @@ var CustomerAuth = class {
         body: JSON.stringify(data)
       }
     );
-    this.setToken(result.token);
-    if (result.refreshToken) this.setRefreshToken(result.refreshToken);
+    if (result.refreshToken) this.setSession(result.token, result.refreshToken);
+    else this.setToken(result.token);
     return result;
   }
   /**
    * Refresh the current token. Uses a refresh token when available, otherwise
    * falls back to the legacy bearer-token compatibility path.
+   *
+   * Refresh tokens are single-use, so a persisted session shared by several
+   * tabs or SDK instances must rotate at most once: concurrent rotations of the
+   * same token are replay from the server's point of view and revoke the whole
+   * family. Persisted browser sessions therefore serialize rotation across
+   * contexts and re-read the canonical persisted credentials inside the lock.
    */
   async refreshToken() {
+    this.syncFromPersistedStorage();
     if (!this.refreshTokenValue && !this.token) {
       throw new ApiError("Not authenticated", 401);
     }
     if (this.refreshPromise) return this.refreshPromise;
-    this.refreshPromise = this._doRefreshToken();
+    const intended = this.currentFence();
+    this.refreshPromise = this.rotateAcrossContexts(intended);
     try {
       return await this.refreshPromise;
     } finally {
       this.refreshPromise = null;
     }
   }
-  async _doRefreshToken() {
-    const init = this.refreshTokenValue ? {
+  /**
+   * Re-read the canonical persisted session. In persisted mode the shared
+   * record — not this instance's memory — is the source of truth, so another
+   * context's rotation, login, or logout is observed before the next credential
+   * use. Change callbacks are deliberately not invoked: this is a read.
+   */
+  syncFromPersistedStorage() {
+    const canonical = this.readCanonicalSession();
+    if (canonical === STORAGE_UNUSABLE) {
+      this.disablePersistence();
+      return;
+    }
+    if (!canonical) return;
+    this.sessionRev = canonical.record.rev;
+    this.token = canonical.record.token;
+    this.refreshTokenValue = canonical.record.refreshToken;
+  }
+  /** `null` when this instance does not persist. */
+  readCanonicalSession() {
+    if (!this.persistRecordKey || !this.persistMirrorKey || !this.persistMirrorRefreshKey) {
+      return null;
+    }
+    return readSessionRecord(
+      this.persistRecordKey,
+      this.persistMirrorKey,
+      this.persistMirrorRefreshKey
+    );
+  }
+  /**
+   * Publish a change to canonical storage.
+   *
+   * The canonical pair is re-read immediately before the single record write so
+   * that a field this call does not change is taken from that read rather than
+   * from this instance's possibly stale copy. That merge is BEST-EFFORT: it
+   * removes the stale counterpart an instance would otherwise carry, but it is
+   * not a compare-and-swap. Web Storage offers none, and the synchronous public
+   * mutators cannot await the refresh lease, so a commit that lands between
+   * this read and the store operation is lost by ordering — including the
+   * counterpart just read, which is then republished stale. The window is one
+   * store operation wide and the server remains authoritative; see
+   * `CUST-AUTH-033` for the stated limit.
+   *
+   * Returns `false` only when `requireLiveSession` refused a write because the
+   * canonical session had already been cleared.
+   */
+  commitPersistedSession(change, options) {
+    const recordKey = this.persistRecordKey;
+    const mirrorKey = this.persistMirrorKey;
+    const mirrorRefreshKey = this.persistMirrorRefreshKey;
+    const canonical = this.readCanonicalSession();
+    if (canonical === null || !recordKey || !mirrorKey || !mirrorRefreshKey) {
+      return true;
+    }
+    if (canonical === STORAGE_UNUSABLE) {
+      this.disablePersistence();
+      return true;
+    }
+    const current = canonical.record;
+    if (options?.requireLiveSession && !current.token && !current.refreshToken) {
+      return false;
+    }
+    const next = {
+      v: SESSION_RECORD_VERSION,
+      rev: current.rev + 1,
+      token: "token" in change ? change.token ?? null : current.token,
+      refreshToken: "refreshToken" in change ? change.refreshToken ?? null : current.refreshToken
+    };
+    if (
+      // Only a state that is genuinely persisted can already say what this
+      // write would say. An absent record reads as an empty pair, and treating
+      // that as a no-op would drop the very tombstone that stops a later
+      // migration from resurrecting the session out of the earlier layout.
+      canonical.stored && next.token === current.token && next.refreshToken === current.refreshToken
+    ) {
+      this.sessionRev = current.rev;
+      this.token = current.token;
+      this.refreshTokenValue = current.refreshToken;
+      return true;
+    }
+    try {
+      localStorage.setItem(recordKey, JSON.stringify(next));
+    } catch {
+      this.disablePersistence();
+      return true;
+    }
+    this.sessionRev = next.rev;
+    this.token = next.token;
+    this.refreshTokenValue = next.refreshToken;
+    try {
+      localStorage.removeItem(mirrorRefreshKey);
+    } catch {
+      return true;
+    }
+    try {
+      if (next.token) localStorage.setItem(mirrorKey, next.token);
+      else localStorage.removeItem(mirrorKey);
+    } catch {
+    }
+    return true;
+  }
+  /**
+   * Storage rejected a write or a read, so it is not a canonical store for this
+   * instance. Fall back to the memory-only session and take no lease: there is
+   * no shared state left to coordinate. Nothing is purged — the record commit
+   * is atomic, so no inconsistent state was published, and another context's
+   * valid session must not be destroyed by this instance's local failure.
+   */
+  disablePersistence() {
+    this.persistRecordKey = null;
+    this.persistMirrorKey = null;
+    this.persistMirrorRefreshKey = null;
+    this.refreshLockName = null;
+  }
+  /**
+   * Compare the canonical record with the fence this call captured before it
+   * left. Every persisted decision — rotate, converge, or fail closed — goes
+   * through this one comparison. The revision catches a logout, a fresh login,
+   * or a manual setter even when token values coincide; the value comparison
+   * additionally catches a mirror-only writer that cannot bump a revision.
+   */
+  classifyCanonicalState(intended) {
+    if (!this.persistRecordKey) return "current";
+    this.syncFromPersistedStorage();
+    if (!this.persistRecordKey) return "current";
+    if (!this.token && !this.refreshTokenValue) return "cleared";
+    if (intended.refreshToken !== null) {
+      return this.refreshTokenValue === intended.refreshToken ? "current" : "superseded";
+    }
+    return this.token === intended.token && !this.refreshTokenValue ? "current" : "superseded";
+  }
+  /** The canonical persisted pair, as a refresh result. */
+  canonicalPair(token) {
+    return {
+      token,
+      ...this.refreshTokenValue ? { refreshToken: this.refreshTokenValue } : {}
+    };
+  }
+  /** Current credentials plus the revision they were observed at. */
+  currentFence() {
+    return { token: this.token, refreshToken: this.refreshTokenValue };
+  }
+  /**
+   * Clear an access credential a 401 just proved unusable — but only while it
+   * is still the canonical one. A rotation committed by another context while
+   * the request was in flight is newer than this 401, so it must survive; the
+   * instance adopts it instead. The refresh entry is never touched here: a
+   * rejected access token says nothing about the refresh family.
+   */
+  invalidateAccessToken(spentToken) {
+    this.syncFromPersistedStorage();
+    if (this.token !== spentToken) return;
+    this.setToken(null);
+  }
+  /** Commit both credentials in one canonical write. */
+  setSession(token, refreshToken, options) {
+    this.token = token;
+    this.refreshTokenValue = refreshToken;
+    const committed = this.commitPersistedSession(
+      { token, refreshToken },
+      options
+    );
+    if (!committed) return false;
+    this.onTokenChange?.(this.token);
+    this.onRefreshTokenChange?.(this.refreshTokenValue);
+    return true;
+  }
+  /**
+   * Serialize rotation against every other context sharing the same storage
+   * key and API/tenant identity. Coordination is best-effort: when it is
+   * unavailable or times out the rotation still happens, so server-side reuse
+   * detection is never bypassed by a client that failed to coordinate.
+   */
+  async rotateAcrossContexts(intended) {
+    const lockName = this.refreshLockName;
+    const requestLock = lockName ? getRefreshLockRequester() : null;
+    if (!lockName || !requestLock) {
+      return this.rotateWithCanonicalState(intended);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REFRESH_LOCK_TIMEOUT);
+    let entered = false;
+    try {
+      return await requestLock(
+        lockName,
+        { signal: controller.signal },
+        async () => {
+          entered = true;
+          return this.rotateWithCanonicalState(intended);
+        }
+      );
+    } catch (error) {
+      if (entered) throw error;
+      return this.rotateWithCanonicalState(intended);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Decide, against freshly re-read canonical state, whether this context still
+   * owns the rotation.
+   */
+  async rotateWithCanonicalState(intended) {
+    let fence = intended;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const state = this.classifyCanonicalState(fence);
+      if (state === "cleared") throw new ApiError("Not authenticated", 401);
+      if (state === "current") return this._doRefreshToken(fence);
+      if (this.token) return this.canonicalPair(this.token);
+      fence = this.currentFence();
+    }
+    throw new ApiError("Not authenticated", 401);
+  }
+  async _doRefreshToken(intended) {
+    const init = intended.refreshToken ? {
       method: "POST",
-      body: JSON.stringify({ refreshToken: this.refreshTokenValue })
+      body: JSON.stringify({ refreshToken: intended.refreshToken })
     } : {
       method: "POST",
-      headers: { Authorization: `Bearer ${this.token}` }
+      headers: { Authorization: `Bearer ${intended.token}` }
     };
     const result = await this.requestJson(
       "/api/customers/refresh",
       init
     );
-    this.setToken(result.token);
-    if (result.refreshToken) this.setRefreshToken(result.refreshToken);
-    return result;
+    const state = this.classifyCanonicalState(intended);
+    if (state === "cleared") throw new ApiError("Not authenticated", 401);
+    if (state === "superseded") {
+      if (this.token) return this.canonicalPair(this.token);
+      throw new ApiError("Not authenticated", 401);
+    }
+    const replacedAccessToken = this.token !== null && this.token !== intended.token ? this.token : null;
+    const nextToken = replacedAccessToken ?? result.token;
+    const nextRefresh = result.refreshToken ?? null;
+    if (!this.setSession(nextToken, nextRefresh, { requireLiveSession: true })) {
+      throw new ApiError("Not authenticated", 401);
+    }
+    return {
+      token: nextToken,
+      ...nextRefresh ? { refreshToken: nextRefresh } : {}
+    };
   }
   /**
-   * Clear the stored token
+   * Clear local credentials synchronously. This compatibility API cannot
+   * revoke the server-side refresh family; use logoutAsync() for that.
+   * @deprecated Use logoutAsync() to end the direct server session.
    */
   logout() {
-    this.setToken(null);
-    this.setRefreshToken(null);
+    this.setSession(null, null);
+  }
+  /**
+   * End the current direct refresh family and clear local credentials even if
+   * revocation fails. A legacy access-only session has no refresh family here.
+   */
+  async logoutAsync() {
+    this.syncFromPersistedStorage();
+    const refreshToken = this.refreshTokenValue;
+    this.logout();
+    if (!refreshToken) return;
+    const operation2 = CUSTOMER_AUTH_ENDPOINT_OPERATIONS.revokeRefresh;
+    await this.requestJson(resolveOperationPath(operation2), {
+      method: resolveOperationMethod(operation2),
+      body: JSON.stringify({ refreshToken })
+    });
+  }
+  /** Archive the current password account and clear this client's credentials on success. */
+  async withdraw(currentPassword) {
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
+    const operation2 = CUSTOMER_AUTH_ENDPOINT_OPERATIONS.withdraw;
+    const result = await this.requestJson(
+      resolveOperationPath(operation2),
+      {
+        method: resolveOperationMethod(operation2),
+        headers: { Authorization: `Bearer ${token}` },
+        body: JSON.stringify({ currentPassword })
+      }
+    );
+    if (!result || typeof result.withdrawnAt !== "string" || !Number.isFinite(Date.parse(result.withdrawnAt)))
+      throw new ApiError("Invalid customer withdrawal response", 502);
+    this.logout();
+    return { withdrawnAt: result.withdrawnAt };
   }
   /**
    * Get the current authenticated customer's profile
    */
   async me() {
-    if (!this.token) return null;
+    const token = this.getToken();
+    if (!token) return null;
     try {
       const data = await this.requestJson(
         "/api/customers/me",
         {
           method: "GET",
-          headers: { Authorization: `Bearer ${this.token}` }
+          headers: { Authorization: `Bearer ${token}` }
         }
       );
       return data.customer ?? null;
     } catch (error) {
       if (error instanceof SDKError && error.status === 401) {
-        this.setToken(null);
+        this.invalidateAccessToken(token);
         return null;
       }
       throw error;
@@ -4021,12 +4499,13 @@ var CustomerAuth = class {
    * Update the authenticated customer's profile (name, phone, marketingConsent)
    */
   async updateProfile(data) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     const result = await this.requestJson(
       "/api/customers/me",
       {
         method: "PATCH",
-        headers: { Authorization: `Bearer ${this.token}` },
+        headers: { Authorization: `Bearer ${token}` },
         body: JSON.stringify(data)
       }
     );
@@ -4036,10 +4515,11 @@ var CustomerAuth = class {
    * Change the password of the currently authenticated customer
    */
   async changePassword(currentPassword, newPassword) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     await this.requestJson("/api/customers/change-password", {
       method: "POST",
-      headers: { Authorization: `Bearer ${this.token}` },
+      headers: { Authorization: `Bearer ${token}` },
       body: JSON.stringify({ currentPassword, newPassword })
     });
   }
@@ -4047,7 +4527,8 @@ var CustomerAuth = class {
    * Get the authenticated customer's orders with pagination and optional status filter
    */
   async getMyOrders(options) {
-    if (!this.token) throw new ApiError("Not authenticated", 401);
+    const token = this.getToken();
+    if (!token) throw new ApiError("Not authenticated", 401);
     const params = new URLSearchParams();
     if (options?.page) params.set("page", String(options.page));
     if (options?.limit) params.set("limit", String(options.limit));
@@ -4069,21 +4550,27 @@ var CustomerAuth = class {
       `/api/customers/me/orders${qs ? `?${qs}` : ""}`,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${this.token}` }
+        headers: { Authorization: `Bearer ${token}` }
       }
     );
     return validatePublicOrderList(result);
   }
   /**
-   * Get the current token (or null if not authenticated)
+   * Get the current token (or null if not authenticated).
+   *
+   * In persisted mode this re-reads shared storage first, so a rotation or
+   * logout performed by another tab is observed before the token is used.
    */
   getToken() {
+    this.syncFromPersistedStorage();
     return this.token;
   }
   /**
-   * Get the current refresh token (or null if unavailable)
+   * Get the current refresh token (or null if unavailable). Persisted mode
+   * re-reads shared storage first, like {@link CustomerAuth.getToken}.
    */
   getRefreshToken() {
+    this.syncFromPersistedStorage();
     return this.refreshTokenValue;
   }
   /**
@@ -4091,6 +4578,7 @@ var CustomerAuth = class {
    */
   setToken(token) {
     this.token = token;
+    this.commitPersistedSession({ token });
     this.onTokenChange?.(token);
   }
   /**
@@ -4098,13 +4586,14 @@ var CustomerAuth = class {
    */
   setRefreshToken(refreshToken) {
     this.refreshTokenValue = refreshToken;
+    this.commitPersistedSession({ refreshToken });
     this.onRefreshTokenChange?.(refreshToken);
   }
   /**
    * Check if the customer is currently authenticated
    */
   isAuthenticated() {
-    return this.token !== null;
+    return this.getToken() !== null;
   }
   /**
    * Internal: make a request with timeout and error handling.
@@ -4454,8 +4943,12 @@ var PaymentSessionApi = class extends CustomerScopedApi {
       ...Object.keys(headers).length > 0 && { headers }
     });
   }
-  async paymentSession(result, expectedProvider) {
-    return validatePublicPaymentSession(await result, expectedProvider);
+  async paymentSession(result, expectedProvider, operation2) {
+    return validatePublicPaymentSession(
+      await result,
+      expectedProvider,
+      operation2
+    );
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
@@ -4502,7 +4995,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
     const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
     return this.paymentSession(
       this.post(endpoint, body, idempotencyKey),
-      "toss"
+      "toss",
+      "cancel"
     );
   }
   cancelPortOne(params) {
@@ -4511,7 +5005,8 @@ var PaymentSessionApi = class extends CustomerScopedApi {
     const endpoint = this.serverTransport ? COMMERCE_ENDPOINTS.paymentSessions.server.cancel : COMMERCE_ENDPOINTS.paymentSessions.cancel;
     return this.paymentSession(
       this.post(endpoint, body, idempotencyKey),
-      "portone"
+      "portone",
+      "cancel"
     );
   }
   confirm(params) {
@@ -6952,7 +7447,11 @@ var COMMERCE_NOTIFICATION_EVENTS = [
   "returnCanceled",
   "returnCompleted",
   "paymentReconciliationRequired",
-  "paymentRefundRequiresAttention"
+  "paymentRefundRequiresAttention",
+  "membershipActivated",
+  "membershipPastDue",
+  "membershipExpired",
+  "membershipCancelled"
 ];
 function isStringOrNumber(value) {
   return typeof value === "string" || typeof value === "number";
@@ -6982,7 +7481,7 @@ function isCommerceNotificationEventName(value) {
   return typeof value === "string" && COMMERCE_NOTIFICATION_EVENTS.includes(value);
 }
 function isCommerceNotificationSourceCollection(value) {
-  return value === "orders" || value === "fulfillments" || value === "returns" || value === "payment-sessions" || value === "payment-refund-attempts";
+  return value === "orders" || value === "fulfillments" || value === "returns" || value === "payment-sessions" || value === "payment-refund-attempts" || value === "customer-memberships";
 }
 function isCommerceNotificationData(value) {
   if (!isRecord(value)) return false;
@@ -7002,6 +7501,10 @@ function isPaymentIncidentNotificationData(value, event) {
   const expectedReason = reconciliation ? "orderless_capture" : "local_commit_ambiguous";
   return value.source?.collection === expectedCollection && typeof value.source.id === "string" && value.source.id.length > 0 && typeof value.paymentSessionId === "string" && value.paymentSessionId.length > 0 && isRecord(value.providerObject) && typeof value.providerObject.provider === "string" && value.providerObject.provider.length > 0 && (value.providerObject.kind === "payment" || value.providerObject.kind === "refund") && typeof value.providerObject.id === "string" && value.providerObject.id.length > 0 && isRecord(value.money) && Number.isSafeInteger(value.money.amountMinor) && Number(value.money.amountMinor) > 0 && typeof value.money.currency === "string" && value.money.currency.length > 0 && value.status === expectedStatus && value.reason === expectedReason && typeof value.observedAt === "string" && value.observedAt.length > 0 && !Number.isNaN(Date.parse(value.observedAt)) && (value.checkoutId === void 0 || typeof value.checkoutId === "string" && value.checkoutId.length > 0) && (value.orderId === void 0 || typeof value.orderId === "string" && value.orderId.length > 0) && (reconciliation ? value.source.id === value.paymentSessionId && value.providerObject.kind === "payment" && value.refundAttemptId === void 0 : typeof value.refundAttemptId === "string" && value.refundAttemptId.length > 0 && value.source.id === value.refundAttemptId);
 }
+function isMembershipNotificationData(value, event) {
+  const expectedStatus = event === "membershipActivated" ? "active" : event === "membershipPastDue" ? "past_due" : event === "membershipExpired" ? "expired" : "cancelled";
+  return typeof value.membershipId === "string" && value.membershipId.length > 0 && typeof value.planId === "string" && value.planId.length > 0 && typeof value.customerId === "string" && value.customerId.length > 0 && typeof value.fromStatus === "string" && value.fromStatus.length > 0 && value.fromStatus !== value.toStatus && value.toStatus === expectedStatus && typeof value.occurredAt === "string" && !Number.isNaN(Date.parse(value.occurredAt));
+}
 function isWebhookCommerceNotificationChange(value) {
   if (!isRecord(value)) return false;
   return value.type === "notification" && value.source === "commerce-notifications" && isCommerceNotificationEventName(value.event) && isCommerceNotificationSourceCollection(value.sourceCollection) && isStringOrNumber(value.sourceId);
@@ -7050,6 +7553,9 @@ function isCommerceNotificationWebhookEvent(event) {
     const notificationSourceId = notification.event === "paymentReconciliationRequired" ? notification.paymentSessionId : notification.refundAttemptId;
     return sourceCollection === expectedCollection && typeof notification.paymentSessionId === "string" && notification.paymentSessionId === incidentData.paymentSessionId && typeof notificationSourceId === "string" && notificationSourceId === incidentData.source.id && matchesOptionalId(changeSourceId, incidentData.source.id);
   }
+  if (notification.event === "membershipActivated" || notification.event === "membershipPastDue" || notification.event === "membershipExpired" || notification.event === "membershipCancelled") {
+    return sourceCollection === "customer-memberships" && isMembershipNotificationData(data, notification.event) && typeof notification.membershipId === "string" && notification.membershipId === data.membershipId && matchesOptionalId(changeSourceId, data.membershipId);
+  }
   if (notification.event === "orderPaid" || notification.event === "orderCanceled" || notification.event === "orderDelivered") {
     return sourceCollection === "orders" && typeof notification.orderId === "string" && notification.orderId.length > 0 && matchesOptionalId(data.orderId, sourceId) && matchesOptionalId(notification.orderId, sourceId) && matchesOptionalId(data.orderId, notification.orderId) && matchesOptionalId(changeSourceId, data.orderId ?? notification.orderId);
   }
@@ -7146,9 +7652,7 @@ var INTERNAL_COLLECTIONS = [
   "audiences",
   "email-logs",
   "api-usage",
-  "tenant-analytics-daily",
-  "tenant-web-analytics-config",
-  "analytics-event-schemas",
+  "tenant-mcp-usage-daily",
   "subscriptions",
   "billing-history",
   "usage-rate-cards",
@@ -7167,6 +7671,8 @@ var INTERNAL_COLLECTIONS = [
   "fulfillment-events",
   "tenant-commerce-config",
   "customer-oauth-clients",
+  "customer-consent-receipts",
+  "customer-group-grants",
   "api-keys",
   "personal-access-tokens",
   "tenant-entitlements",
@@ -7184,6 +7690,7 @@ var INTERNAL_COLLECTIONS = [
   "event-admission-types",
   "customer-payment-methods",
   "tenant-payment-credentials",
+  "membership-unapplied-paid-evidence",
   "commerce-payment-accounts",
   "payment-provider-customer-aliases"
 ];
@@ -7566,200 +8073,6 @@ function getVideoMp4Url(playbackId, resolution = "high") {
   return `${MUX_STREAM_BASE}/${playbackId}/${resolution}.mp4`;
 }
 
-// src/analytics.ts
-function createAnalytics(config) {
-  if (typeof window === "undefined") {
-    return { pageview() {
-    }, track() {
-    }, destroy() {
-    } };
-  }
-  const endpoint = config.endpoint ?? `${resolveApiUrl()}/api/analytics/collect`;
-  const respectDnt = config.respectDnt !== false;
-  function isDntActive() {
-    if (!respectDnt) return false;
-    const nav = navigator;
-    return nav.doNotTrack === "1" || nav.globalPrivacyControl === true;
-  }
-  const isLocalHost = (() => {
-    try {
-      const h = location.hostname;
-      return h === "localhost" || h === "127.0.0.1" || h.endsWith(".local");
-    } catch {
-      return false;
-    }
-  })();
-  const mode = config.mode ?? "auto";
-  const sendSuppressed = mode === "development" || mode === "auto" && isLocalHost;
-  let suppressNoticeShown = false;
-  function devSuppressNotice() {
-    if (suppressNoticeShown) return;
-    suppressNoticeShown = true;
-    try {
-      console.info(
-        `[01 analytics] events disabled on local host (mode: '${mode}'). Pass mode: 'production' to send while developing.`
-      );
-    } catch {
-    }
-  }
-  let lastPath = null;
-  let lastAt = 0;
-  const autoTrack = config.autoTrack !== false;
-  const originalPushState = history.pushState;
-  const originalReplaceState = history.replaceState;
-  let destroyed = false;
-  function newEventId() {
-    return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : String(Date.now()) + String(Math.random());
-  }
-  function sendBeaconOrFetch(body) {
-    try {
-      if (typeof navigator.sendBeacon === "function") {
-        const blob = new Blob([body], { type: "text/plain" });
-        const sent = navigator.sendBeacon(endpoint, blob);
-        if (sent) return;
-      }
-      fetch(endpoint, {
-        method: "POST",
-        keepalive: true,
-        headers: { "Content-Type": "application/json" },
-        body
-      }).catch(() => {
-      });
-    } catch {
-    }
-  }
-  function sendPageview(pathname) {
-    if (isDntActive()) return;
-    const doc = document;
-    if (doc.prerendering === true || document.visibilityState === "prerender") return;
-    if (sendSuppressed) {
-      devSuppressNotice();
-      return;
-    }
-    const now = Date.now();
-    if (pathname === lastPath && now - lastAt < 500) return;
-    lastPath = pathname;
-    lastAt = now;
-    const body = JSON.stringify({
-      publishableKey: config.publishableKey,
-      pathname,
-      referrer: document.referrer || "",
-      eventId: newEventId(),
-      eventTs: Date.now()
-    });
-    sendBeaconOrFetch(body);
-  }
-  function trackCurrentPath() {
-    if (destroyed) return;
-    sendPageview(location.pathname);
-  }
-  function patchedPushState(data, unused, url) {
-    originalPushState.apply(this, [data, unused, url]);
-    if (!destroyed) setTimeout(trackCurrentPath, 0);
-  }
-  function patchedReplaceState(data, unused, url) {
-    originalReplaceState.apply(this, [data, unused, url]);
-    if (!destroyed) setTimeout(trackCurrentPath, 0);
-  }
-  if (autoTrack) {
-    history.pushState = patchedPushState;
-    history.replaceState = patchedReplaceState;
-    window.addEventListener("popstate", trackCurrentPath);
-    if (document.readyState === "complete") {
-      trackCurrentPath();
-    } else {
-      window.addEventListener("load", trackCurrentPath, { once: true });
-    }
-  }
-  const isProduction = !isLocalHost;
-  const warnedReasons = /* @__PURE__ */ new Set();
-  function devWarn(name, reason) {
-    if (isProduction) return;
-    if (warnedReasons.has(reason)) return;
-    warnedReasons.add(reason);
-    console.warn(`[01 analytics] dropped event ${name}: ${reason}`);
-  }
-  const EVENT_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_:-]{0,49}$/;
-  const RESERVED_PREFIXES = ["__", "_pv_"];
-  function validateEventName(name) {
-    if (!name || typeof name !== "string") return "name-empty";
-    for (const prefix of RESERVED_PREFIXES) {
-      if (name.startsWith(prefix)) return "name-reserved";
-    }
-    if (!EVENT_NAME_RE.test(name)) return "name-regex";
-    return null;
-  }
-  const PROP_KEY_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,31}$/;
-  function validateEventProps(props) {
-    if (props === void 0 || props === null) return null;
-    if (typeof props !== "object" || Array.isArray(props)) return "props-value-type";
-    const keys = Object.keys(props);
-    if (keys.length > 10) return "props-too-many-keys";
-    for (const k of keys) {
-      const v = props[k];
-      if (!PROP_KEY_RE.test(k)) return "props-key-regex";
-      if (typeof v === "string") {
-        if (v.length > 80) return "props-value-too-long";
-      } else if (typeof v === "number") {
-        if (!isFinite(v)) return "props-value-not-finite";
-      } else if (typeof v === "boolean") {
-      } else {
-        return "props-value-type";
-      }
-    }
-    return null;
-  }
-  return {
-    pageview(path) {
-      if (destroyed) return;
-      sendPageview(path ?? location.pathname);
-    },
-    track(name, props) {
-      if (destroyed) return;
-      if (isDntActive()) return;
-      const doc = document;
-      if (doc.prerendering === true || document.visibilityState === "prerender") return;
-      const nameErr = validateEventName(name);
-      if (nameErr) {
-        devWarn(name, nameErr);
-        return;
-      }
-      if (props !== void 0) {
-        const propsErr = validateEventProps(props);
-        if (propsErr) {
-          devWarn(name, propsErr);
-          return;
-        }
-      }
-      if (sendSuppressed) {
-        devSuppressNotice();
-        return;
-      }
-      const body = JSON.stringify({
-        publishableKey: config.publishableKey,
-        pathname: location.pathname,
-        referrer: document.referrer || "",
-        eventId: newEventId(),
-        eventName: name,
-        eventProps: props,
-        eventTs: Date.now()
-      });
-      sendBeaconOrFetch(body);
-    },
-    destroy() {
-      if (destroyed) return;
-      destroyed = true;
-      if (autoTrack) {
-        history.pushState = originalPushState;
-        history.replaceState = originalReplaceState;
-        window.removeEventListener("popstate", trackCurrentPath);
-      }
-      lastPath = null;
-      lastAt = 0;
-    }
-  };
-}
-
 // src/index.ts
 function createClient2(options) {
   return createClient(options);