@01.software/sdk 0.72.1 → 0.74.0

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # @01.software/sdk
 
+## 0.74.0
+
+### Minor Changes
+
+- a5ac520: **Additive response arm (0.x minor).** `cancelOrder()` already returned this body for an order paid entirely with customer credit; `CancelOrderResponse` now types it as `CancelOrderCreditOnlyCommittedResponse` (exported from `@01.software/sdk`): `cancelCommitted: true`, the restored purchase total as `refundedAmount`, `providerRefunded: false`, and no `transactionId` or `refundPending`. There is no PG refund to run. Runtime behavior is unchanged. Code that assumed a committed response without `transactionId` has `refundedAmount: 0`, or an exhaustive check over `CancelOrderResponse`, needs the new arm.
+- b01549e: Feature progress now supports `customers` and `community` in addition to `ecommerce`. `createServerClient().tenant.featureProgress({ feature })` returns the response for the requested feature (`TenantFeatureProgressResponseFor<F>`): the `ecommerce` response keeps `config.fulfillmentMode`, while `customers` and `community` responses have no `config`. `TenantFeatureProgressResponse` still names the ecommerce response and `TenantFeatureProgressInput` still defaults to `feature: 'ecommerce'`, so existing wrappers keep their types; use `TenantFeatureProgressInput<TenantFeatureProgressFeature>` and `TenantFeatureProgressResponseUnion` to handle every supported feature. `01 feature check customers|community` reports hosted customer sign-in and first public comment setup. Manual items still require an end-to-end check in the app.
+
+  BREAKING (0.x minor): `TenantFeatureProgressFeature` now also includes `'customers'` and `'community'`, so exhaustive handling of that type needs the new cases, and a hand-written `TenantIntrospectionClient` implementation must type `featureProgress` as generic over the requested feature.
+
+- 6b8a188: Feature progress now supports `events`. `createServerClient().tenant.featureProgress({ feature: 'events' })` and `01 feature check events` report whether the workspace event calendar is public and whether a scheduled, not-yet-ended occurrence accepts a free RSVP, plus a manual register, lookup, and cancel check. The check is read-only and does not evaluate remaining capacity or paid admission. The response has no `config`.
+
+  BREAKING (0.x minor): `TenantFeatureProgressFeature` now also includes `'events'`, so exhaustive handling of that type needs the new case.
+
+- f433dee: Feature progress now supports `membership`. `createServerClient().tenant.featureProgress({ feature: 'membership' })` and `01 feature check membership` report whether an active plan has an active price for new sign-ups, plus a manual sign-up, charge, renewal, and cancellation check. Apps that only read or cancel existing memberships can treat the sellable-plan item as optional. The response has no `config`, like `customers` and `community`.
+
+  BREAKING (0.x minor): `TenantFeatureProgressFeature` now also includes `'membership'`, so exhaustive handling of that type needs the new case.
+
+### Patch Changes
+
+- 6814052: Clarify generated Event location JSDoc about the public read visibility of stored online URLs and notes and the privacy of internal notes. Persisted location paths and public read behavior remain unchanged.
+- 65ed375: `Tenant` 생성 타입의 `defaultContentLocale` 설명 주석에 고객 메일도 이 언어로 발송한다는 내용이 추가됩니다. 타입 구조는 변경하지 않습니다.
+- eb457be: Regenerate Payload type documentation after clarifying guest-link expiry guidance in the Console Admin Panel. Only JSDoc changes; field types and API response shapes are unchanged.
+- e1c8158: Order variants by their fractional-indexing `_order` key (code-unit order, keyed before unkeyed; equal to the Admin Panel order for current-format `[0-9a-z]` keys) instead of a `Number()` conversion that turned every key into `NaN`, so listing-group representative variants and `fillDefaults` selections follow the Admin Panel variant order.
+- e0fcb45: Type `createServerClient().video` as non-optional so the documented `createServerClient(...).video.playback(id)` compiles under strict TypeScript without `?.` or `!`. The server client always sets `video` at runtime; `RootServerClient.video` stays optional for structural mocks. A hand-written mock typed as `RootServerClientWithEvents` (or a `withMarket()` stub returning it) now needs a `video` member.
+- 58f915b: `Customer`·`Product` 생성 타입에서 `customData` 속성의 선언 순서만 바뀝니다. 타입 구조는 변경하지 않습니다.
+- 0e826e1: Remove collection-level descriptions from the generated payload types; Console list screens no longer show collection descriptions.
+- 6dea486: Shorten or remove commerce field descriptions in the generated payload types to match the trimmed Console copy.
+- 8530c76: Align event and registration descriptions in the generated payload types with the Console public read terminology and clarify guest-token PII visibility under retention policies. Types and response shapes are unchanged.
+- 9c0c1d5: Point the generated `users.tenants` description at the renamed Settings > Workspace > Project destination.
+- 16b3229: Shorten or remove shared field descriptions (SEO, subtitle, summary, taxonomy, videos) in the generated payload types to match the trimmed Console copy.
+- a26270c: Keep internal profile record creation evidence out of public profile and profile-statistics types while synchronizing the generated storage schema. Ordinary API and GraphQL surfaces do not expose `recordCreatedAt`.
+- 1d52b00: Shorten or remove customer and membership field descriptions in the generated payload types to match the trimmed Console copy.
+- a16f609: Shorten or remove content, community and event field descriptions in the generated payload types to match the trimmed Console copy.
+- 4165ada: Add `voided` to the generated `MembershipUnappliedPaidEvidence.reason` values for late paid evidence on expired setup charges.
+- 27f0891: Shorten or remove workspace, settings and system field descriptions in the generated payload types to match the trimmed Console copy.
+- 5376b13: Fix product listing-page search requests to query title and slug only, avoiding HTTP 400 errors caused by querying the nonexistent Products handle field.
+- fb854bc: 생성 타입에서 입장 유형 `priceReference` 필드 설명 주석을 갱신한다. 런타임과 타입 시그니처 변경은 없다.
+- 809b7db: Clarify the generated Video viewCount documentation to reflect that views are not currently collected automatically. The type structure is unchanged.
+
+## 0.73.1
+
+### Patch Changes
+
+- 57e6e15: Sort product options and option values by their orderable `_order` keys in Payload's fractional-indexing (code-unit) order instead of the runtime-locale-dependent `localeCompare` order. For current-format keys this is the order the Admin Panel shows.
+- 623b7e8: Update the generated field descriptions for the tenant base currency and the market exchange rate.
+- 265ad09: Synchronize generated storage types for internal Project invitations and private
+  current-email verification evidence. No invitation SDK API or collection access
+  is added.
+
+## 0.73.0
+
+### Minor Changes
+
+- b271588: Add optional market selection to events.getAdmissionAvailability so callers can display the same market price used by Cart and Checkout. Omitted market uses the catalog default; the public price response keeps its existing fields. Resolved-market reads, including default-market calls, omit admission types whose same-tenant products are not assigned to that market.
+- 41c7d41: Add server-only `memberships.billingCustodyContext` to obtain the Console-owned
+  restore generation through the existing delegated HMAC custody boundary. Keep
+  legacy ciphertext requests and responses compatible. Deploy Console support
+  before publishing the SDK or using the updated Membership and CLUB templates.
+  The bundled starters obtain the generation from Console without a storefront
+  environment variable and retain the generation across custody read/CAS updates.
+
+### Patch Changes
+
+- 163b450: Clarify that form submission email settings are retained for compatibility and do not send notifications, without changing field keys or types.
+- ae622d1: Refresh generated workspace sender, credential, and webhook field descriptions. Public types and API behavior are unchanged.
+- f8a25e1: Clarify that tenant administrators obtain the billing custody restore generation from the authenticated Console delegated billing connection panel.
+- 9cfcc4e: Update generated User membership guidance to point Project workspace member management to Settings > Workspace > Project environments. No SDK type shape or runtime behavior changes.
+- b8a447c: Clarify generated transaction kind and shipping policy descriptions without changing field keys or types.
+- 4781438: Clarify the generated customer address description. Field types and API response shapes are unchanged.
+- 3d0665d: Clarify the generated preview destination description without changing its schema or behavior.
+- 668102b: Webhook.url 필드 설명의 민감정보 경고를 복원합니다. 타입 구조는 변경하지 않습니다.
+- 5ef9bc6: Format the numbers in the `Monthly API usage limit exceeded (current/limit)` error message with a fixed `en-US` locale so the message no longer depends on the runtime's default locale.
+
 ## 0.72.1
 
 ### Patch Changes

package/README.md

@@ -472,6 +472,8 @@ addendum in `docs/decisions/0012-sdk-public-commerce-contract.md`.
 
 ### Product Listing Pages (PLP) — join-safe queries
 
+`search` trims surrounding whitespace and matches product `title` or `slug`.
+
 **Recommended path:** Use `commerce.product.listingPage()` (or
 `createQueryHooks(client).useProductListingPage()`) for greenfield storefront
 PLPs. It wraps the cacheable listing-groups query endpoint, keeps the raw
@@ -933,6 +935,32 @@ request UUID and the current version; exact retries retain the original values.
 A privacy-erased snapshot has state `erased`, null `externalCustomerId`, and
 null `previousState`. Keep these calls and snapshots in trusted server code.
 
+### Delegated billing ciphertext
+
+The server client obtains the Console-owned restore generation through the
+existing custody endpoint, using its server key and delegated connection HMAC:
+
+```ts
+const { generation } = await server.memberships.billingCustodyContext({
+  membershipId,
+  webhookSecret,
+})
+const stored = await server.memberships.billingCustody({
+  action: 'read',
+  membershipId,
+  webhookSecret,
+  generation,
+})
+```
+
+Keep that generation and `stored.version` for mutations based on this read.
+Obtain a context immediately before a fresh initial upload (`expectedVersion: 0`).
+Generation mismatch stops execution; never fetch a new context to retry an old
+mutation or charge. After recovery, provider re-authorization and a fresh encrypted
+upload/readback are required. Existing explicit-generation requests remain
+supported. Deploy Console support before SDK publication and upgraded template
+use; unsupported servers and malformed contexts fail without fallback.
+
 ## Storefront performance defaults
 
 - **PLP:** prefer `commerce.product.listingPage()` or `useProductListingPage()` (GET `/api/products/listing-groups/query/catalog`, CDN-cacheable, card-ready). Use `listingGroupsCatalog({ productIds })` only when IDs are already known. Treat the full listing-groups response shape as a server-auth escape hatch because it can include operational stock fields. Avoid fetching a product list and then calling `detail()` per card.
@@ -1634,9 +1662,24 @@ customer already owns returns `resolution: 'unchanged'` and writes nothing, so
 the revision you last observed stays valid for the next mutation. Because it
 writes nothing, such a merge does not count as Cart activity for stale-Cart
 cleanup.
+`carts.merge` rejects an unknown or wrong `guestCartToken`, or a Cart belonging to another
+customer or tenant, with the same `404/not_found` envelope without writes.
+The response does not reveal which case occurred. Branch on
+`reason`, and use `requestId` for support correlation rather than comparing error text.
 Treat a replayed Cart result as an operation receipt: never replace a newer
 cached Cart with a lower `revision`; retrieve when response ordering is unclear.
 
+A customer can have more than one active Cart, because `carts.create` always
+creates a new Cart. `carts.mine` returns the active Cart with the latest
+`createdAt`, and `carts.merge` merges a guest Cart into that same Cart. When
+`createdAt` is equal, the Cart with the higher `id` is chosen. Merging an active
+Cart the customer already owns returns that Cart `unchanged`, even when it is an
+older Cart.
+
+If the guest Cart's market differs from that chosen Cart, `carts.merge` returns
+`409 cart_market_mismatch`. It does not merge into an older Cart in the guest
+Cart's market instead.
+
 Shipping Checkout creation requires a request `shippingAddress` or a valid
 stored Cart address whenever any line has `requiresShipping !== false`.
 `recipientName`, `phone`, `postalCode`, `address`, and `detailAddress` must be nonblank after trimming. Otherwise,
@@ -1931,9 +1974,12 @@ Customer order reads remain available through
 The SDK root no longer exports raw generated `Order`, `Transaction`, `Cart`, or
 `CartItem` Payload documents. Use the canonical `PublicOrder` / `PublicCart`
 DTOs for storefront code and explicit server collection types only inside
-trusted operational code. Order cancellation no longer returns the deprecated
-inline provider-refund branch. `refundPending` is a local financial marker, not
-authority for caller provider I/O:
+trusted operational code. SDK types no longer include the retired inline
+provider-refund flow. An order whose cancellation started through that flow can
+still return `providerRefunded: true` with `refundSeq`, or an uncommitted body
+with `reconciliationRequired: true`. These bounded legacy bodies remain outside
+`CancelOrderResponse`. `refundPending` is a local financial marker, not authority
+for caller provider I/O:
 
 | Captured payment lane                                   | Provider refund owner        | `resolveCancelRefund`                                                               |
 | ------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------------- |
@@ -1956,6 +2002,13 @@ as a committed cancellation and never start a provider refund from your
 storefront or BFF. A retry reads or resumes the same Console refund. Registered
 PortOne and credit-funded managed orders still return the pending marker.
 
+For an order paid entirely with customer credit, `cancelOrder()` restores credit
+inside the cancel commit and returns `CancelOrderCreditOnlyCommittedResponse`:
+`cancelCommitted: true`, the positive restored purchase total as
+`refundedAmount`, and `providerRefunded: false`, with neither `transactionId`
+nor `refundPending`. There is no PG refund to run. A later domain retry uses the
+ordinary `alreadyCanceled` arm with the same `refundedAmount`.
+
 Managed ownership follows the captured Transaction's exact tenant-bound
 PaymentSession and historical registered account. Order/provider/environment
 drift remains Console-owned corruption. Unresolved or cross-tenant identity
@@ -2328,6 +2381,20 @@ replacement API. Pass an empty list to clear codes. Singular `admission`,
 Browser `mine()`/`merge({ guestCartToken })` derive customer identity from the
 JWT; server calls require an explicit `customerToken`.
 
+### Event admission availability
+
+For paid admission choices, call
+`client.events.getAdmissionAvailability({ occurrence, market: 'kr' })` with an
+active market handle or id. Omit `market` for the catalog default. The public
+price includes `amount`, `compareAtPrice`, `currency`, and `marketId` resolved
+from fixed market prices or the market calculation; an unknown market returns
+`404 not_found`. Use the same market for the Cart. Checkout re-reads current
+pricing and eligibility. When a market resolves, admission types are returned
+only when their same-tenant product is assigned to that market. This filter also
+applies to existing calls that omit `market` and use the default market; missing
+products and empty assignments are omitted. With no active market, base pricing
+and the existing unfiltered behavior remain.
+
 ### Customer event registration history
 
 After customer sign-in, `client.events.listMyRegistrations({ page: 1, limit: 10 })`

package/dist/client.cjs

@@ -896,7 +896,7 @@ async function httpFetch(url, options) {
           );
           const usageError = attachRequestId(
             createUsageLimitError(
-              `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,
+              `Monthly API usage limit exceeded (${current.toLocaleString("en-US")}/${limit.toLocaleString("en-US")})`,
               { limit, current, remaining },
               {
                 url,
@@ -1386,6 +1386,10 @@ var EMBEDDED_ADMIN_ENDPOINT_OPERATIONS = {
   configure: operation("tenants", "patch", "/embedded-admin-app"),
   disable: operation("tenants", "delete", "/embedded-admin-app")
 };
+var FIELD_CONFIG_ENDPOINT_OPERATIONS = {
+  list: operation("field-configs", "get", "/list"),
+  save: operation("field-configs", "post", "/save")
+};
 var EVENTS_ENDPOINT_OPERATIONS = {
   registrations: {
     register: operation("event-registrations", "post", "/register"),
@@ -5613,6 +5617,11 @@ function getRelationID(value) {
   }
   return void 0;
 }
+function compareOrdinal(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
 function extractEntityId(value) {
   if (typeof value === "string") return value;
   if (typeof value === "number") return String(value);
@@ -6218,14 +6227,17 @@ function buildProductHref(product, group, options = {}) {
   return params.size > 0 ? `${path}?${params.toString()}` : path;
 }
 function compareVariantOrder(a, b) {
-  const aOrder = Number(a._order ?? Number.MAX_SAFE_INTEGER);
-  const bOrder = Number(b._order ?? Number.MAX_SAFE_INTEGER);
-  if (Number.isFinite(aOrder) && Number.isFinite(bOrder) && aOrder !== bOrder) {
-    return aOrder - bOrder;
+  const aOrder = a._order || null;
+  const bOrder = b._order || null;
+  if (aOrder !== bOrder) {
+    if (aOrder === null) return 1;
+    if (bOrder === null) return -1;
+    const byOrder = compareOrdinal(aOrder, bOrder);
+    if (byOrder !== 0) return byOrder;
   }
   const aId = String(getRelationID(a.id) ?? "");
   const bId = String(getRelationID(b.id) ?? "");
-  return aId.localeCompare(bId);
+  return compareOrdinal(aId, bId);
 }
 function getVariantAvailableForSale(variant) {
   if (variant.isActive === false) return false;
@@ -6472,11 +6484,7 @@ function buildProductListingPageWhere(params) {
   const search = params.search?.trim();
   if (search) {
     clauses.push({
-      or: [
-        { title: { like: search } },
-        { slug: { like: search } },
-        { handle: { like: search } }
-      ]
+      or: [{ title: { like: search } }, { slug: { like: search } }]
     });
   }
   const filters = params.filters;
@@ -6830,6 +6838,8 @@ function buildRangeEndpoint(params) {
 function buildAdmissionAvailabilityEndpoint(params) {
   const urlParams = new URLSearchParams();
   urlParams.set("occurrence", params.occurrence);
+  const normalizedMarket2 = params.market?.trim();
+  if (normalizedMarket2) urlParams.set("market", normalizedMarket2);
   return resolveOperationPath(
     EVENTS_ENDPOINT_OPERATIONS.occurrences.admissionAvailability,
     { query: urlParams }