@01.software/sdk 0.71.0 → 0.73.1

package/dist/query.d.cts

@@ -1,10 +1,10 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { QueryClient, UseQueryResult, UseSuspenseQueryResult, InfiniteData, UseInfiniteQueryResult, UseSuspenseInfiniteQueryResult } from '@tanstack/react-query';
-import { d6 as ApiQueryOptions, dg as PayloadFindResponse, dB as PublicReadQueryOptions, dh as PayloadMutationResponse, dC as CustomerAuth, dD as CustomerProfile, dE as CustomerAuthResponse, dF as CustomerLoginData, dG as CustomerRegisterResponse, dH as CustomerRegisterData, dI as CustomerRefreshResponse, dJ as UpdateProfileData, dK as ProductListingPageParams, dL as ProductListingPageBaseParams, dM as ProductDetailParams, dN as ProductDetailCatalogResult, dO as ProductListingPageCatalogParams, dP as ProductListingPageResult, dQ as ProductListingGroupsCatalogItem, dR as ProductListingPageFullParams, dS as ProductListingGroupsItem, dk as RootClient, cn as RootServerClient } from './types-DLHEIsAx.cjs';
-import './payload-types-BgOEk6Y9.cjs';
-import { S as ServerCollection, P as PublicCollection } from './const-oGEoxCXZ.cjs';
-import { C as CollectionClient } from './collection-client-D18xyUq_.cjs';
-import { C as CollectionType } from './types-BzG3NO7R.cjs';
+import { d8 as ApiQueryOptions, di as PayloadFindResponse, dD as PublicReadQueryOptions, dj as PayloadMutationResponse, dE as CustomerAuth, dF as CustomerProfile, dG as CustomerAuthResponse, dH as CustomerLoginData, dI as CustomerRegisterResponse, dJ as CustomerRegisterData, dK as CustomerRefreshResponse, dL as UpdateProfileData, dM as ProductListingPageParams, dN as ProductListingPageBaseParams, dO as ProductDetailParams, dP as ProductDetailCatalogResult, dQ as ProductListingPageCatalogParams, dR as ProductListingPageResult, dS as ProductListingGroupsCatalogItem, dT as ProductListingPageFullParams, dU as ProductListingGroupsItem, dm as RootClient, cp as RootServerClient } from './types-Chwgg4CQ.cjs';
+import './payload-types-PXkmefhZ.cjs';
+import { S as ServerCollection, P as PublicCollection } from './const-BS2EaIp4.cjs';
+import { C as CollectionClient } from './collection-client-BH4dIZ6c.cjs';
+import { C as CollectionType } from './types-CyMz0Kzc.cjs';
 import { SDKError } from './errors.cjs';
 export { a as RealtimeConnection, R as RealtimeEvent, b as RealtimeListener } from './realtime-D7HtUpqt.cjs';
 import './metadata.cjs';

package/dist/query.d.ts

@@ -1,10 +1,10 @@
 import * as _tanstack_react_query from '@tanstack/react-query';
 import { QueryClient, UseQueryResult, UseSuspenseQueryResult, InfiniteData, UseInfiniteQueryResult, UseSuspenseInfiniteQueryResult } from '@tanstack/react-query';
-import { d6 as ApiQueryOptions, dg as PayloadFindResponse, dB as PublicReadQueryOptions, dh as PayloadMutationResponse, dC as CustomerAuth, dD as CustomerProfile, dE as CustomerAuthResponse, dF as CustomerLoginData, dG as CustomerRegisterResponse, dH as CustomerRegisterData, dI as CustomerRefreshResponse, dJ as UpdateProfileData, dK as ProductListingPageParams, dL as ProductListingPageBaseParams, dM as ProductDetailParams, dN as ProductDetailCatalogResult, dO as ProductListingPageCatalogParams, dP as ProductListingPageResult, dQ as ProductListingGroupsCatalogItem, dR as ProductListingPageFullParams, dS as ProductListingGroupsItem, dk as RootClient, cn as RootServerClient } from './types-nyOvcO0K.js';
-import './payload-types-BgOEk6Y9.js';
-import { S as ServerCollection, P as PublicCollection } from './const-Dlu0mXmj.js';
-import { C as CollectionClient } from './collection-client-CUGJcTpl.js';
-import { C as CollectionType } from './types-CSvp2fJ_.js';
+import { d8 as ApiQueryOptions, di as PayloadFindResponse, dD as PublicReadQueryOptions, dj as PayloadMutationResponse, dE as CustomerAuth, dF as CustomerProfile, dG as CustomerAuthResponse, dH as CustomerLoginData, dI as CustomerRegisterResponse, dJ as CustomerRegisterData, dK as CustomerRefreshResponse, dL as UpdateProfileData, dM as ProductListingPageParams, dN as ProductListingPageBaseParams, dO as ProductDetailParams, dP as ProductDetailCatalogResult, dQ as ProductListingPageCatalogParams, dR as ProductListingPageResult, dS as ProductListingGroupsCatalogItem, dT as ProductListingPageFullParams, dU as ProductListingGroupsItem, dm as RootClient, cp as RootServerClient } from './types-lbzbJSZh.js';
+import './payload-types-PXkmefhZ.js';
+import { S as ServerCollection, P as PublicCollection } from './const-CCvoknRY.js';
+import { C as CollectionClient } from './collection-client-lLAl3xCZ.js';
+import { C as CollectionType } from './types-CQRsG6sA.js';
 import { SDKError } from './errors.js';
 export { a as RealtimeConnection, R as RealtimeEvent, b as RealtimeListener } from './realtime-D7HtUpqt.js';
 import './metadata.js';

package/dist/realtime.d.cts

@@ -1,7 +1,7 @@
 import { R as RealtimeEvent } from './realtime-D7HtUpqt.cjs';
 export { a as RealtimeConnection, b as RealtimeListener } from './realtime-D7HtUpqt.cjs';
-import { P as PublicCollection } from './const-oGEoxCXZ.cjs';
-import './payload-types-BgOEk6Y9.cjs';
+import { P as PublicCollection } from './const-BS2EaIp4.cjs';
+import './payload-types-PXkmefhZ.cjs';
 
 interface UseRealtimeQueryOptions {
     /** Filter events to specific collections. Empty/undefined = all collections. */

package/dist/realtime.d.ts

@@ -1,7 +1,7 @@
 import { R as RealtimeEvent } from './realtime-D7HtUpqt.js';
 export { a as RealtimeConnection, b as RealtimeListener } from './realtime-D7HtUpqt.js';
-import { P as PublicCollection } from './const-Dlu0mXmj.js';
-import './payload-types-BgOEk6Y9.js';
+import { P as PublicCollection } from './const-CCvoknRY.js';
+import './payload-types-PXkmefhZ.js';
 
 interface UseRealtimeQueryOptions {
     /** Filter events to specific collections. Empty/undefined = all collections. */

package/dist/server.cjs

@@ -911,7 +911,7 @@ async function httpFetch(url, options) {
           );
           const usageError = attachRequestId(
             createUsageLimitError(
-              `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,
+              `Monthly API usage limit exceeded (${current.toLocaleString("en-US")}/${limit.toLocaleString("en-US")})`,
               { limit, current, remaining },
               {
                 url,
@@ -2990,7 +2990,18 @@ var ABANDONED_REASONS = ["expired", "customer", "operator"];
 function managedPaymentProviders(providers) {
   return providers;
 }
-var PAYMENT_PROVIDERS = managedPaymentProviders(["toss", "portone"]);
+var PAYMENT_PROVIDERS = managedPaymentProviders([
+  "toss",
+  "portone",
+  "stripe"
+]);
+var CANCEL_RECOVERY_METHODS = {
+  toss: "cancel()",
+  portone: "cancelPortOne()",
+  stripe: null
+};
+var STRIPE_RETURN_URL_RAW_CHARACTERS = /^[^\s\u0000-\u001F\u007F\\]+$/;
+var STRIPE_RETURN_URL_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]+(?:[/?#]|$)/;
 var PAYMENT_PROVIDER_STATUSES = [
   "requires_payment_method",
   "requires_action",
@@ -3051,11 +3062,8 @@ function fail(resource, path, expected) {
   invalidCanonicalResponse(resource, { path, expected });
 }
 function providerMismatch(resource, expected, actual, operation2) {
-  if (operation2 === "cancel") {
-    const method = {
-      toss: "cancel()",
-      portone: "cancelPortOne()"
-    }[actual];
+  const method = CANCEL_RECOVERY_METHODS[actual];
+  if (operation2 === "cancel" && method !== null) {
     throw createApiError(
       `Canonical ${resource} response provider mismatch: expected ${expected}, received ${actual}.`,
       502,
@@ -4246,6 +4254,65 @@ function validateRequiredReconciliation(value, allowed, resource, path) {
 }
 function validateNextAction(value, provider, resource, path) {
   const action = record(value, resource, path);
+  if (provider === "stripe") {
+    exact(
+      action,
+      ["type", "clientSecret", "publishableKey", "returnUrl"],
+      [],
+      resource,
+      path
+    );
+    if (action.type !== "stripe_payment_element")
+      fail(resource, `${path}.type`, "stripe_payment_element");
+    const clientSecret = boundedString(
+      action.clientSecret,
+      255,
+      resource,
+      `${path}.clientSecret`
+    );
+    if (!/^pi_[A-Za-z0-9]+_secret_[A-Za-z0-9]+$/.test(clientSecret)) {
+      fail(
+        resource,
+        `${path}.clientSecret`,
+        "Stripe PaymentIntent client secret"
+      );
+    }
+    const publishableKey = boundedString(
+      action.publishableKey,
+      255,
+      resource,
+      `${path}.publishableKey`
+    );
+    if (!/^pk_(?:test|live)_[A-Za-z0-9]+$/.test(publishableKey)) {
+      fail(resource, `${path}.publishableKey`, "Stripe publishable key");
+    }
+    const returnUrl = boundedString(
+      action.returnUrl,
+      2048,
+      resource,
+      `${path}.returnUrl`
+    );
+    if (!STRIPE_RETURN_URL_RAW_CHARACTERS.test(returnUrl) || !STRIPE_RETURN_URL_AUTHORITY.test(returnUrl)) {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    try {
+      const parsed = new URL(returnUrl);
+      const loopback = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+      if (!loopback && parsed.protocol !== "https:" || parsed.username || parsed.password)
+        throw new Error("unsafe return URL");
+    } catch {
+      fail(
+        resource,
+        `${path}.returnUrl`,
+        "HTTPS or loopback URL without embedded credentials"
+      );
+    }
+    return;
+  }
   if (provider === "portone") {
     if (action.type === "portone_sdk") {
       const hasCancelable = "cancelable" in action;
@@ -4621,7 +4688,7 @@ function validatePublicPaymentSession(value, expectedProvider, operation2) {
     );
   }
   if (expectedProvider !== void 0 && provider !== expectedProvider) {
-    if (operation2 === "cancel" && status !== "canceling" && status !== "canceled") {
+    if (operation2 === "cancel" && CANCEL_RECOVERY_METHODS[provider] !== null && status !== "canceling" && status !== "canceled") {
       fail(
         resource,
         "$.providerStatus",
@@ -4901,6 +4968,11 @@ function getRelationID(value) {
   }
   return void 0;
 }
+function compareOrdinal(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
 function extractEntityId(value) {
   if (typeof value === "string") return value;
   if (typeof value === "number") return String(value);
@@ -5513,7 +5585,7 @@ function compareVariantOrder(a, b) {
   }
   const aId = String(getRelationID(a.id) ?? "");
   const bId = String(getRelationID(b.id) ?? "");
-  return aId.localeCompare(bId);
+  return compareOrdinal(aId, bId);
 }
 function getVariantAvailableForSale(variant) {
   if (variant.isActive === false) return false;
@@ -6720,6 +6792,8 @@ function buildRangeEndpoint(params) {
 function buildAdmissionAvailabilityEndpoint(params) {
   const urlParams = new URLSearchParams();
   urlParams.set("occurrence", params.occurrence);
+  const normalizedMarket2 = params.market?.trim();
+  if (normalizedMarket2) urlParams.set("market", normalizedMarket2);
   return resolveOperationPath(
     EVENTS_ENDPOINT_OPERATIONS.occurrences.admissionAvailability,
     { query: urlParams }
@@ -6922,16 +6996,37 @@ var MembershipApi = class extends BaseApi {
   }
   /**
    * Store/read only app-encrypted billing ciphertext for the Membership's
-   * method. The tenant server receives the non-secret restore generation from
-   * its platform operator's integration configuration; it is not discovered
-   * from an unauthenticated endpoint.
+   * method. Obtain generation from billingCustodyContext before a new upload
+   * or read, and retain that same generation for every mutation based on the
+   * read. Never rediscover and retry a mutation after a generation mismatch.
    */
   async billingCustody(params) {
     const { webhookSecret, ...input } = params;
-    const body = {
-      kind: "billing-custody.v1",
-      ...input
-    };
+    return this.requestBillingCustody(
+      {
+        kind: "billing-custody.v1",
+        ...input
+      },
+      webhookSecret
+    );
+  }
+  /** Requires the same server key, Membership and delegated HMAC as custody. */
+  async billingCustodyContext(params) {
+    const result = await this.requestBillingCustody(
+      {
+        kind: "billing-custody.v1",
+        action: "context",
+        membershipId: params.membershipId
+      },
+      params.webhookSecret
+    );
+    if (!result || typeof result !== "object" || Array.isArray(result) || Object.keys(result).length !== 2 || !("action" in result) || result.action !== "context" || !("generation" in result) || typeof result.generation !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+      result.generation
+    ))
+      throw new Error("Invalid billing custody context response");
+    return { action: "context", generation: result.generation };
+  }
+  async requestBillingCustody(body, webhookSecret) {
     const timestamp2 = Date.now().toString();
     const deliveryId = crypto.randomUUID();
     const signature = await custodySignature(
@@ -7295,7 +7390,8 @@ var ServerClient = class _ServerClient {
       subscribe: membershipApi.subscribe.bind(membershipApi),
       endSubscribeIntent: membershipApi.endSubscribeIntent.bind(membershipApi),
       cancel: membershipApi.cancel.bind(membershipApi),
-      billingCustody: membershipApi.billingCustody.bind(membershipApi)
+      billingCustody: membershipApi.billingCustody.bind(membershipApi),
+      billingCustodyContext: membershipApi.billingCustodyContext.bind(membershipApi)
     };
     this.customerGroups = new CustomerGroupApi(serverOptions);
     this.externalEffectClaims = new ExternalEffectClaimsApi(serverOptions);