@01.software/sdk 0.65.1 → 0.67.0

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @01.software/sdk
 
+## 0.67.0
+
+### Minor Changes
+
+- 79bec7b: Add events.listMyRegistrations() for paginated customer-authenticated event registration history with a PII-free DTO.
+
+  BREAKING (0.x minor): `createServerClient().events` now returns an object facade instead of an `EventsClient` instance, excluding the customer-only `listMyRegistrations` method. The existing `getRange`, `getAdmissionAvailability`, `register`, `getGuestRegistration`, and `cancelGuestRegistration` calls remain supported. Consumers that accept server event helpers should import `RootServerClientWithEvents` from `@01.software/sdk/server` and use `RootServerClientWithEvents['events']` instead of `EventsClient`. Replace `instanceof EventsClient` checks with checks for the methods they need (for example, `typeof events.getRange === 'function'`). For customer registration history in a server BFF, create a request-scoped `createClient({ publishableKey, customer: { persist: false, token } })`.
+
+### Patch Changes
+
+- 6d58a9c: Fix compiled Canvas template nodes with transparent backgrounds so their slug scope and transparent background classes remain separate tokens.
+- 40d78bd: Sync generated types for the optional, operator-only virtual adminTitle on commerce config and tenant metadata. Storefront metadata reads and persisted fields are unchanged.
+
+  Private singleton titles are omitted from publishable-key, customer, and service-credential responses, including requests with a coincident Console session. They use the response document's tenant authority. GraphQL returns null when this denied optional field is explicitly selected.
+
+- 5662849: Clarify the generated Link clickCount documentation: the field is read-only, and Console does not currently collect clicks automatically. Stored fields and access rules are unchanged.
+
+## 0.66.6
+
+### Patch Changes
+
+- 0599ab4: 기존 CustomerAuth 요청의 path/method를 공통 HTTP manifest에 연결합니다. 등록·로그인·refresh·profile·password 요청의 body, 인증, 응답 및 세션 동작은 유지합니다.
+
+## 0.66.5
+
+### Patch Changes
+
+- 604f443: Refresh generated community ban types to match the Admin Panel field order and temporary expiry guidance. The field types and API behavior are unchanged.
+
+## 0.66.4
+
+### Patch Changes
+
+- ed09398: Clarify that a blank sender display name uses the workspace name for commerce and event notifications, and document the hosted sign-in logo URL fallback.
+- c7b8803: Regenerate membership plan Payload declarations to match the Admin Panel's basic information field order. Field names, types, and fallback semantics are unchanged.
+- e879ec4: Update generated type documentation comments to call the account boundary a workspace in English descriptions. Type names, field names, collection slugs, and runtime behavior are unchanged.
+
+## 0.66.3
+
+### Patch Changes
+
+- 35568b4: Map stored video aspect-ratio enums to valid CSS ratios for VideoPlayer placeholders and ready players, preserving the 16/9 default and explicit style overrides. A stored ratio is now a valid inline `aspect-ratio`, so it takes precedence over an aspect ratio set through `className`; use `style.aspectRatio` or `placeholderStyle.aspectRatio` to override it.
+
+## 0.66.2
+
+### Patch Changes
+
+- 055cb8d: Synchronize generated internal payment-account types with optional Commerce market assignments. Account management remains SDK-internal; this adds no public payment API.
+
+## 0.66.1
+
+### Patch Changes
+
+- 8abfca5: Clarify that live-stream counters expose stored values and are not automatically aggregated by Console.
+- 167f186: Clarify generated customer address field guidance comments.
+
+## 0.66.0
+
+### Minor Changes
+
+- 29f068e: Add server-only `commerce.product.graphRevision` and `updateVariantPrices` for updating existing variant base prices without submitting the complete product graph. Keep one explicit content locale while reading the baseline, reviewing current values, writing, and independently reading back. Conflicts require a fresh review; the helper does not retry, refresh the revision, or fall back to upsert. Stock, deletes, options, and market prices are excluded. Existing PATCH receipts, projection warnings, and conflict metadata remain available.
+
+### Patch Changes
+
+- fbb0715: Add optional closed-month observation quality metadata to the generated internal usage snapshot type.
+- 62d1c63: Classify platform billing consent receipts as an internal Console collection.
+- a9ca714: Synchronize generated usage invoice types with the private, transition-gated precharge notice protocol fields.
+
 ## 0.65.1
 
 ### Patch Changes

package/README.md

@@ -96,6 +96,12 @@ monthly allowance is exhausted or 503 when admission cannot be verified.
 legacy public-ID paths for unmigrated paid assets. A signed asset's retained
 `muxPlaybackId` is historical usage evidence and is not a playable URL.
 
+`VideoPlayer` displays the stored `aspectRatio` values `16_9`, `9_16`,
+`4_3`, and `1_1` as CSS ratios in both the placeholder and ready player.
+An unset ratio defaults to `16/9`. Override the ready player with
+`style.aspectRatio`, or the placeholder with `placeholderStyle.aspectRatio`;
+each override applies only to its own rendering path.
+
 `CanvasRenderer` renders reserved `shape` nodes (`terminator`, `process`,
 `decision`, `io`, `subprocess`) with first-party SVG geometry, without a tenant
 catalog row or QuickJS template.
@@ -751,6 +757,10 @@ const prepared = await server.memberships.subscribe({
 })
 
 if (prepared.status === 'incomplete') {
+  const expiresAt = Date.parse(prepared.firstCharge.expiresAt)
+  if (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) {
+    throw new Error('First charge instruction expired or invalid')
+  }
   await tenantPsp.charge({
     idempotencyKey: prepared.firstCharge.idempotencyKey,
     amount: prepared.firstCharge.amount,
@@ -767,8 +777,8 @@ posts the signed outcome through the configured charge-result webhook. A trial
 response is immediately `trialing` and has no `firstCharge` field. Before a paid
 subscribe, configure an active delegated billing connection for
 the tenant; otherwise Console returns `409 conflict` without lifecycle writes.
-Do not start
-the PSP payment at or after `expiresAt`; deduplicate PSP work with
+Do not start the PSP payment if `expiresAt` is invalid or the current time is
+at or after it; deduplicate PSP work with
 `firstCharge.idempotencyKey`. A late paid result remains evidence but cannot
 activate the Membership, so the tenant handles any refund outside this API. Replays use
 the same plan, price, customer reference, and idempotency key while the first
@@ -1869,6 +1879,55 @@ options, option values, and variants. It is the tenant-admin safe path because
 it applies the product/option/variant transaction that raw collection writes do
 not provide.
 
+For an existing variant's **base price only**, use the server-only narrow helper:
+
+```typescript
+const locale = 'ko'
+const baseline = await server.commerce.product.graphRevision({
+  productId,
+  locale,
+})
+// Review current base prices after taking the baseline, in the same locale.
+const current = await server.collections.from('product-variants').find({
+  where: { product: { equals: productId } },
+  locale,
+})
+const variantId = current.docs[0].id
+const saved = await server.commerce.product.updateVariantPrices({
+  productId,
+  locale,
+  graphRevision: baseline.graphRevision,
+  updates: [{ id: variantId, price: 1250 }],
+})
+// Independent readback; this does not replace the revision of an older draft.
+const readback = await server.collections
+  .from('product-variants')
+  .findById(variantId, { locale })
+if (saved.productProjectionStale) {
+  console.warn('Prices saved; product listing projection may still be stale.')
+}
+```
+
+`graphRevision()` returns only `{ productId, graphRevision }` from a private,
+no-store server read. `updateVariantPrices()` sends only the supplied existing
+rows to the variants PATCH and returns its `ok`, `productId`, `updated`,
+`deleted`, and `productProjectionStale` fields unchanged. It accepts 1–250
+`{ id, price }` rows; price uses the existing numeric shop-currency amount,
+with currency precision enforced by Console. Stock, deletions, option changes,
+compare-at prices, and market prices are rejected as SDK inputs. They are not
+silently stripped or sent. Full graph upsert remains a separate operation.
+
+Use the same explicit enabled content `locale` (`ko` or `en`) for baseline,
+value review, save, and readback. A `409 graph_conflict` requires reviewing fresh
+values before a deliberate new edit; the SDK never fetches a replacement
+revision, retries the PATCH, or falls back to upsert. The existing conflict
+fields remain at `SDKError.details.body.currentGraphRevision` and
+`SDKError.details.body.currentGraphUpdatedAt`, together with
+`apiReason` and `requestId`. Read-only service keys can read the revision but
+cannot change prices; operator/PAT tenant roles and tenant pinning still apply.
+A saved projection warning reports committed graph data, not a failed save or
+permission to repeat the write.
+
 `commerce.product.upsert()` is a graph-write API. For Console product
 documents, Payload saves product fields first; upsert receives `productId`,
 `graphRevision` (required when updating an existing product via `productId` -
@@ -2046,6 +2105,24 @@ replacement API. Pass an empty list to clear codes. Singular `admission`,
 Browser `mine()`/`merge({ guestCartToken })` derive customer identity from the
 JWT; server calls require an explicit `customerToken`.
 
+### Customer event registration history
+
+After customer sign-in, `client.events.listMyRegistrations({ page: 1, limit: 10 })`
+returns only that session's registrations with status, quantity, created time,
+and event/occurrence references plus current public title/time metadata.
+`page` defaults to 1; `limit` defaults to 10 and is capped at 100. The result has
+`docs`, `totalDocs`, `limit`, `page`, `totalPages`, `hasNextPage`, `hasPrevPage`.
+A customer JWT and matching publishable key are required; server keys cannot
+impersonate customers. Reads and responses use `no-store`. Non-public/missing
+metadata becomes null while registration references/status remain. PII expiry
+and cleanup preserve the same attendee-free DTO. Guest credentials, answers,
+audit fields and locations are absent; same-email guest records are not linked.
+
+`createServerClient().events` excludes this customer-only method, following the
+customer-only membership/profile/order helpers. A server BFF creates a client
+per request with `createClient({ publishableKey, customer: { persist: false, token } })`
+and calls `client.events.listMyRegistrations()` with the customer's JWT.
+
 ### Community public reads
 
 Use the shaped `community` helpers for browser/customer community screens. A

package/dist/client.cjs

@@ -1418,7 +1418,9 @@ var COMMERCE_ENDPOINT_OPERATIONS = {
     ),
     stockCheck: operation("products", "post", "/stock-check"),
     stockSnapshot: operation("products", "get", "/stock"),
-    upsert: operation("products", "post", "/upsert")
+    upsert: operation("products", "post", "/upsert"),
+    graphRevision: operation("products", "get", "/:id/graph-revision"),
+    variantsPatch: operation("products", "patch", "/:id/variants")
   },
   orders: {
     create: operation("orders", "post", "/create"),
@@ -1587,6 +1589,14 @@ var CUSTOMER_GROUP_ENDPOINT_OPERATIONS = {
   revoke: operation("customer-groups", "post", "/:id/members/revoke")
 };
 var CUSTOMER_AUTH_ENDPOINT_OPERATIONS = {
+  register: operation("customers", "post", "/register"),
+  login: operation("customers", "post", "/login"),
+  refresh: operation("customers", "post", "/refresh"),
+  me: operation("customers", "get", "/me"),
+  updateProfile: operation("customers", "patch", "/me"),
+  forgotPassword: operation("customers", "post", "/forgot-password"),
+  resetPassword: operation("customers", "post", "/reset-password"),
+  changePassword: operation("customers", "post", "/change-password"),
   revokeRefresh: operation("customers", "post", "/revoke-refresh"),
   withdraw: operation("customers", "post", "/withdraw")
 };
@@ -1596,6 +1606,9 @@ var EMBEDDED_ADMIN_ENDPOINT_OPERATIONS = {
   disable: operation("tenants", "delete", "/embedded-admin-app")
 };
 var EVENTS_ENDPOINT_OPERATIONS = {
+  registrations: {
+    listMine: operation("event-registrations", "get", "/my")
+  },
   events: {
     convertSchedule: operation("events", "post", "/:id/schedule")
   },
@@ -4021,19 +4034,24 @@ var CustomerAuth = class {
    * Register a new customer account
    */
   async register(data) {
-    return this.requestJson("/api/customers/register", {
-      method: "POST",
-      body: JSON.stringify(data)
-    });
+    return this.requestJson(
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.register),
+      {
+        method: resolveOperationMethod(
+          CUSTOMER_AUTH_ENDPOINT_OPERATIONS.register
+        ),
+        body: JSON.stringify(data)
+      }
+    );
   }
   /**
    * Login with email and password. Stores the token internally.
    */
   async login(data) {
     const result = await this.requestJson(
-      "/api/customers/login",
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.login),
       {
-        method: "POST",
+        method: resolveOperationMethod(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.login),
         body: JSON.stringify(data)
       }
     );
@@ -4279,14 +4297,18 @@ var CustomerAuth = class {
   }
   async _doRefreshToken(intended) {
     const init = intended.refreshToken ? {
-      method: "POST",
+      method: resolveOperationMethod(
+        CUSTOMER_AUTH_ENDPOINT_OPERATIONS.refresh
+      ),
       body: JSON.stringify({ refreshToken: intended.refreshToken })
     } : {
-      method: "POST",
+      method: resolveOperationMethod(
+        CUSTOMER_AUTH_ENDPOINT_OPERATIONS.refresh
+      ),
       headers: { Authorization: `Bearer ${intended.token}` }
     };
     const result = await this.requestJson(
-      "/api/customers/refresh",
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.refresh),
       init
     );
     const state = this.classifyCanonicalState(intended);
@@ -4355,9 +4377,9 @@ var CustomerAuth = class {
     if (!token) return null;
     try {
       const data = await this.requestJson(
-        "/api/customers/me",
+        resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.me),
         {
-          method: "GET",
+          method: resolveOperationMethod(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.me),
           headers: { Authorization: `Bearer ${token}` }
         }
       );
@@ -4374,19 +4396,29 @@ var CustomerAuth = class {
    * Request a password reset email
    */
   async forgotPassword(email) {
-    await this.requestJson("/api/customers/forgot-password", {
-      method: "POST",
-      body: JSON.stringify({ email })
-    });
+    await this.requestJson(
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.forgotPassword),
+      {
+        method: resolveOperationMethod(
+          CUSTOMER_AUTH_ENDPOINT_OPERATIONS.forgotPassword
+        ),
+        body: JSON.stringify({ email })
+      }
+    );
   }
   /**
    * Reset password using a token from the reset email
    */
   async resetPassword(token, password) {
-    await this.requestJson("/api/customers/reset-password", {
-      method: "POST",
-      body: JSON.stringify({ token, password })
-    });
+    await this.requestJson(
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.resetPassword),
+      {
+        method: resolveOperationMethod(
+          CUSTOMER_AUTH_ENDPOINT_OPERATIONS.resetPassword
+        ),
+        body: JSON.stringify({ token, password })
+      }
+    );
   }
   /**
    * Update the authenticated customer's profile (name, phone, marketingConsent)
@@ -4395,9 +4427,11 @@ var CustomerAuth = class {
     const token = this.getToken();
     if (!token) throw new ApiError("Not authenticated", 401);
     const result = await this.requestJson(
-      "/api/customers/me",
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.updateProfile),
       {
-        method: "PATCH",
+        method: resolveOperationMethod(
+          CUSTOMER_AUTH_ENDPOINT_OPERATIONS.updateProfile
+        ),
         headers: { Authorization: `Bearer ${token}` },
         body: JSON.stringify(data)
       }
@@ -4410,11 +4444,16 @@ var CustomerAuth = class {
   async changePassword(currentPassword, newPassword) {
     const token = this.getToken();
     if (!token) throw new ApiError("Not authenticated", 401);
-    await this.requestJson("/api/customers/change-password", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}` },
-      body: JSON.stringify({ currentPassword, newPassword })
-    });
+    await this.requestJson(
+      resolveOperationPath(CUSTOMER_AUTH_ENDPOINT_OPERATIONS.changePassword),
+      {
+        method: resolveOperationMethod(
+          CUSTOMER_AUTH_ENDPOINT_OPERATIONS.changePassword
+        ),
+        headers: { Authorization: `Bearer ${token}` },
+        body: JSON.stringify({ currentPassword, newPassword })
+      }
+    );
   }
   /**
    * Get the authenticated customer's orders with pagination and optional status filter
@@ -6212,6 +6251,18 @@ var EventsClient = class {
       { useCustomerAuth: false }
     );
   }
+  listMyRegistrations(params = {}) {
+    const query = new URLSearchParams();
+    if (params.page !== void 0) query.set("page", String(params.page));
+    if (params.limit !== void 0) query.set("limit", String(params.limit));
+    const operation2 = EVENTS_ENDPOINT_OPERATIONS.registrations.listMine;
+    return this.execute(
+      resolveOperationPath(operation2, { query }),
+      resolveOperationMethod(operation2),
+      void 0,
+      { useCustomerAuth: true, noStore: true }
+    );
+  }
   register(params) {
     return this.execute(
       "/api/event-registrations/register",
@@ -6242,6 +6293,7 @@ var EventsClient = class {
     try {
       const response = await httpFetch(endpoint, {
         method,
+        ...options.noStore && { cache: "no-store" },
         apiUrl: this.apiUrl,
         publishableKey: this.publishableKey,
         ...useCustomerAuth && token ? { customerToken: token } : {},