@propeller-commerce/propeller-sdk-v2 0.17.0 → 0.18.1

package/CHANGELOG.md

@@ -3,6 +3,70 @@
 All notable changes to `@propeller-commerce/propeller-sdk-v2` are documented here.
 
 ---
+## [0.18.1] - 2026-11-03
+
+A host can now hand the client its own `fetch()`, and a query no longer fails
+the page when the connection to the API drops once.
+
+### Added
+
+- **`fetch` on `GraphQLClientConfig`.** Supply the `fetch()` the client sends
+  requests with; it defaults to the global `fetch`. Pass a request-scoped fetch
+  during SSR (Nitro's `event.fetch`, in Nuxt `useRequestEvent()!.fetch`) so a
+  relative proxy `endpoint` such as `/api/graphql` is served in-process instead
+  of over the network, which fails with `fetch failed` wherever a server can't
+  reach its own public hostname. A request-scoped fetch belongs to one request,
+  so create the client per request when you pass one. The type is exported as
+  `FetchImplementation`. Contributed by Mark Wienk (TRIMM) in
+  [#1](https://github.com/propeller-commerce/propeller-sdk-v2/pull/1). (PWP-1091)
+
+### Fixed
+
+- **A query is sent once more when the connection drops.** `GraphQL request
+  failed: fetch failed` used to reach the page straight away, so a
+  server-rendered page answered 500 where a reload worked. A query now gets one
+  more attempt, within the same `timeout`, before the error is thrown.
+  Mutations are never resent, since the server may have applied one before the
+  connection dropped; timeouts, HTTP error statuses and GraphQL errors are not
+  retried. (PWP-1062)
+
+---
+## [0.18.0] - 2026-09-24
+
+`product` and `cluster` can now be scoped to a contact and a company, so a
+storefront can ask the assortment question the API was always able to answer.
+
+### Added
+
+- **`userId` and `companyId` on the `product` and `cluster` queries.** Both
+  arguments have always existed on the schema — the generated operations simply
+  did not declare or forward them, so there was no way to reach them through the
+  SDK and every call resolved against the bearer token's own identity.
+
+  This is what left a direct link to a product outside the company's POSITIVE
+  orderlist opening normally while listings and search correctly hid it: the
+  listing queries scope by identity, the single-entity ones could not. With the
+  arguments in place, `product(productId:, userId:, companyId:)` answers
+  `PRODUCT_NOT_FOUND` for a product outside the contact's assortment, which is
+  the correct answer and what a host needs in order to 404 the page. (PWP-1015)
+
+  Both are optional and default to undefined, so every existing call is
+  unchanged.
+
+### Notes for consumers
+
+- The API rejects a `companyId` the contact does not belong to ("Unauthorized
+  use of companyId"), so a company restored from storage must be validated
+  against the contact's companies before it is sent.
+- Three adjacent gaps were found while checking this and are deliberately NOT
+  in this release, because each is a behaviour change rather than an additive
+  argument: `product`/`cluster` also accept `hidden`, `clusterConfig` forwards
+  only `clusterId` (so it is not identity-scoped either), and
+  `orderGetPDF`/`quoteGetPDF` accept a `revisionNumber`. Say the word and they
+  can go in one follow-up rather than three.
+
+---
+
 
 ## [0.17.0] - 2026-09-23
 

package/README.md

@@ -87,6 +87,7 @@ See [MIGRATION-0.10.0.md](./MIGRATION-0.10.0.md) for the full upgrade guide.
 | `getAccessToken` | `() => string \| undefined \| Promise<string \| undefined>` | reads `localStorage['access_token']` in browser | Use this for SSR (`getServerSession`, HTTP-only cookies) or in-memory token stores. |
 | `defaultLanguage` | `string` | — | ISO 639-1 tag (e.g. `'NL'`). Service methods that take an optional top-level `language` and don't receive one fall back to this value before sending the request. An explicit `language` on the call always wins. |
 | `throwOnPartialErrors` | `boolean` | `false` | On a partial response (`data` *and* `errors`), services return the data and debug-log the errors. Set `true` to throw `GraphQLOperationError` instead. `client.execute()` never throws regardless. |
+| `fetch` | `(url: string, init: RequestInit) => Promise<Response>` | global `fetch` | Request transport. Pass a request-scoped fetch during SSR (e.g. Nitro's `event.fetch`) so a relative proxy `endpoint` is handled in-process instead of over the network. A request-scoped fetch belongs to one request, so create the client per request when you pass one. |
 
 ### Proxy contract
 

package/dist/cjs/client/GraphQLClient.d.ts

@@ -66,6 +66,13 @@ export interface GraphQLResponse<T = any> {
  * May return a string, undefined (no token), or a Promise of either.
  */
 export type AccessTokenProvider = () => string | undefined | Promise<string | undefined>;
+/**
+ * The subset of `fetch()` the client calls: a URL string and a `RequestInit`,
+ * resolving to a standard `Response`. Narrower than `typeof fetch` so
+ * host-runtime implementations (undici, Nitro's `event.fetch`, test doubles)
+ * fit without matching every overload.
+ */
+export type FetchImplementation = (url: string, init: RequestInit) => Promise<Response>;
 /**
  * Configuration for the GraphQL client.
  */
@@ -118,6 +125,18 @@ export interface GraphQLClientConfig {
      * compatible). The low-level `client.execute()` never throws regardless.
      */
     throwOnPartialErrors?: boolean;
+    /**
+     * `fetch()` implementation used for every request. Defaults to the global
+     * `fetch`, resolved per request (so later polyfills and spies apply).
+     *
+     * Supply a request-scoped fetch during SSR to keep the call in-process:
+     * Nitro's `event.fetch` (Nuxt: `useRequestEvent()!.fetch`) routes a
+     * relative `endpoint` like `/api/graphql` straight to the app's own proxy
+     * handler. With the global `fetch`, SSR needs an absolute URL and makes a
+     * real network round trip to its own public hostname — which fails with
+     * `fetch failed` wherever the server can't reach its own ingress.
+     */
+    fetch?: FetchImplementation;
 }
 /**
  * A GraphQL client for the Propeller eCommerce Platform.
@@ -195,6 +214,9 @@ export declare class GraphQLClient {
      * who want to inspect partial responses can do so. The higher-level
      * `query()` / `mutate()` helpers and the `runOperation` helper used by
      * services throw `GraphQLOperationError` when `errors` is non-empty.
+     *
+     * A query whose connection drops (`fetch failed`) is sent once more, within
+     * the same `timeout`, before the error is thrown. Mutations are never resent.
      */
     execute<T = any>(operation: GraphQLOperation): Promise<GraphQLResponse<T>>;
     /**

package/dist/cjs/client/GraphQLClient.js

@@ -1,6 +1,7 @@
 "use strict";
-// Note: This client uses the built-in fetch API available in Node.js 18+.
-// For older runtimes, install a fetch polyfill.
+// Note: This client uses the built-in fetch API available in Node.js 18+
+// unless `config.fetch` supplies another implementation. For older runtimes,
+// install a fetch polyfill.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GraphQLClient = void 0;
 exports.createClient = createClient;
@@ -15,6 +16,10 @@ const DEFAULT_ORDER_EDITOR_MUTATIONS = [
     'triggerQuoteSendRequest',
     'triggerOrderSendConfirm',
 ];
+// The `mutation` keyword at the start of any line. Generated documents put
+// their fragments first, so "the document starts with `mutation`" would miss
+// most mutations — and a missed mutation is one that gets sent twice.
+const MUTATION_DOCUMENT = /^\s*mutation\b/m;
 function defaultAccessTokenProvider() {
     if (typeof window !== 'undefined' && window.localStorage) {
         return window.localStorage.getItem(DEFAULT_TOKEN_STORAGE_KEY) || undefined;
@@ -183,6 +188,9 @@ class GraphQLClient {
      * who want to inspect partial responses can do so. The higher-level
      * `query()` / `mutate()` helpers and the `runOperation` helper used by
      * services throw `GraphQLOperationError` when `errors` is non-empty.
+     *
+     * A query whose connection drops (`fetch failed`) is sent once more, within
+     * the same `timeout`, before the error is thrown. Mutations are never resent.
      */
     async execute(operation) {
         const { query, variables = {}, operationName, fetchOptions } = operation;
@@ -200,7 +208,8 @@ class GraphQLClient {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
         try {
-            const response = await fetch(this.getEndpoint(), {
+            const fetchImpl = this.config.fetch ?? fetch;
+            const send = () => fetchImpl(this.getEndpoint(), {
                 method: 'POST',
                 headers,
                 body,
@@ -214,6 +223,18 @@ class GraphQLClient {
                 next: fetchOptions?.next,
                 signal: controller.signal,
             });
+            // A dropped connection rejects fetch() with a TypeError (the fetch spec's
+            // network error). A timeout rejects with an AbortError and an HTTP error
+            // status resolves, so neither is retried. Matched by name, not
+            // `instanceof`, so a TypeError from another realm (Jest, a vm sandbox)
+            // still counts. A mutation is never sent twice: the server may have
+            // applied it before the connection dropped. The retry shares the timeout.
+            const response = await send().catch((error) => {
+                if (error?.name !== 'TypeError' || MUTATION_DOCUMENT.test(query))
+                    throw error;
+                this.debugLog(`Connection dropped (${error.message}), retrying ${actualOperationName ?? 'query'} once`);
+                return send();
+            });
             clearTimeout(timeoutId);
             if (!response.ok) {
                 const bodyText = await response.text().catch(() => '');

package/dist/cjs/client/index.d.ts

@@ -7,7 +7,7 @@
  * compatibility with code written against 0.9.x.
  */
 export { GraphQLClient, createClient, createGraphQLClient, initializeClient, getClient, } from './GraphQLClient';
-export type { GraphQLOperation, GraphQLResponse, GraphQLClientConfig, GraphQLFetchOptions, AccessTokenProvider, } from './GraphQLClient';
+export type { GraphQLOperation, GraphQLResponse, GraphQLClientConfig, GraphQLFetchOptions, AccessTokenProvider, FetchImplementation, } from './GraphQLClient';
 export { GraphQLOperationError } from './GraphQLOperationError';
 export type { GraphQLErrorEntry } from './GraphQLOperationError';
 /**

package/dist/cjs/generated/operationVariables.d.ts

@@ -1798,6 +1798,8 @@ export interface ClusterVariables {
     language?: string;
     applyOrderlists?: boolean;
     orderlistIds?: number[];
+    userId?: number;
+    companyId?: number;
     priceCalculateProductInput?: PriceCalculateProductInput;
     userBulkPriceProductInput?: UserBulkPriceProductInput;
     attributeResultSearchInput?: AttributeResultSearchInput;
@@ -3820,6 +3822,8 @@ export interface ProductVariables {
     language?: string;
     applyOrderlists?: boolean;
     orderlistIds?: number[];
+    userId?: number;
+    companyId?: number;
     priceCalculateProductInput?: PriceCalculateProductInput;
     userBulkPriceProductInput?: UserBulkPriceProductInput;
     attributeResultSearchInput?: AttributeResultSearchInput;

package/dist/cjs/generated/operations/cluster.js

@@ -842,13 +842,15 @@ fragment ClusterConfigSettingFields on ClusterConfigSetting {
   priority
 }
 
-query cluster(\$clusterId: Int, \$slug: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
+query cluster(\$clusterId: Int, \$slug: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$userId: Int, \$companyId: Int, \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
   cluster(
     clusterId: \$clusterId
     slug: \$slug
     language: \$language
     applyOrderlists: \$applyOrderlists
     orderlistIds: \$orderlistIds
+    userId: \$userId
+    companyId: \$companyId
   ) {
     ...ClusterFields
   }

package/dist/cjs/generated/operations/product.js

@@ -712,7 +712,7 @@ fragment SurchargeFields on Surcharge {
   validTo
 }
 
-query product(\$productId: Int, \$slug: String, \$sku: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
+query product(\$productId: Int, \$slug: String, \$sku: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$userId: Int, \$companyId: Int, \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
   product(
     productId: \$productId
     slug: \$slug
@@ -720,6 +720,8 @@ query product(\$productId: Int, \$slug: String, \$sku: String, \$language: Strin
     language: \$language
     applyOrderlists: \$applyOrderlists
     orderlistIds: \$orderlistIds
+    userId: \$userId
+    companyId: \$companyId
   ) {
     ...ProductFields
   }

package/dist/esm/client/GraphQLClient.js

@@ -1,5 +1,6 @@
-// Note: This client uses the built-in fetch API available in Node.js 18+.
-// For older runtimes, install a fetch polyfill.
+// Note: This client uses the built-in fetch API available in Node.js 18+
+// unless `config.fetch` supplies another implementation. For older runtimes,
+// install a fetch polyfill.
 import { GraphQLOperationError } from './GraphQLOperationError.js';
 const DEFAULT_TOKEN_STORAGE_KEY = 'access_token';
 const DEFAULT_ORDER_EDITOR_MUTATIONS = [
@@ -8,6 +9,10 @@ const DEFAULT_ORDER_EDITOR_MUTATIONS = [
     'triggerQuoteSendRequest',
     'triggerOrderSendConfirm',
 ];
+// The `mutation` keyword at the start of any line. Generated documents put
+// their fragments first, so "the document starts with `mutation`" would miss
+// most mutations — and a missed mutation is one that gets sent twice.
+const MUTATION_DOCUMENT = /^\s*mutation\b/m;
 function defaultAccessTokenProvider() {
     if (typeof window !== 'undefined' && window.localStorage) {
         return window.localStorage.getItem(DEFAULT_TOKEN_STORAGE_KEY) || undefined;
@@ -176,6 +181,9 @@ export class GraphQLClient {
      * who want to inspect partial responses can do so. The higher-level
      * `query()` / `mutate()` helpers and the `runOperation` helper used by
      * services throw `GraphQLOperationError` when `errors` is non-empty.
+     *
+     * A query whose connection drops (`fetch failed`) is sent once more, within
+     * the same `timeout`, before the error is thrown. Mutations are never resent.
      */
     async execute(operation) {
         const { query, variables = {}, operationName, fetchOptions } = operation;
@@ -193,7 +201,8 @@ export class GraphQLClient {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
         try {
-            const response = await fetch(this.getEndpoint(), {
+            const fetchImpl = this.config.fetch ?? fetch;
+            const send = () => fetchImpl(this.getEndpoint(), {
                 method: 'POST',
                 headers,
                 body,
@@ -207,6 +216,18 @@ export class GraphQLClient {
                 next: fetchOptions?.next,
                 signal: controller.signal,
             });
+            // A dropped connection rejects fetch() with a TypeError (the fetch spec's
+            // network error). A timeout rejects with an AbortError and an HTTP error
+            // status resolves, so neither is retried. Matched by name, not
+            // `instanceof`, so a TypeError from another realm (Jest, a vm sandbox)
+            // still counts. A mutation is never sent twice: the server may have
+            // applied it before the connection dropped. The retry shares the timeout.
+            const response = await send().catch((error) => {
+                if (error?.name !== 'TypeError' || MUTATION_DOCUMENT.test(query))
+                    throw error;
+                this.debugLog(`Connection dropped (${error.message}), retrying ${actualOperationName ?? 'query'} once`);
+                return send();
+            });
             clearTimeout(timeoutId);
             if (!response.ok) {
                 const bodyText = await response.text().catch(() => '');

package/dist/esm/generated/operations/cluster.js

@@ -839,13 +839,15 @@ fragment ClusterConfigSettingFields on ClusterConfigSetting {
   priority
 }
 
-query cluster(\$clusterId: Int, \$slug: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
+query cluster(\$clusterId: Int, \$slug: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$userId: Int, \$companyId: Int, \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
   cluster(
     clusterId: \$clusterId
     slug: \$slug
     language: \$language
     applyOrderlists: \$applyOrderlists
     orderlistIds: \$orderlistIds
+    userId: \$userId
+    companyId: \$companyId
   ) {
     ...ClusterFields
   }

package/dist/esm/generated/operations/product.js

@@ -709,7 +709,7 @@ fragment SurchargeFields on Surcharge {
   validTo
 }
 
-query product(\$productId: Int, \$slug: String, \$sku: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
+query product(\$productId: Int, \$slug: String, \$sku: String, \$language: String, \$applyOrderlists: Boolean, \$orderlistIds: [Int!], \$userId: Int, \$companyId: Int, \$priceCalculateProductInput: PriceCalculateProductInput, \$userBulkPriceProductInput: UserBulkPriceProductInput, \$attributeResultSearchInput: AttributeResultSearchInput, \$imageSearchFilters: MediaImageProductSearchInput, \$mediaVideoSearchInput: MediaVideoProductSearchInput, \$mediaDocumentSearchInput: MediaDocumentProductSearchInput, \$imageVariantFilters: TransformationsInput!) {
   product(
     productId: \$productId
     slug: \$slug
@@ -717,6 +717,8 @@ query product(\$productId: Int, \$slug: String, \$sku: String, \$language: Strin
     language: \$language
     applyOrderlists: \$applyOrderlists
     orderlistIds: \$orderlistIds
+    userId: \$userId
+    companyId: \$companyId
   ) {
     ...ProductFields
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@propeller-commerce/propeller-sdk-v2",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "TypeScript GraphQL client for Propeller eCommerce V2 Platform - works with React, Vue, Angular and all JavaScript frameworks",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",