@orvello/sdk 0.3.0 → 0.5.0

package/CONTRACT_SHA256

@@ -1 +1 @@
-eb64699e8b371644f2a18619fdd4c65055683b270c6c92577cf8e0df8716d2ca
+02a65db9ad216d195f560a2e4f7cdd7a19a38814362b4c89551188796b017768

package/README.md

@@ -418,3 +418,21 @@ allocations separately from invoice status. Amounts remain decimal strings. Use
 `bankPaymentConfirmed`, `state` and `issues` together; a manual `paid` mark alone is
 not bank evidence. `revision` is a content digest, not an ordered event version.
 This call neither imports bank transactions nor initiates payments.
+
+### Frozen bank payment instructions
+
+`client.invoices.getPaymentInstructions(invoiceId)` reads the invoice's frozen bank
+reference and recipient. The amount is a decimal string. Existing invoices without a
+snapshot return HTTP 409; the SDK does not invent instructions. This read is not payment
+evidence and must not trigger provisioning. Use `getPaymentEvidence` for bank coverage.
+The matching Bills endpoint and schema must be deployed before using this operation.
+
+### Replay bank payment evidence events
+
+`client.invoices.getPaymentEvents(invoiceId, { afterVersion: 0, limit: 50 })`
+returns durable events ordered by per-invoice `version`, plus `nextVersion` and
+`hasMore`. Store the cursor atomically with inbox processing, deduplicate by event
+UUID and reject unknown schema versions. Replay does not acknowledge/delete events.
+Re-read `getPaymentEvidence(invoiceId)` before acting on historical coverage.
+A later event can revoke it. Invoices without frozen instructions are not enrolled.
+Available with Bills payment-event journal migration 0041 and the matching API deployment.

package/dist/contract.cjs

@@ -394,6 +394,70 @@ var apiRoutes_app_info = {
 
 // src/generated/api/base/routes.auth.ts
 var apiRoutes_auth = {
+  // Contract source: explicit
+  "auth_mfa_complete": {
+    method: "POST",
+    path: "/auth/mfa/complete",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Complete a first-factor login with TOTP or a recovery code",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_status": {
+    method: "GET",
+    path: "/auth/mfa",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Read the current product account's MFA status",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_setup": {
+    method: "POST",
+    path: "/auth/mfa/setup",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Prepare TOTP enrollment after rechecking the password",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_enable": {
+    method: "POST",
+    path: "/auth/mfa/enable",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Confirm TOTP enrollment and return recovery codes once",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_mfa_disable": {
+    method: "POST",
+    path: "/auth/mfa/disable",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Disable MFA using both the password and a second factor",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
   // Contract source: explicit
   "auth_register": {
     method: "POST",
@@ -521,6 +585,107 @@ var apiRoutes_auth = {
       validated: { "params": false, "query": true, "body": false }
     },
     types: null
+  },
+  // Contract source: explicit
+  "auth_me_email_patch": {
+    method: "PATCH",
+    path: "/auth/me/email",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Change current user's email after password confirmation",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_change": {
+    method: "POST",
+    path: "/auth/password/change",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Change password for the current user",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_request": {
+    method: "POST",
+    path: "/auth/password/reset/request",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Request a password reset email",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_confirm": {
+    method: "POST",
+    path: "/auth/password/reset/confirm",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Reset password with an email token",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_password_reset_landing": {
+    method: "GET",
+    path: "/auth/password/reset",
+    auth: { "type": "public" },
+    meta: {
+      tags: ["auth"],
+      summary: "Browser landing page for password reset links",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_list": {
+    method: "GET",
+    path: "/auth/sessions",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "List active refresh-token sessions for the current user",
+      validated: { "params": false, "query": true, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_revoke": {
+    method: "DELETE",
+    path: "/auth/sessions/:sessionId",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Revoke one active session",
+      validated: { "params": true, "query": false, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
+  "auth_sessions_revoke_other": {
+    method: "POST",
+    path: "/auth/sessions/revoke-other",
+    auth: { "type": "frontend_bearer_http" },
+    meta: {
+      tags: ["auth"],
+      summary: "Revoke all sessions except the supplied current refresh token",
+      bodyContentType: "application/json",
+      validated: { "params": false, "query": false, "body": true }
+    },
+    types: null
   }
 };
 
@@ -3711,6 +3876,19 @@ var apiRoutes_invoices = {
 
 // src/generated/api/features/routes.invoices_external.ts
 var apiRoutes_invoices_external = {
+  // Contract source: explicit
+  "invoices_payment_events_external": {
+    method: "GET",
+    path: "/invoices/external/:invoiceId/payment-events",
+    auth: { "type": "unified_bearer", "allowUserSession": false, "allowOAuth2": true, "allowApiKey": true, "requireRole": "viewer", "scopes": ["invoices:read"] },
+    meta: {
+      tags: ["invoices-external"],
+      summary: "Replay durable bank payment evidence events",
+      description: "Per-invoice ordered journal, afterVersion exclusive. Replay does not acknowledge or delete events. Consumers persist their cursor atomically with processing and re-read current payment evidence before commerce actions. Historical invoices without frozen instructions are not enrolled. No global cursor or delivery-order promise across invoices.",
+      validated: { "params": true, "query": true, "body": false }
+    },
+    types: null
+  },
   // Contract source: explicit
   "invoices_payment_evidence_external": {
     method: "GET",
@@ -3725,6 +3903,19 @@ var apiRoutes_invoices_external = {
     types: null
   },
   // Contract source: explicit
+  "invoices_payment_instructions_external": {
+    method: "GET",
+    path: "/invoices/external/:invoiceId/payment-instructions",
+    auth: { "type": "unified_bearer", "allowUserSession": false, "allowOAuth2": true, "allowApiKey": true, "requireRole": "viewer", "scopes": ["invoices:read"] },
+    meta: {
+      tags: ["invoices-external"],
+      summary: "Read immutable bank payment instructions",
+      description: "Reference and recipient frozen on first issue. Decimal amount is a string. Historical invoices without a snapshot return 409; no reference is created by reading. This is not evidence of payment or permission to provision.",
+      validated: { "params": true, "query": false, "body": false }
+    },
+    types: null
+  },
+  // Contract source: explicit
   "invoices_search_external": {
     method: "GET",
     path: "/invoices/external",