@orvello/sdk 0.2.4 → 0.4.0

package/CONTRACT_SHA256

@@ -1 +1 @@
-bfd85f17c2aa38bf82c759d02eefaecde34d402f7704d074e5fcdc8cb35c3990
+c3f121a094268542856384510d880bbd65a13b5b242c38e017ad5f622e3b30e2

package/README.md

@@ -411,3 +411,18 @@ import type {
 ## License
 
 MIT
+# Bank payment evidence
+
+`await client.invoices.getPaymentEvidence(invoiceId)` reads authoritative bank
+allocations separately from invoice status. Amounts remain decimal strings. Use
+`bankPaymentConfirmed`, `state` and `issues` together; a manual `paid` mark alone is
+not bank evidence. `revision` is a content digest, not an ordered event version.
+This call neither imports bank transactions nor initiates payments.
+
+### Frozen bank payment instructions
+
+`client.invoices.getPaymentInstructions(invoiceId)` reads the invoice's frozen bank
+reference and recipient. The amount is a decimal string. Existing invoices without a
+snapshot return HTTP 409; the SDK does not invent instructions. This read is not payment
+evidence and must not trigger provisioning. Use `getPaymentEvidence` for bank coverage.
+The matching Bills endpoint and schema must be deployed before using this operation.

package/dist/contract.cjs

@@ -394,6 +394,70 @@ var apiRoutes_app_info = {
 
 // src/generated/api/base/routes.auth.ts
 var apiRoutes_auth = {
+  // Contract source: explicit
+  "auth_mfa_complete": {
+    method: "POST",
+    path: "/auth/mfa/complete",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Complete a first-factor login with TOTP or a recovery code",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_status": {
+    method: "GET",
+    path: "/auth/mfa",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Read the current product account's MFA status",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_setup": {
+    method: "POST",
+    path: "/auth/mfa/setup",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Prepare TOTP enrollment after rechecking the password",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_enable": {
+    method: "POST",
+    path: "/auth/mfa/enable",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Confirm TOTP enrollment and return recovery codes once",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_disable": {
+    method: "POST",
+    path: "/auth/mfa/disable",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Disable MFA using both the password and a second factor",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
   // Contract source: explicit
   "auth_register": {
     method: "POST",
@@ -521,6 +585,107 @@ var apiRoutes_auth = {
       validated: { "params": false, "query": true, "body": false }
     },
     types: null
+  },
+  // Contract source: explicit
+  "auth_me_email_patch": {
+    method: "PATCH",
+    path: "/auth/me/email",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Change current user's email after password confirmation",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_change": {
+    method: "POST",
+    path: "/auth/password/change",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Change password for the current user",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_request": {
+    method: "POST",
+    path: "/auth/password/reset/request",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Request a password reset email",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_confirm": {
+    method: "POST",
+    path: "/auth/password/reset/confirm",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Reset password with an email token",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_landing": {
+    method: "GET",
+    path: "/auth/password/reset",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Browser landing page for password reset links",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_list": {
+    method: "GET",
+    path: "/auth/sessions",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "List active refresh-token sessions for the current user",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_revoke": {
+    method: "DELETE",
+    path: "/auth/sessions/:sessionId",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Revoke one active session",
+      validated: { "params": true, "query": false, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_revoke_other": {
+    method: "POST",
+    path: "/auth/sessions/revoke-other",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Revoke all sessions except the supplied current refresh token",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
   }
 };
 
@@ -3711,6 +3876,32 @@ var apiRoutes_invoices = {
 
 // src/generated/api/features/routes.invoices_external.ts
 var apiRoutes_invoices_external = {
+  // Contract source: explicit
+  "invoices_payment_evidence_external": {
+    method: "GET",
+    path: "/invoices/external/:invoiceId/payment-evidence",
+    auth: { "type": "unified_bearer", "allowUserSession": false, "allowOAuth2": true, "allowApiKey": true, "requireRole": "viewer", "scopes": ["invoices:read"] },
+    meta: {
+      tags: ["invoices-external"],
+      summary: "Read bank payment evidence for an invoice",
+      description: "Consistent read-only snapshot of imported bank payments and refunds. Separates cash from discounts, writeoffs and manual paid marks. Decimal amounts are strings. bankPaymentConfirmed requires full matching-account/currency bank coverage without unresolved issues. revision is a content digest, not an ordered event version. No bank import or payment is initiated.",
+      validated: { "params": true, "query": false, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "invoices_payment_instructions_external": {
+    method: "GET",
+    path: "/invoices/external/:invoiceId/payment-instructions",
+    auth: { "type": "unified_bearer", "allowUserSession": false, "allowOAuth2": true, "allowApiKey": true, "requireRole": "viewer", "scopes": ["invoices:read"] },
+    meta: {
+      tags: ["invoices-external"],
+      summary: "Read immutable bank payment instructions",
+      description: "Reference and recipient frozen on first issue. Decimal amount is a string. Historical invoices without a snapshot return 409; no reference is created by reading. This is not evidence of payment or permission to provision.",
+      validated: { "params": true, "query": false, "body": false }
+    },
+    types: null
+  },
   // Contract source: explicit
   "invoices_search_external": {
     method: "GET",