@01.software/sdk 0.71.0 → 0.72.1

package/dist/{collection-client-D18xyUq_.d.cts → collection-client-B3CnqMDQ.d.cts}

@@ -1,8 +1,8 @@
-import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-DLHEIsAx.cjs';
-import './payload-types-BgOEk6Y9.cjs';
+import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-CnkJQUez.cjs';
+import './payload-types-BRg8Yary.cjs';
 import { GenerateMetadataOptions, Metadata } from './metadata.cjs';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-oGEoxCXZ.cjs';
-import { C as CollectionType } from './types-BzG3NO7R.cjs';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-_ZfJjRQG.cjs';
+import { C as CollectionType } from './types-FyklqLAk.cjs';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;

package/dist/{collection-client-CUGJcTpl.d.ts → collection-client-uOgS_1bC.d.ts}

@@ -1,8 +1,8 @@
-import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-nyOvcO0K.js';
-import './payload-types-BgOEk6Y9.js';
+import { dd as DebugConfig, dj as RetryConfig, d6 as ApiQueryOptions, dg as PayloadFindResponse, dh as PayloadMutationResponse, dy as ApiDocumentWriteOptions, dz as ApiWriteOptions, dA as ApiDeleteOptions, dB as PublicReadQueryOptions } from './types-Cmnxxvuv.js';
+import './payload-types-BRg8Yary.js';
 import { GenerateMetadataOptions, Metadata } from './metadata.js';
-import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-Dlu0mXmj.js';
-import { C as CollectionType } from './types-CSvp2fJ_.js';
+import { C as Collection, S as ServerCollection, P as PublicCollection } from './const-BJBK7jBl.js';
+import { C as CollectionType } from './types-DLjSqL0P.js';
 
 interface FetchOptions extends RequestInit {
     apiUrl?: string;

package/dist/{const-Dlu0mXmj.d.ts → const-BJBK7jBl.d.ts}

@@ -1,4 +1,4 @@
-import './payload-types-BgOEk6Y9.js';
+import './payload-types-BRg8Yary.js';
 
 /**
  * Internal collections that should not be exposed via SDK.

package/dist/{const-oGEoxCXZ.d.cts → const-_ZfJjRQG.d.cts}

@@ -1,4 +1,4 @@
-import './payload-types-BgOEk6Y9.cjs';
+import './payload-types-BRg8Yary.cjs';
 
 /**
  * Internal collections that should not be exposed via SDK.

package/dist/{index-Ccd4NYTL.d.ts → index-CBaP4q8r.d.ts}

@@ -1,6 +1,6 @@
-import { C as Collection } from './const-Dlu0mXmj.js';
-import { C as CollectionType } from './types-CSvp2fJ_.js';
-import './payload-types-BgOEk6Y9.js';
+import { C as Collection } from './const-BJBK7jBl.js';
+import { C as CollectionType } from './types-DLjSqL0P.js';
+import './payload-types-BRg8Yary.js';
 
 type WebhookOperation = string;
 /**

package/dist/{index-HHVtIKXs.d.cts → index-CI_LFWiG.d.cts}

@@ -1,6 +1,6 @@
-import { C as Collection } from './const-oGEoxCXZ.cjs';
-import { C as CollectionType } from './types-BzG3NO7R.cjs';
-import './payload-types-BgOEk6Y9.cjs';
+import { C as Collection } from './const-_ZfJjRQG.cjs';
+import { C as CollectionType } from './types-FyklqLAk.cjs';
+import './payload-types-BRg8Yary.cjs';
 
 type WebhookOperation = string;
 /**

package/dist/index.cjs

@@ -2720,7 +2720,18 @@ var ABANDONED_REASONS = ["expired", "customer", "operator"];
 function managedPaymentProviders(providers) {
   return providers;
 }
-var PAYMENT_PROVIDERS = managedPaymentProviders(["toss", "portone"]);
+var PAYMENT_PROVIDERS = managedPaymentProviders([
+  "toss",
+  "portone",
+  "stripe"
+]);
+var CANCEL_RECOVERY_METHODS = {
+  toss: "cancel()",
+  portone: "cancelPortOne()",
+  stripe: null
+};
+var STRIPE_RETURN_URL_RAW_CHARACTERS = /^[^\s\u0000-\u001F\u007F\\]+$/;
+var STRIPE_RETURN_URL_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]+(?:[/?#]|$)/;
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -2769,11 +2780,8 @@ function fail(resource, path, expected) {
   invalidCanonicalResponse(resource, { path, expected });
 }
 function providerMismatch(resource, expected, actual, operation2) {
-  if (operation2 === "cancel") {
-    const method = {
-      toss: "cancel()",
-      portone: "cancelPortOne()"
-    }[actual];
+  const method = CANCEL_RECOVERY_METHODS[actual];
+  if (operation2 === "cancel" && method !== null) {
     throw createApiError(
       `Canonical ${resource} response provider mismatch: expected ${expected}, received ${actual}.`,
       502,
@@ -4017,6 +4025,65 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
 }
 function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "stripe") {
+    exact(
+      action,
+      ["type", "clientSecret", "publishableKey", "returnUrl"],
+      [],
+      resource,
+      path
+    );
+    if (action.type !== "stripe_payment_element")
+      fail(resource, `${path}.type`, "stripe_payment_element");
+    const clientSecret = boundedString(
+      action.clientSecret,
+      255,
+      resource,
+      `${path}.clientSecret`
+    );
+    if (!/^pi_[A-Za-z0-9]+_secret_[A-Za-z0-9]+$/.test(clientSecret)) {
+      fail(
+        resource,
+        `${path}.clientSecret`,
+        "Stripe PaymentIntent client secret"
+      );
+    }
+    const publishableKey = boundedString(
+      action.publishableKey,
+      255,
+      resource,
+      `${path}.publishableKey`
+    );
+    if (!/^pk_(?:test|live)_[A-Za-z0-9]+$/.test(publishableKey)) {
+      fail(resource, `${path}.publishableKey`, "Stripe publishable key");
+    }
+    const returnUrl = boundedString(
+      action.returnUrl,
+      2048,
+      resource,
+      `${path}.returnUrl`
+    );
+    if (!STRIPE_RETURN_URL_RAW_CHARACTERS.test(returnUrl) || !STRIPE_RETURN_URL_AUTHORITY.test(returnUrl)) {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    try {
+      const parsed = new URL(returnUrl);
+      const loopback = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+      if (!loopback && parsed.protocol !== "https:" || parsed.username || parsed.password)
+        throw new Error("unsafe return URL");
+    } catch {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    return;
+  }
   if (provider === "portone") {
     if (action.type === "portone_sdk") {
       const hasCancelable = "cancelable" in action;
@@ -4392,7 +4459,7 @@ function validatePublicPaymentSession(value, expectedProvider, operation2) {
     );
   }
   if (expectedProvider !== void 0 && provider !== expectedProvider) {
-    if (operation2 === "cancel" && status !== "canceling" && status !== "canceled") {
+    if (operation2 === "cancel" && CANCEL_RECOVERY_METHODS[provider] !== null && status !== "canceling" && status !== "canceled") {
       fail(
         resource,
         "$.providerStatus",