@01.software/sdk 0.70.1 → 0.72.1

package/dist/{collection-client-BHLStm1K.d.cts → collection-client-B3CnqMDQ.d.cts}

@@ -1,8 +1,8 @@
-import { cU as DebugConfig, c_ as RetryConfig, cN as ApiQueryOptions, cX as PayloadFindResponse, cY as PayloadMutationResponse, dc as ApiDeleteOptions, dd as PublicReadQueryOptions } from './types-Bzgf4mTo.cjs';
-import './payload-types-DTAaWKrp.cjs';
+import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-CnkJQUez.cjs';
+import './payload-types-BRg8Yary.cjs';
 import { GenerateMetadataOptions, Metadata } from './metadata.cjs';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-BfQfV-rr.cjs';
-import { C as CollectionType } from './types-CpSiyJud.cjs';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-_ZfJjRQG.cjs';
+import { C as CollectionType } from './types-FyklqLAk.cjs';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;
@@ -90,21 +90,17 @@ declare class CollectionQueryBuilder<T extends Collection> {
     /**
      * Create a new document
      * POST /api/{collection}
+     * Pass `locale` to write localized fields in a tenant-enabled locale.
      * @returns Payload CMS mutation response with doc and message
      */
-    create(data: Partial<CollectionType<T>>, options?: {
-        file?: File | Blob;
-        filename?: string;
-    }): Promise<PayloadMutationResponse<CollectionType<T>>>;
+    create(data: Partial<CollectionType<T>>, options?: ApiDocumentWriteOptions): Promise<PayloadMutationResponse<CollectionType<T>>>;
     /**
      * Update a document by ID
      * PATCH /api/{collection}/{id}
+     * Pass `locale` to write localized fields in a tenant-enabled locale.
      * @returns Payload CMS mutation response with doc and message
      */
-    update(id: string, data: Partial<CollectionType<T>>, options?: {
-        file?: File | Blob;
-        filename?: string;
-    }): Promise<PayloadMutationResponse<CollectionType<T>>>;
+    update(id: string, data: Partial<CollectionType<T>>, options?: ApiDocumentWriteOptions): Promise<PayloadMutationResponse<CollectionType<T>>>;
     /**
      * Count documents
      * GET /api/{collection}/count
@@ -130,7 +126,7 @@ declare class CollectionQueryBuilder<T extends Collection> {
      * PATCH /api/{collection}
      * @returns Payload CMS find response with updated docs
      */
-    updateMany(where: ApiQueryOptions['where'], data: Partial<CollectionType<T>>): Promise<PayloadFindResponse<CollectionType<T>>>;
+    updateMany(where: ApiQueryOptions['where'], data: Partial<CollectionType<T>>, options?: ApiWriteOptions): Promise<PayloadFindResponse<CollectionType<T>>>;
     /**
      * Delete a document by ID
      * DELETE /api/{collection}/{id}
@@ -172,12 +168,12 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
      * Create document
      * POST /api/{collection}
      */
-    requestCreate<T = unknown>(endpoint: string, data?: unknown): Promise<PayloadMutationResponse<T>>;
+    requestCreate<T = unknown>(endpoint: string, data?: unknown, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Update document
      * PATCH /api/{collection}/{id}
      */
-    requestUpdate<T = unknown>(endpoint: string, data?: unknown): Promise<PayloadMutationResponse<T>>;
+    requestUpdate<T = unknown>(endpoint: string, data?: unknown, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Count documents
      * GET /api/{collection}/count
@@ -192,7 +188,7 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
     requestUpdateMany<T = unknown>(endpoint: string, data: {
         where?: ApiQueryOptions['where'];
         data: unknown;
-    }): Promise<PayloadFindResponse<T>>;
+    }, options?: ApiWriteOptions): Promise<PayloadFindResponse<T>>;
     /**
      * Delete document
      * DELETE /api/{collection}/{id}
@@ -209,12 +205,12 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
      * Create document with file upload
      * POST /api/{collection} (multipart/form-data)
      */
-    requestCreateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string): Promise<PayloadMutationResponse<T>>;
+    requestCreateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Update document with file upload
      * PATCH /api/{collection}/{id} (multipart/form-data)
      */
-    requestUpdateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string): Promise<PayloadMutationResponse<T>>;
+    requestUpdateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
 }
 declare class ServerCollectionClient extends CollectionClient<ServerCollection> {
     from<T extends ServerCollection>(collection: T): ServerCollectionQueryBuilder<T>;

package/dist/{collection-client-B1FSJ24_.d.ts → collection-client-uOgS_1bC.d.ts}

@@ -1,8 +1,8 @@
-import { cU as DebugConfig, c_ as RetryConfig, cN as ApiQueryOptions, cX as PayloadFindResponse, cY as PayloadMutationResponse, dc as ApiDeleteOptions, dd as PublicReadQueryOptions } from './types-DdlhpNVv.js';
-import './payload-types-DTAaWKrp.js';
+import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-Cmnxxvuv.js';
+import './payload-types-BRg8Yary.js';
 import { GenerateMetadataOptions, Metadata } from './metadata.js';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-ty8u0TDI.js';
-import { C as CollectionType } from './types-DX8Z44yQ.js';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-BJBK7jBl.js';
+import { C as CollectionType } from './types-DLjSqL0P.js';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;
@@ -90,21 +90,17 @@ declare class CollectionQueryBuilder<T extends Collection> {
     /**
      * Create a new document
      * POST /api/{collection}
+     * Pass `locale` to write localized fields in a tenant-enabled locale.
      * @returns Payload CMS mutation response with doc and message
      */
-    create(data: Partial<CollectionType<T>>, options?: {
-        file?: File | Blob;
-        filename?: string;
-    }): Promise<PayloadMutationResponse<CollectionType<T>>>;
+    create(data: Partial<CollectionType<T>>, options?: ApiDocumentWriteOptions): Promise<PayloadMutationResponse<CollectionType<T>>>;
     /**
      * Update a document by ID
      * PATCH /api/{collection}/{id}
+     * Pass `locale` to write localized fields in a tenant-enabled locale.
      * @returns Payload CMS mutation response with doc and message
      */
-    update(id: string, data: Partial<CollectionType<T>>, options?: {
-        file?: File | Blob;
-        filename?: string;
-    }): Promise<PayloadMutationResponse<CollectionType<T>>>;
+    update(id: string, data: Partial<CollectionType<T>>, options?: ApiDocumentWriteOptions): Promise<PayloadMutationResponse<CollectionType<T>>>;
     /**
      * Count documents
      * GET /api/{collection}/count
@@ -130,7 +126,7 @@ declare class CollectionQueryBuilder<T extends Collection> {
      * PATCH /api/{collection}
      * @returns Payload CMS find response with updated docs
      */
-    updateMany(where: ApiQueryOptions['where'], data: Partial<CollectionType<T>>): Promise<PayloadFindResponse<CollectionType<T>>>;
+    updateMany(where: ApiQueryOptions['where'], data: Partial<CollectionType<T>>, options?: ApiWriteOptions): Promise<PayloadFindResponse<CollectionType<T>>>;
     /**
      * Delete a document by ID
      * DELETE /api/{collection}/{id}
@@ -172,12 +168,12 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
      * Create document
      * POST /api/{collection}
      */
-    requestCreate<T = unknown>(endpoint: string, data?: unknown): Promise<PayloadMutationResponse<T>>;
+    requestCreate<T = unknown>(endpoint: string, data?: unknown, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Update document
      * PATCH /api/{collection}/{id}
      */
-    requestUpdate<T = unknown>(endpoint: string, data?: unknown): Promise<PayloadMutationResponse<T>>;
+    requestUpdate<T = unknown>(endpoint: string, data?: unknown, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Count documents
      * GET /api/{collection}/count
@@ -192,7 +188,7 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
     requestUpdateMany<T = unknown>(endpoint: string, data: {
         where?: ApiQueryOptions['where'];
         data: unknown;
-    }): Promise<PayloadFindResponse<T>>;
+    }, options?: ApiWriteOptions): Promise<PayloadFindResponse<T>>;
     /**
      * Delete document
      * DELETE /api/{collection}/{id}
@@ -209,12 +205,12 @@ declare class CollectionClient<TCollection extends Collection = PublicCollection
      * Create document with file upload
      * POST /api/{collection} (multipart/form-data)
      */
-    requestCreateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string): Promise<PayloadMutationResponse<T>>;
+    requestCreateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
     /**
      * Update document with file upload
      * PATCH /api/{collection}/{id} (multipart/form-data)
      */
-    requestUpdateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string): Promise<PayloadMutationResponse<T>>;
+    requestUpdateWithFile<T = unknown>(endpoint: string, data: unknown, file: File | Blob, filename?: string, options?: ApiWriteOptions): Promise<PayloadMutationResponse<T>>;
 }
 declare class ServerCollectionClient extends CollectionClient<ServerCollection> {
     from<T extends ServerCollection>(collection: T): ServerCollectionQueryBuilder<T>;

package/dist/{const-ty8u0TDI.d.ts → const-BJBK7jBl.d.ts}

@@ -1,4 +1,4 @@
-import './payload-types-DTAaWKrp.js';
+import './payload-types-BRg8Yary.js';
 
 /**
  * Internal collections that should not be exposed via SDK.

package/dist/{const-BfQfV-rr.d.cts → const-_ZfJjRQG.d.cts}

@@ -1,4 +1,4 @@
-import './payload-types-DTAaWKrp.cjs';
+import './payload-types-BRg8Yary.cjs';
 
 /**
  * Internal collections that should not be exposed via SDK.

package/dist/embedded-admin/server.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var server_exports = {};
 __export(server_exports, {
   fetchEmbeddedAdminJwks: () => fetchEmbeddedAdminJwks,
+  verifyEmbeddedAdminExecution: () => verifyEmbeddedAdminExecution,
   verifyEmbeddedAdminSession: () => verifyEmbeddedAdminSession
 });
 module.exports = __toCommonJS(server_exports);
@@ -113,6 +114,7 @@ var COMMERCE_ERROR_CODES = [
   "cart_not_active",
   "cart_locked",
   "cart_empty",
+  "shipping_address_required",
   "cart_market_unavailable",
   "cart_market_mismatch",
   "checkout_not_open",
@@ -129,6 +131,7 @@ var COMMERCE_ERROR_CODES = [
   "price_changed",
   "pricing_fact_in_use",
   "insufficient_stock",
+  "credit_insufficient",
   "reservation_conflict",
   "stock_lock_unavailable",
   "variant_not_found",
@@ -207,9 +210,56 @@ var ValidationError = class extends SDKError {
 };
 var createValidationError = (message, details, userMessage, suggestion, status) => new ValidationError(message, details, userMessage, suggestion, status);
 
+// src/embedded-admin/actions.ts
+var EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX = "urn:01-software:embedded-admin-execution:";
+var EMBEDDED_ADMIN_MAX_SELECTED_IDS = 100;
+var ACTION_ID = /^[a-z][a-z0-9_-]{0,63}$/;
+var COLLECTION = /^[a-z][a-z0-9-]{0,63}$/;
+var EXECUTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function recordWithKeys(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw createValidationError("Invalid embedded admin action context.");
+  }
+  const record = value;
+  if (Object.keys(record).some((key) => !keys.includes(key))) {
+    throw createValidationError("Invalid embedded admin action context.");
+  }
+  return record;
+}
+function normalizeEmbeddedAdminExecutionContext(value) {
+  const input = recordWithKeys(value, [
+    "executionId",
+    "expiresAt",
+    "actionId",
+    "collection",
+    "selectedIds"
+  ]);
+  if (typeof input.executionId !== "string" || !EXECUTION_ID.test(input.executionId) || typeof input.expiresAt !== "number" || !Number.isSafeInteger(input.expiresAt) || input.expiresAt <= 0 || typeof input.actionId !== "string" || !ACTION_ID.test(input.actionId) || typeof input.collection !== "string" || !COLLECTION.test(input.collection) || !Array.isArray(input.selectedIds) || input.selectedIds.length > EMBEDDED_ADMIN_MAX_SELECTED_IDS || input.selectedIds.some(
+    (id) => typeof id !== "string" || !id || id.length > 128 || id.trim() !== id || Array.from(id).some(
+      (character) => character.charCodeAt(0) <= 32 || character.charCodeAt(0) === 127
+    )
+  ) || new Set(input.selectedIds).size !== input.selectedIds.length)
+    throw createValidationError("Invalid embedded admin execution context.");
+  return {
+    executionId: input.executionId,
+    expiresAt: input.expiresAt,
+    actionId: input.actionId,
+    collection: input.collection,
+    selectedIds: [...input.selectedIds].sort()
+  };
+}
+function embeddedAdminExecutionContextsEqual(left, right) {
+  try {
+    return JSON.stringify(normalizeEmbeddedAdminExecutionContext(left)) === JSON.stringify(normalizeEmbeddedAdminExecutionContext(right));
+  } catch {
+    return false;
+  }
+}
+
 // src/embedded-admin/index.ts
 var EMBEDDED_ADMIN_SESSION_TTL_SECONDS = 60;
 var EMBEDDED_ADMIN_APP_KEY = "primary";
+var MAX_PATH_LENGTH = 512;
 var EMBEDDED_ADMIN_TENANT_ROLES = [
   "tenant-admin",
   "tenant-editor",
@@ -236,6 +286,23 @@ function normalizeEmbeddedAdminExactOrigin(value, options = {}) {
   if (parsed.pathname !== "/" || trimmed.endsWith("/")) return null;
   return parsed.origin;
 }
+function normalizeEmbeddedAdminRelativePath(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.length > MAX_PATH_LENGTH) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed, "https://embedded.invalid");
+  } catch {
+    return null;
+  }
+  if (parsed.origin !== "https://embedded.invalid" || parsed.pathname.startsWith("//") || parsed.search || parsed.hash || parsed.username || parsed.password) {
+    return null;
+  }
+  return parsed.pathname;
+}
 
 // src/embedded-admin/server.ts
 var ALGORITHMS = ["RS256", "ES256"];
@@ -279,6 +346,53 @@ async function fetchEmbeddedAdminJwks(consoleOrigin, options = {}) {
   return parseJwks(JSON.parse(text));
 }
 async function verifyEmbeddedAdminSession(options) {
+  const claims = await verifySession(options);
+  if ("protocol_version" in claims || "execution_context" in claims || "token_use" in claims) {
+    throw new Error("An action assertion requires execution verification.");
+  }
+  return claims;
+}
+async function verifyEmbeddedAdminExecution(options) {
+  if (typeof options.consumeExecution !== "function") {
+    throw createValidationError("A durable execution consumer is required.");
+  }
+  const clock = options.clock ?? (() => Math.floor(Date.now() / 1e3));
+  const currentSecond = () => {
+    const now = clock();
+    if (!Number.isSafeInteger(now) || now < 0)
+      throw createValidationError("A trusted Unix-second clock is required.");
+    return now;
+  };
+  const claims = await verifySession({ ...options, now: currentSecond() }, true);
+  const execution = normalizeEmbeddedAdminExecutionContext(
+    claims.execution_context
+  );
+  const frame = new URL(options.frameUrl);
+  const path = normalizeEmbeddedAdminRelativePath(frame.pathname);
+  if (claims.protocol_version !== 2 || !["super-admin", "tenant-admin"].includes(claims.tenant_role) || "token_use" in claims || !path || frame.origin !== claims.dest || `${frame.origin}${path}` !== options.frameUrl || claims.frame_url !== options.frameUrl || claims.exp !== execution.expiresAt || currentSecond() >= execution.expiresAt || !embeddedAdminExecutionContextsEqual(execution, options.execution))
+    throw new Error(
+      "Embedded admin execution context does not match its assertion."
+    );
+  const consumed = await options.consumeExecution({
+    issuer: claims.iss,
+    tenantId: claims.tenant_id,
+    operatorId: claims.operator_id,
+    appKey: claims.app_key,
+    executionId: execution.executionId,
+    expiresAt: execution.expiresAt
+  });
+  if (consumed !== true)
+    throw new Error("Embedded admin execution was already consumed.");
+  if (currentSecond() >= execution.expiresAt)
+    throw new Error("Embedded admin execution expired during consumption.");
+  return {
+    ...claims,
+    protocol_version: 2,
+    frame_url: options.frameUrl,
+    execution_context: execution
+  };
+}
+async function verifySession(options, executionPurpose = false) {
   const allowedRoles = options.allowedRoles ?? ["super-admin", "tenant-admin"];
   if (!Array.isArray(allowedRoles) || allowedRoles.some(
     (role) => !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(role)
@@ -298,6 +412,7 @@ async function verifyEmbeddedAdminSession(options) {
       "consoleOrigin and destination must be exact origins."
     );
   }
+  const audience = executionPurpose ? `${EMBEDDED_ADMIN_EXECUTION_AUDIENCE_PREFIX}${destination}` : destination;
   if (typeof options.channelId !== "string" || options.channelId.length < 16 || options.channelId.length > 128 || typeof options.token !== "string" || options.token.length === 0) {
     throw createValidationError("Embedded admin session input is invalid.");
   }
@@ -311,7 +426,7 @@ async function verifyEmbeddedAdminSession(options) {
     (0, import_jose.createLocalJWKSet)(jwks),
     {
       algorithms: [...ALGORITHMS],
-      audience: destination,
+      audience,
       clockTolerance: 0,
       currentDate: new Date(currentSecond * 1e3),
       issuer,
@@ -319,7 +434,7 @@ async function verifyEmbeddedAdminSession(options) {
     }
   );
   const lifetime = typeof payload.exp === "number" && typeof payload.iat === "number" ? payload.exp - payload.iat : Number.POSITIVE_INFINITY;
-  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== destination || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(
+  if (typeof protectedHeader.kid !== "string" || protectedHeader.kid.length === 0 || !Number.isInteger(payload.iat) || !Number.isInteger(payload.nbf) || !Number.isInteger(payload.exp) || payload.iat > currentSecond || lifetime <= 0 || lifetime > EMBEDDED_ADMIN_SESSION_TTL_SECONDS || payload.nbf !== payload.iat || payload.aud !== audience || typeof payload.jti !== "string" || payload.jti.length === 0 || payload.app_key !== EMBEDDED_ADMIN_APP_KEY || payload.channel_id !== options.channelId || payload.dest !== destination || typeof payload.operator_id !== "string" || payload.operator_id.length === 0 || payload.sub !== payload.operator_id || typeof payload.tenant_id !== "string" || payload.tenant_id.length === 0 || !["super-admin", ...EMBEDDED_ADMIN_TENANT_ROLES].includes(
     payload.tenant_role
   ) || !allowedRoles.includes(payload.tenant_role)) {
     throw new Error("Embedded admin session claims are invalid.");