@01.software/sdk 0.70.1 → 0.72.1

package/dist/server.js

@@ -85,6 +85,7 @@ var COMMERCE_ERROR_CODES = [
   "cart_not_active",
   "cart_locked",
   "cart_empty",
+  "shipping_address_required",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
@@ -101,6 +102,7 @@ var COMMERCE_ERROR_CODES = [
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "credit_insufficient",
   "reservation_conflict",
   "stock_lock_unavailable",
   "variant_not_found",
@@ -564,6 +566,8 @@ async function parseErrorBody(response) {
   try {
     const body = await response.json();
     const reason = typeof body.reason === "string" ? body.reason : typeof body.code === "string" ? body.code : void 0;
+    const payloadErrorReason = Array.isArray(body.errors) ? readPayloadErrorReason(body.errors) : void 0;
+    const payloadReasonField = payloadErrorReason !== void 0 ? { payloadErrorReason } : {};
     if (body.errors && Array.isArray(body.errors)) {
       const fieldErrors = [];
       for (const e of body.errors) {
@@ -586,6 +590,7 @@ async function parseErrorBody(response) {
           errorMessage: `HTTP ${response.status}: ${details}`,
           userMessage: details,
           reason,
+          ...payloadReasonField,
           body,
           errors: fieldErrors.length > 0 ? fieldErrors : body.errors
         };
@@ -596,6 +601,7 @@ async function parseErrorBody(response) {
         errorMessage: `HTTP ${response.status}: ${body.error}`,
         userMessage: body.error,
         reason,
+        ...payloadReasonField,
         body
       };
     }
@@ -604,14 +610,23 @@ async function parseErrorBody(response) {
         errorMessage: `HTTP ${response.status}: ${body.message}`,
         userMessage: body.message,
         reason,
+        ...payloadReasonField,
         body
       };
     }
-    return { ...fallback, reason, body };
+    return { ...fallback, reason, ...payloadReasonField, body };
   } catch {
     return fallback;
   }
 }
+function readPayloadErrorReason(errors) {
+  const data = errors[0]?.data;
+  if (!data || typeof data !== "object") return void 0;
+  const { reason, code } = data;
+  if (typeof reason === "string") return reason;
+  if (typeof code === "string") return code;
+  return void 0;
+}
 function getParsedErrorSuggestion(status, parsed) {
   if (status === 403 && parsed.reason === "origin_not_allowed") {
     return "Add the request origin to the tenant Browser API origins, then retry the browser request.";
@@ -657,7 +672,10 @@ function mapResponseToError(status, parsed, details, requestId, retryAfter, cano
     if (retryAfter !== void 0) {
       Object.assign(withRequestId, { retryAfter });
     }
-    return canonicalCommerceError ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(withRequestId, parsed.reason);
+    return canonicalCommerceError ? enhanceCommerceError(withRequestId, parsed.body, requestId) : enhanceNonCommerceError(
+      withRequestId,
+      parsed.reason ?? parsed.payloadErrorReason
+    );
   };
   if (status === 400 || status === 422) {
     return finalize(
@@ -1076,6 +1094,7 @@ async function parseApiResponse(response, endpoint, options = {}) {
 // ../../internal/http-contracts/src/index.ts
 var operationBrand = /* @__PURE__ */ Symbol("sdk-http-operation");
 var PORTONE_STANDARD_ACTION_CAPABILITIES_MEDIA_TYPE = "application/vnd.01software.portone-action-capabilities.v1+json";
+var CUSTOMER_CREDIT_FUNDING_MEDIA_TYPE = "application/vnd.01software.credit-funding.v1+json";
 var operation = (collection, method, path, errorFamily) => Object.freeze({
   [operationBrand]: true,
   collection,
@@ -1239,6 +1258,11 @@ var portOneStandardActionCapabilityOperations = /* @__PURE__ */ new Set([
 ]);
 var MEMBERSHIP_ENDPOINT_OPERATIONS = {
   subscribe: operation(null, "post", "/memberships/subscribe"),
+  endSubscribeIntent: operation(
+    null,
+    "post",
+    "/memberships/subscribe-intent/end"
+  ),
   billingCustody: operation(null, "post", "/memberships/billing-custody"),
   cancel: operation(null, "post", "/memberships/:id/cancel"),
   me: operation(null, "get", "/memberships/me"),
@@ -1284,6 +1308,19 @@ var BENEFIT_VOUCHER_ENDPOINT_OPERATIONS = {
   void: operation("customers", "post", "/benefit-vouchers/void"),
   listMine: operation("customers", "get", "/me/benefit-vouchers")
 };
+var CUSTOMER_CREDIT_ENDPOINT_OPERATIONS = {
+  grant: strictCommerceOperation("customers", "post", "/credits/grant"),
+  getGrant: strictCommerceOperation("customers", "post", "/credits/get-grant"),
+  getAccount: strictCommerceOperation("customers", "post", "/credits/account"),
+  revoke: strictCommerceOperation("customers", "post", "/credits/revoke"),
+  mine: strictCommerceOperation("customers", "get", "/me/credits"),
+  history: strictCommerceOperation("customers", "get", "/me/credits/history"),
+  configure: strictCommerceOperation(
+    "customers",
+    "post",
+    "/credits/configuration"
+  )
+};
 var CUSTOMER_GROUP_ENDPOINT_OPERATIONS = {
   members: operation("customer-groups", "get", "/:id/members"),
   grant: operation("customer-groups", "post", "/:id/members/grant"),
@@ -1703,6 +1740,179 @@ var BenefitVouchersApi = class extends BaseApi {
   }
 };
 
+// src/core/api/customer-credit-types.ts
+function parseCustomerCreditAccount(value) {
+  const data = object2(value, ["summary", "history"]);
+  return {
+    summary: parseMyCustomerCredits(data.summary),
+    history: parseMyCustomerCreditHistory(data.history)
+  };
+}
+function invalid() {
+  throw createApiError("Invalid customer credit response", 502);
+}
+function object2(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(value, key)))
+    invalid();
+  return value;
+}
+function money(value) {
+  return typeof value === "string" && /^(0|[1-9][0-9]*)$/.test(value);
+}
+function uuid2(value) {
+  return typeof value === "string" && /^([0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i.test(
+    value
+  );
+}
+function time2(value) {
+  if (typeof value !== "string") return false;
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?Z$/.exec(value);
+  if (!match) return false;
+  const [, year, month, day, hour, minute, second = "0"] = match;
+  const y = Number(year), m = Number(month), d = Number(day);
+  const days = [
+    31,
+    y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0) ? 29 : 28,
+    31,
+    30,
+    31,
+    30,
+    31,
+    31,
+    30,
+    31,
+    30,
+    31
+  ];
+  return m >= 1 && m <= 12 && d >= 1 && d <= days[m - 1] && Number(hour) < 24 && Number(minute) < 60 && Number(second) < 60;
+}
+var states = ["available", "held", "spent", "expired", "revoked"];
+function balances(value) {
+  const data = object2(value, states);
+  if (states.some((key) => !money(data[key]))) invalid();
+}
+function page(value) {
+  if (value.currency !== "KRW" || !time2(value.evaluatedAt) || !Number.isSafeInteger(value.page) || value.page < 1 || typeof value.hasNextPage !== "boolean")
+    invalid();
+}
+function parseCustomerCreditGrant(value) {
+  const data = object2(value, [
+    "id",
+    "customerId",
+    "templateId",
+    "templateVersion",
+    "mode",
+    "maximum",
+    "amount",
+    "currency",
+    "validityDays",
+    "grantedAt",
+    "expiresAt",
+    "sourceNamespace",
+    "sourceRef"
+  ]);
+  if (!uuid2(data.id) || !uuid2(data.customerId) || !uuid2(data.templateId) || !Number.isSafeInteger(data.templateVersion) || data.templateVersion < 1 || !["fixed", "bounded"].includes(data.mode) || !money(data.maximum) || !money(data.amount) || data.currency !== "KRW" || !Number.isInteger(data.validityDays) || data.validityDays < 1 || data.validityDays > 1825 || !time2(data.grantedAt) || !time2(data.expiresAt) || typeof data.sourceNamespace !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/.test(data.sourceNamespace) || typeof data.sourceRef !== "string" || !data.sourceRef.length || data.sourceRef.length > 256 || // eslint-disable-next-line no-control-regex -- The public source identity explicitly forbids ASCII control characters.
+  /[\u0000-\u001f\u007f]/.test(data.sourceRef))
+    invalid();
+  return value;
+}
+function parseRevokeCustomerCredit(value) {
+  const data = object2(value, ["revoked", "pending", "spent"]);
+  if (!money(data.revoked) || !money(data.pending) || !money(data.spent))
+    invalid();
+  return value;
+}
+function parseMyCustomerCredits(value) {
+  const data = object2(value, [
+    "currency",
+    "evaluatedAt",
+    "granted",
+    "balances",
+    "buckets",
+    "page",
+    "hasNextPage"
+  ]);
+  page(data);
+  balances(data.balances);
+  if (!money(data.granted) || !Array.isArray(data.buckets) || data.buckets.length > 50)
+    invalid();
+  for (const value2 of data.buckets) {
+    const bucket = object2(value2, [
+      "id",
+      "grantId",
+      "kind",
+      "grantedAt",
+      "expiresAt",
+      "isRevoked",
+      "balances"
+    ]);
+    if (!uuid2(bucket.id) || !uuid2(bucket.grantId) || !["original", "grace"].includes(bucket.kind) || !time2(bucket.grantedAt) || !time2(bucket.expiresAt) || typeof bucket.isRevoked !== "boolean")
+      invalid();
+    balances(bucket.balances);
+  }
+  return value;
+}
+function parseMyCustomerCreditHistory(value) {
+  const data = object2(value, [
+    "currency",
+    "evaluatedAt",
+    "entries",
+    "page",
+    "hasNextPage"
+  ]);
+  page(data);
+  if (!Array.isArray(data.entries) || data.entries.length > 50) invalid();
+  for (const value2 of data.entries) {
+    const entry = object2(value2, [
+      "id",
+      "grantId",
+      "kind",
+      "amount",
+      "fromState",
+      "toState",
+      "createdAt"
+    ]);
+    if (!uuid2(entry.id) || !uuid2(entry.grantId) || !money(entry.amount) || !time2(entry.createdAt) || ![
+      "grant",
+      "reserve",
+      "consume",
+      "release",
+      "restore",
+      "expire",
+      "revoke"
+    ].includes(entry.kind) || entry.fromState !== null && !states.includes(entry.fromState) || entry.toState !== null && !states.includes(entry.toState))
+      invalid();
+  }
+  return value;
+}
+
+// src/core/api/credits-api.ts
+var CreditsApi = class extends BaseApi {
+  constructor(options) {
+    super("CreditsApi", options);
+  }
+  async grant(input) {
+    return parseCustomerCreditGrant(
+      await this.requestEndpoint(CUSTOMER_CREDIT_ENDPOINT_OPERATIONS.grant, input)
+    );
+  }
+  async getGrant(input) {
+    return parseCustomerCreditGrant(
+      await this.requestEndpoint(CUSTOMER_CREDIT_ENDPOINT_OPERATIONS.getGrant, input)
+    );
+  }
+  async getAccount(input) {
+    return parseCustomerCreditAccount(
+      await this.requestEndpoint(CUSTOMER_CREDIT_ENDPOINT_OPERATIONS.getAccount, input)
+    );
+  }
+  async revoke(input) {
+    return parseRevokeCustomerCredit(
+      await this.requestEndpoint(CUSTOMER_CREDIT_ENDPOINT_OPERATIONS.revoke, input)
+    );
+  }
+};
+
 // src/core/collection/http-client.ts
 import { stringify } from "qs-esm";
 function validateWhere(where) {
@@ -1954,6 +2164,9 @@ function resolveMetaImage(ref) {
 }
 
 // src/core/collection/query-builder.ts
+function toWriteOptions(options) {
+  return options?.locale === void 0 ? void 0 : { locale: options.locale };
+}
 var CollectionQueryBuilder = class {
   constructor(api, collection) {
     this.api = api;
@@ -1984,36 +2197,50 @@ var CollectionQueryBuilder = class {
   /**
    * Create a new document
    * POST /api/{collection}
+   * Pass `locale` to write localized fields in a tenant-enabled locale.
    * @returns Payload CMS mutation response with doc and message
    */
   async create(data, options) {
     const endpoint = `/api/${String(this.collection)}`;
+    const writeOptions = toWriteOptions(options);
     if (options?.file) {
       return this.api.requestCreateWithFile(
         endpoint,
         data,
         options.file,
-        options.filename
+        options.filename,
+        writeOptions
       );
     }
-    return this.api.requestCreate(endpoint, data);
+    return this.api.requestCreate(
+      endpoint,
+      data,
+      writeOptions
+    );
   }
   /**
    * Update a document by ID
    * PATCH /api/{collection}/{id}
+   * Pass `locale` to write localized fields in a tenant-enabled locale.
    * @returns Payload CMS mutation response with doc and message
    */
   async update(id, data, options) {
     const endpoint = `/api/${String(this.collection)}/${String(id)}`;
+    const writeOptions = toWriteOptions(options);
     if (options?.file) {
       return this.api.requestUpdateWithFile(
         endpoint,
         data,
         options.file,
-        options.filename
+        options.filename,
+        writeOptions
       );
     }
-    return this.api.requestUpdate(endpoint, data);
+    return this.api.requestUpdate(
+      endpoint,
+      data,
+      writeOptions
+    );
   }
   /**
    * Count documents
@@ -2057,10 +2284,11 @@ var CollectionQueryBuilder = class {
    * PATCH /api/{collection}
    * @returns Payload CMS find response with updated docs
    */
-  async updateMany(where, data) {
+  async updateMany(where, data, options) {
     return this.api.requestUpdateMany(
       `/api/${String(this.collection)}`,
-      { where, data }
+      { where, data },
+      toWriteOptions(options)
     );
   }
   /**
@@ -2155,8 +2383,9 @@ var CollectionClient = class extends HttpClient {
    * Create document
    * POST /api/{collection}
    */
-  async requestCreate(endpoint, data) {
-    const response = await this.fetchWithTracking(endpoint, {
+  async requestCreate(endpoint, data, options) {
+    const url = this.buildUrl(endpoint, options);
+    const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "POST",
       body: data ? JSON.stringify(data) : void 0
@@ -2167,8 +2396,9 @@ var CollectionClient = class extends HttpClient {
    * Update document
    * PATCH /api/{collection}/{id}
    */
-  async requestUpdate(endpoint, data) {
-    const response = await this.fetchWithTracking(endpoint, {
+  async requestUpdate(endpoint, data, options) {
+    const url = this.buildUrl(endpoint, options);
+    const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "PATCH",
       body: data ? JSON.stringify(data) : void 0
@@ -2191,8 +2421,8 @@ var CollectionClient = class extends HttpClient {
    * Update multiple documents (bulk update)
    * PATCH /api/{collection}
    */
-  async requestUpdateMany(endpoint, data) {
-    const url = this.buildUrl(endpoint, { where: data.where });
+  async requestUpdateMany(endpoint, data, options) {
+    const url = this.buildUrl(endpoint, { where: data.where, ...options });
     const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "PATCH",
@@ -2228,8 +2458,9 @@ var CollectionClient = class extends HttpClient {
    * Create document with file upload
    * POST /api/{collection} (multipart/form-data)
    */
-  async requestCreateWithFile(endpoint, data, file, filename) {
-    const response = await this.fetchWithTracking(endpoint, {
+  async requestCreateWithFile(endpoint, data, file, filename, options) {
+    const url = this.buildUrl(endpoint, options);
+    const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "POST",
       body: buildPayloadFormData(data, file, filename)
@@ -2240,8 +2471,9 @@ var CollectionClient = class extends HttpClient {
    * Update document with file upload
    * PATCH /api/{collection}/{id} (multipart/form-data)
    */
-  async requestUpdateWithFile(endpoint, data, file, filename) {
-    const response = await this.fetchWithTracking(endpoint, {
+  async requestUpdateWithFile(endpoint, data, file, filename, options) {
+    const url = this.buildUrl(endpoint, options);
+    const response = await this.fetchWithTracking(url, {
       ...this.defaultOptions,
       method: "PATCH",
       body: buildPayloadFormData(data, file, filename)
@@ -2497,11 +2729,11 @@ var CommunityClient = class extends RawCustomerScopedApi {
    * - `rootComment`: comments belonging to a thread rooted at that comment.
    */
   listComments(params) {
-    const { postId, page, limit, rootComment, topLevelOnly, sort } = params;
+    const { postId, page: page2, limit, rootComment, topLevelOnly, sort } = params;
     return this.execute(
       this.buildCommentsListQuery({
         postId,
-        page,
+        page: page2,
         limit,
         rootComment,
         topLevelOnly,
@@ -2512,11 +2744,11 @@ var CommunityClient = class extends RawCustomerScopedApi {
   }
   /** Direct replies to a comment (`where[parent][equals]`). */
   listReplies(params) {
-    const { commentId, page, limit, sort } = params;
+    const { commentId, page: page2, limit, sort } = params;
     return this.execute(
       this.buildCommentsListQuery({
         parentId: commentId,
-        page,
+        page: page2,
         limit,
         sort
       }),
@@ -2700,7 +2932,18 @@ var ABANDONED_REASONS = ["expired", "customer", "operator"];
 function managedPaymentProviders(providers) {
   return providers;
 }
-var PAYMENT_PROVIDERS = managedPaymentProviders(["toss", "portone"]);
+var PAYMENT_PROVIDERS = managedPaymentProviders([
+  "toss",
+  "portone",
+  "stripe"
+]);
+var CANCEL_RECOVERY_METHODS = {
+  toss: "cancel()",
+  portone: "cancelPortOne()",
+  stripe: null
+};
+var STRIPE_RETURN_URL_RAW_CHARACTERS = /^[^\s\u0000-\u001F\u007F\\]+$/;
+var STRIPE_RETURN_URL_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]+(?:[/?#]|$)/;
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2761,11 +3004,8 @@ function fail(resource, path, expected) {
   invalidCanonicalResponse(resource, { path, expected });
 }
 function providerMismatch(resource, expected, actual, operation2) {
-  if (operation2 === "cancel") {
-    const method = {
-      toss: "cancel()",
-      portone: "cancelPortOne()"
-    }[actual];
+  const method = CANCEL_RECOVERY_METHODS[actual];
+  if (operation2 === "cancel" && method !== null) {
     throw createApiError(
       `Canonical ${resource} response provider mismatch: expected ${expected}, received ${actual}.`,
       502,
@@ -2794,6 +3034,17 @@ function exact(value, required, optional, resource, path) {
   const unexpected = Object.keys(value).find((key) => !allowed.has(key));
   if (unexpected) fail(resource, `${path}.${unexpected}`, "no unknown fields");
 }
+function responseExtensionKeys(value, keys, resource, path) {
+  if (!keys.some((key) => Object.prototype.hasOwnProperty.call(value, key)))
+    return [];
+  enumValue(
+    value.deliveryMethod,
+    ["shipping", "pickup"],
+    resource,
+    `${path}.deliveryMethod`
+  );
+  return [...keys];
+}
 function string(value, resource, path) {
   if (typeof value !== "string" || value.length === 0) {
     fail(resource, path, "non-empty string");
@@ -3148,6 +3399,12 @@ function validatePublicCart(value, resource = "Cart") {
   exact(
     cart,
     [
+      ...responseExtensionKeys(
+        cart,
+        ["deliveryMethod", "shippingMinor", "totalMinor"],
+        resource,
+        "$"
+      ),
       "id",
       "status",
       "revision",
@@ -3218,6 +3475,13 @@ function validatePublicCart(value, resource = "Cart") {
   if (expectedSubtotal - BigInt(discount) < 0n || BigInt(estimatedTotal) !== expectedSubtotal - BigInt(discount)) {
     fail(resource, "$.estimatedTotalMinor", "subtotalMinor - discountMinor");
   }
+  if ("deliveryMethod" in cart) {
+    const shipping = safeMinor(cart.shippingMinor, resource, "$.shippingMinor");
+    const total = safeMinor(cart.totalMinor, resource, "$.totalMinor");
+    if (BigInt(total) !== BigInt(estimatedTotal) + BigInt(shipping)) {
+      fail(resource, "$.totalMinor", "estimatedTotalMinor + shippingMinor");
+    }
+  }
   timestamp(cart.expiresAt, resource, "$.expiresAt");
   timestamp(cart.createdAt, resource, "$.createdAt");
   timestamp(cart.updatedAt, resource, "$.updatedAt");
@@ -3461,6 +3725,17 @@ function validateCheckoutCore(value, resource, list, server) {
     "$.status"
   );
   const keys = checkoutVariantKeys(status, checkout.placedVia);
+  keys.required.push(
+    ...responseExtensionKeys(
+      checkout,
+      ["deliveryMethod", "source"],
+      resource,
+      "$"
+    )
+  );
+  if ("deliveryMethod" in checkout)
+    enumValue(checkout.source, ["web", "in_person"], resource, "$.source");
+  keys.optional.push("funding");
   if (list) {
     keys.required = keys.required.filter(
       (key) => !["items", "shippingAddress", "attributes"].includes(key)
@@ -3472,6 +3747,33 @@ function validateCheckoutCore(value, resource, list, server) {
   exact(checkout, keys.required, keys.optional, resource, "$");
   string(checkout.id, resource, "$.id");
   validateCheckoutAmounts(checkout.amounts, resource, "$.amounts");
+  if (Object.prototype.hasOwnProperty.call(checkout, "funding")) {
+    const funding = record(checkout.funding, resource, "$.funding");
+    exact(
+      funding,
+      ["creditAmount", "providerPayableAmount"],
+      [],
+      resource,
+      "$.funding"
+    );
+    const credit = safeMinor(
+      funding.creditAmount,
+      resource,
+      "$.funding.creditAmount"
+    );
+    const provider = safeMinor(
+      funding.providerPayableAmount,
+      resource,
+      "$.funding.providerPayableAmount"
+    );
+    const amounts = checkout.amounts;
+    if (BigInt(credit) + BigInt(provider) !== BigInt(amounts.totalMinor) || credit > 0 && amounts.currency !== "KRW")
+      fail(
+        resource,
+        "$.funding",
+        "exact purchase total split; positive credits require KRW"
+      );
+  }
   if (!list) {
     const items = array(checkout.items, resource, "$.items");
     if (items.length === 0) fail(resource, "$.items", "non-empty array");
@@ -3630,10 +3932,10 @@ function validateCheckoutQueryResult(value) {
   return value;
 }
 function validateMoney(value, resource, path) {
-  const money = record(value, resource, path);
-  exact(money, ["amountMinor", "currency"], [], resource, path);
-  safeMinor(money.amountMinor, resource, `${path}.amountMinor`);
-  currency(money.currency, resource, `${path}.currency`);
+  const money2 = record(value, resource, path);
+  exact(money2, ["amountMinor", "currency"], [], resource, path);
+  safeMinor(money2.amountMinor, resource, `${path}.amountMinor`);
+  currency(money2.currency, resource, `${path}.currency`);
 }
 function validateCustomPaymentSession(value) {
   const resource = "custom PaymentSession";
@@ -3894,6 +4196,65 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
 }
 function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "stripe") {
+    exact(
+      action,
+      ["type", "clientSecret", "publishableKey", "returnUrl"],
+      [],
+      resource,
+      path
+    );
+    if (action.type !== "stripe_payment_element")
+      fail(resource, `${path}.type`, "stripe_payment_element");
+    const clientSecret = boundedString(
+      action.clientSecret,
+      255,
+      resource,
+      `${path}.clientSecret`
+    );
+    if (!/^pi_[A-Za-z0-9]+_secret_[A-Za-z0-9]+$/.test(clientSecret)) {
+      fail(
+        resource,
+        `${path}.clientSecret`,
+        "Stripe PaymentIntent client secret"
+      );
+    }
+    const publishableKey = boundedString(
+      action.publishableKey,
+      255,
+      resource,
+      `${path}.publishableKey`
+    );
+    if (!/^pk_(?:test|live)_[A-Za-z0-9]+$/.test(publishableKey)) {
+      fail(resource, `${path}.publishableKey`, "Stripe publishable key");
+    }
+    const returnUrl = boundedString(
+      action.returnUrl,
+      2048,
+      resource,
+      `${path}.returnUrl`
+    );
+    if (!STRIPE_RETURN_URL_RAW_CHARACTERS.test(returnUrl) || !STRIPE_RETURN_URL_AUTHORITY.test(returnUrl)) {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    try {
+      const parsed = new URL(returnUrl);
+      const loopback = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+      if (!loopback && parsed.protocol !== "https:" || parsed.username || parsed.password)
+        throw new Error("unsafe return URL");
+    } catch {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    return;
+  }
   if (provider === "portone") {
     if (action.type === "portone_sdk") {
       const hasCancelable = "cancelable" in action;
@@ -4269,7 +4630,7 @@ function validatePublicPaymentSession(value, expectedProvider, operation2) {
     );
   }
   if (expectedProvider !== void 0 && provider !== expectedProvider) {
-    if (operation2 === "cancel" && status !== "canceling" && status !== "canceled") {
+    if (operation2 === "cancel" && CANCEL_RECOVERY_METHODS[provider] !== null && status !== "canceling" && status !== "canceled") {
       fail(
         resource,
         "$.providerStatus",
@@ -5810,8 +6171,9 @@ var CheckoutApi = class extends CustomerScopedApi {
   }
   post(endpoint, body, idempotencyKey) {
     return this.requestEndpoint(endpoint, body, {
-      ...idempotencyKey && {
-        headers: { "X-Idempotency-Key": idempotencyKey }
+      headers: {
+        Accept: CUSTOMER_CREDIT_FUNDING_MEDIA_TYPE,
+        ...idempotencyKey && { "X-Idempotency-Key": idempotencyKey }
       }
     });
   }
@@ -5821,34 +6183,58 @@ var CheckoutApi = class extends CustomerScopedApi {
   async serverCheckout(result) {
     return validateServerCheckout(await result);
   }
-  async createResult(result) {
-    return validateCreateCheckoutResult(
+  async createResult(result, creditAmount) {
+    const parsed = validateCreateCheckoutResult(
       await result,
       false
     );
+    this.assertRequestedCredit(parsed.checkout, creditAmount);
+    return parsed;
   }
-  async createServerResult(result) {
-    return validateCreateCheckoutResult(
+  async createServerResult(result, creditAmount) {
+    const parsed = validateCreateCheckoutResult(
       await result,
       true
     );
+    this.assertRequestedCredit(parsed.checkout, creditAmount);
+    return parsed;
+  }
+  assertCreditInput(amount) {
+    if (amount !== void 0 && (!Number.isSafeInteger(amount) || amount <= 0))
+      throw createValidationError(
+        "creditAmount must be a positive safe integer."
+      );
+  }
+  assertRequestedCredit(checkout, requested) {
+    if (requested !== void 0 && checkout.funding?.creditAmount !== requested)
+      throw createApiError(
+        "Credit funding was not confirmed by the server.",
+        502,
+        { resource: "Checkout", path: "$.funding" },
+        "The response does not confirm the requested credit funding.",
+        "Retry the same create with the original idempotency key and credit amount, or retrieve the Checkout; never retry without credit."
+      );
   }
   create(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
+    this.assertCreditInput(body.creditAmount);
     return this.createResult(
-      this.post(COMMERCE_ENDPOINTS.checkouts.create, body, idempotencyKey)
+      this.post(COMMERCE_ENDPOINTS.checkouts.create, body, idempotencyKey),
+      body.creditAmount
     );
   }
   createServer(params) {
     const { idempotencyKey, ...body } = params;
     assertCommerceIdempotencyKey(idempotencyKey);
+    this.assertCreditInput(body.creditAmount);
     return this.createServerResult(
       this.post(
         COMMERCE_ENDPOINTS.checkouts.server.create,
         body,
         idempotencyKey
-      )
+      ),
+      body.creditAmount
     );
   }
   retrieve(params) {
@@ -6495,7 +6881,16 @@ var MembershipApi = class extends BaseApi {
    * to activate the membership.
    *
    * `subscribeIntentKey` is used as the HTTP idempotency key so the call is
-   * safely retryable.
+   * safely retryable. Trials are once per tenant/customer/plan; a prior recipient
+   * gets the paid prepare response (409 conflict without writes if the delegated
+   * connection is unavailable). Catalog trialDays is not customer eligibility.
+   * Display firstCharge amount/currency/periodStart and obtain explicit customer
+   * consent before PSP execution; refusal must never dispatch payment.
+   * Completed trial replays keep their result. Existing payload/live duplicate
+   * checks run first (another live Membership is 409 duplicate_subscription).
+   * If an unfinished trial replay passes those checks after another intent
+   * received the trial, it returns 409 idempotency_conflict without writes;
+   * its original snapshot is never rewritten into a paid intent.
    */
   subscribe(params) {
     const { subscribeIntentKey, ...body } = params;
@@ -6505,6 +6900,21 @@ var MembershipApi = class extends BaseApi {
       idempotencyRequestOptions(subscribeIntentKey)
     );
   }
+  /**
+   * End an unprepared or terminal intent without changing membership evidence.
+   * Use an opaque random, non-personal key of 1–512 visible ASCII characters;
+   * other keys are rejected because headers and JSON can encode them differently.
+   */
+  async endSubscribeIntent(params) {
+    const result = await this.requestEndpoint(
+      MEMBERSHIP_ENDPOINT_OPERATIONS.endSubscribeIntent,
+      params
+    );
+    if (!result || typeof result !== "object" || Array.isArray(result) || Object.keys(result).length !== 1 || !("status" in result) || result.status !== "ended" && result.status !== "existing") {
+      throw new Error("Invalid membership intent termination response");
+    }
+    return { status: result.status };
+  }
   /**
    * Cancel a membership by id.
    * By default this sets `cancelAtPeriodEnd`, keeps benefits until
@@ -6602,7 +7012,7 @@ function getExternalEffectClaimErrorReason(error) {
   const reason = getSDKErrorReason(error);
   return errorReasons.has(reason) ? reason : void 0;
 }
-var states = /* @__PURE__ */ new Set([
+var states2 = /* @__PURE__ */ new Set([
   "pre_dispatch_claimed",
   "armed_unknown",
   "reported_effect",
@@ -6627,7 +7037,7 @@ function claimFromResponse(value) {
   const claim = value.claim;
   if (!claim || typeof claim !== "object") invalidResponse();
   const row = claim;
-  if (typeof row.id !== "string" || !states.has(row.state) || row.armedAt !== null && typeof row.armedAt !== "string" || row.firstReportOutcome !== null && row.firstReportOutcome !== "effect" && row.firstReportOutcome !== "no_effect" || row.reportAuthority !== "tenant_supplied_unverified" || typeof row.leaseGranted !== "boolean" || row.leaseToken !== null && typeof row.leaseToken !== "string" || !Number.isSafeInteger(row.leaseGeneration) || row.leaseGranted && row.leaseToken === null || !row.leaseGranted && row.leaseToken !== null)
+  if (typeof row.id !== "string" || !states2.has(row.state) || row.armedAt !== null && typeof row.armedAt !== "string" || row.firstReportOutcome !== null && row.firstReportOutcome !== "effect" && row.firstReportOutcome !== "no_effect" || row.reportAuthority !== "tenant_supplied_unverified" || typeof row.leaseGranted !== "boolean" || row.leaseToken !== null && typeof row.leaseToken !== "string" || !Number.isSafeInteger(row.leaseGeneration) || row.leaseGranted && row.leaseToken === null || !row.leaseGranted && row.leaseToken !== null)
     invalidResponse();
   return {
     id: row.id,
@@ -6750,8 +7160,8 @@ var InstallationCredentialsApi = class extends BaseApi {
 function invalidResponse3() {
   throw createApiError("Invalid external-customer link response", 200);
 }
-var uuid2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var isUuid = (value) => typeof value === "string" && (uuid2.test(value) || value === "00000000-0000-0000-0000-000000000000" || value.toLowerCase() === "ffffffff-ffff-ffff-ffff-ffffffffffff");
+var uuid3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var isUuid = (value) => typeof value === "string" && (uuid3.test(value) || value === "00000000-0000-0000-0000-000000000000" || value.toLowerCase() === "ffffffff-ffff-ffff-ffff-ffffffffffff");
 var isIdentity = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && value === value.trim() && // eslint-disable-next-line no-control-regex -- Normalized identity forbids C0 controls.
 !/[\u0000-\u001f]/.test(value) && !/[\uD800-\uDFFF]/u.test(value);
 var isDateTime = (value) => {
@@ -6892,6 +7302,7 @@ var ServerClient = class _ServerClient {
     const membershipApi = new MembershipApi(serverOptions);
     this.memberships = {
       subscribe: membershipApi.subscribe.bind(membershipApi),
+      endSubscribeIntent: membershipApi.endSubscribeIntent.bind(membershipApi),
       cancel: membershipApi.cancel.bind(membershipApi),
       billingCustody: membershipApi.billingCustody.bind(membershipApi)
     };
@@ -6899,6 +7310,7 @@ var ServerClient = class _ServerClient {
     this.externalEffectClaims = new ExternalEffectClaimsApi(serverOptions);
     this.installationCredentials = new InstallationCredentialsApi(serverOptions);
     this.benefitVouchers = new BenefitVouchersApi(serverOptions);
+    this.credits = new CreditsApi(serverOptions);
     this.externalCustomerLinks = new ExternalCustomerLinksApi(serverOptions);
     const tenantIntrospectionApi = new TenantIntrospectionApi(serverOptions);
     this.tenant = {
@@ -6976,6 +7388,7 @@ export {
   BenefitVouchersApi,
   CollectionClient,
   CommunityClient,
+  CreditsApi,
   CustomerGroupApi,
   EventsClient,
   ExternalCustomerLinksApi,