@autobusal/providers 1.40.3 → 1.40.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.40.4
+
+### Fixed
+
+- **The Content-Language header survives a cold load** - requests firing before i18next.init resolved carried no language at all, which is the recurring English-menu-under-/sq leak (CMS-05/CMS-07). The interceptor now falls back to the URL's locale prefix, then the stored preference.
+
 ## 1.40.3
 
 ### Fixed
@@ -363,6 +369,13 @@ added to `OperatorData` and `RouteData`, always optional and often absent.
 (`auto_publish`, `threshold`). Absent or false means every review waits for a
 human, which is the default for every brand.
 
+## [1.40.5] - 2026-08-26
+
+### Added
+
+- `OrderData.round_trip?` - whether the order is already half of a round
+  trip (either leg); computed by obtapi's single-order endpoint.
+
 ## [1.17.0] - 2026-08-02
 
 ### Changed

package/Queries/apiClient.ts

@@ -49,8 +49,25 @@ if (!isBffMode) {
 // upstream (see @autobusal/bff) - both sides had to change, only one of
 // them silently doing nothing would look identical to neither working.
 apiClient.interceptors.request.use(config => {
-  if (i18next.language) {
-    config.headers['Content-Language'] = i18next.language;
+  /*
+   * Claude - 2026-08-22 (audit findings CMS-05/CMS-07): on a COLD load,
+   * requests that fire before i18next.init resolves saw no language at
+   * all - so the first menu/settings fetch of a /sq visit carried no
+   * header and came back English, which is exactly the recurring
+   * English-menu-under-/sq leak the audit kept meeting. The fallback
+   * resolves the same way Setup/languages does: the URL's locale prefix
+   * first, then the stored preference. An unknown two-letter first
+   * segment is harmless - the API ignores languages it doesn't serve.
+   */
+  const fromUrl = window.location.pathname.split('/')[1];
+
+  const language = i18next.language
+    || (/^[a-z]{2}$/.test(fromUrl) ? fromUrl : '')
+    || localStorage.getItem('language')
+    || '';
+
+  if (language) {
+    config.headers['Content-Language'] = language;
   }
 
   return config;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.40.3",
+  "version": "1.40.5",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"
-}
+}

package/types/orders.ts

@@ -42,6 +42,10 @@ export interface OrderData {
   note_cancel: string
   actions: string[]
   created_at: string
+  // Claude - 2026-08-22 (audit TK-01): the PNR-style reference support and
+  // operators quote - both the listing and the single-order endpoint carry
+  // it; optional only because older cached rows may predate the column.
+  order_number?: string
   /*
    * Edited: Ferjolt Ozuni - Date: 2026-08-11
    * Who owns this order, collapsed to what a viewer outside the account
@@ -49,6 +53,10 @@ export interface OrderData {
    * Libraries\Orders\View::ownerCategory() (obtapi) for the mapping.
    */
   owner_category: 'agency' | 'operator' | 'individual'
+  // Claude - 2026-08-26: whether this order is already half of a round
+  // trip (either leg) - the return-trip offer stays silent when true.
+  // Optional: only the single-order endpoint computes it.
+  round_trip?: boolean
   // Edited: Ferjolt Ozuni - Date: 2026-08-11
   // Optional now: hidden on a restricted response (the public order lookup
   // and any other non-self-service view) - see View::get()'s $restricted.