@surfiran/public-api-client 0.36.0 → 0.37.0

package/README.md

@@ -83,7 +83,7 @@ Do not duplicate the endpoint list here; the pinned OpenAPI snapshot and generat
 
 ## Publication and rollback
 
-Routine package CI uses the owned non-production `crm-ci-heavy` / `cpx62-ci` runner pool with the Node.js version pinned by [ci.yml](.github/workflows/ci.yml). Follow the [GitHub Actions budget policy effective 2026-10-13](https://github.com/SURFIRAN/surfiran-crm-api/blob/main/docs/architecture/REPOSITORY_BOUNDARIES.md#github-actions-budget-policy-owner-override-2026-10-13): GitHub Actions must use owned runners, with no GitHub-hosted or paid fallback. The separate [Codex Cloud development preference](https://github.com/SURFIRAN/surfiran-crm-api/blob/main/docs/architecture/REPOSITORY_BOUNDARIES.md#execution-resources-owner-policy-2026-10-05) remains unchanged. Manual publication uses the dedicated trusted `package-publish` runner and never occupies `surfdmc-prod-deploy`; package and cross-repository artifact credentials do not move to Home or general CI workers.
+Routine package CI uses the owned non-production `owned-ci-linux` / `owned-ci-heavy` runner pool with the Node.js version pinned by [ci.yml](.github/workflows/ci.yml). CodeQL Default Setup independently selects `owned-ci-linux` in repository code-scanning settings; its TypeScript extractor requires Node.js 20 or newer on the runner service's standard PATH, even when ordinary CI uses `setup-node`. Follow the [GitHub Actions budget policy effective 2026-10-13](https://github.com/SURFIRAN/surfiran-crm-api/blob/main/docs/architecture/REPOSITORY_BOUNDARIES.md#github-actions-budget-policy-owner-override-2026-10-13): GitHub Actions must use owned runners, with no GitHub-hosted or paid fallback. The separate [Codex Cloud development preference](https://github.com/SURFIRAN/surfiran-crm-api/blob/main/docs/architecture/REPOSITORY_BOUNDARIES.md#execution-resources-owner-policy-2026-10-05) remains unchanged. Manual publication uses the dedicated trusted `package-publish` runner and never occupies `surfdmc-prod-deploy`; package and cross-repository artifact credentials do not move to Home or general CI workers.
 
 Publication is manual and repository-local through [public-api-client-publish.yml](.github/workflows/public-api-client-publish.yml). It runs on `main` only with explicit publication authorization and `publish_confirm=PUBLISH`. A future version must be bound to an exact reviewed API contract release, pass package/reproducibility checks and publication preflight, create release provenance, and provide an exact previous rollback version. The workflow uses `PUBLIC_API_CONTRACT_READ_TOKEN` to read the private immutable API release and a separate `PUBLIC_API_CLIENT_RELEASE_SETTINGS_READ_TOKEN` with scoped Administration:read to confirm immutable Releases are enabled for this client repository. Before publishing to npmjs.org, it creates or exactly reuses an immutable client release `public-api-client/v<package version>` containing the packed tarball and provenance JSON. It marks the evidence release as non-latest and verifies its asset digests, source tag SHA, and GitHub release attestations. Retries must reproduce the same bytes, including the explicit generation timestamp. Missing or unverifiable release or publication evidence blocks npm publication; the workflow does not use Actions artifact storage for these gates.
 

package/dist/generated/public-api-v1.d.ts

@@ -1,4 +1,4 @@
-export type GeneratedPublicApiVersion = '0.28.0';
+export type GeneratedPublicApiVersion = '0.29.0';
 export type GeneratedPublicApiPath = '/booking-intents' | '/booking-intents/{id}' | '/bot-protection' | '/brochure-leads' | '/destinations' | '/destinations/{slug}' | '/homepage' | '/inquiries' | '/locales' | '/localization/previews/{candidateId}' | '/localization/releases/{releaseId}' | '/localization/ui-catalogs/{snapshotId}' | '/marketing-unsubscribes' | '/newsletter/confirm' | '/newsletter/subscriptions' | '/reviews' | '/search' | '/search-suggestions' | '/site-content/about' | '/site-content/accessibility-statement' | '/site-content/booking-cancellation-policy' | '/site-content/contact' | '/site-content/cookie-policy' | '/site-content/destination-iran' | '/site-content/destinations/{country}' | '/site-content/faqs' | '/site-content/footer' | '/site-content/header' | '/site-content/health-safety-support' | '/site-content/home' | '/site-content/iran-travel-status' | '/site-content/iran-visa-information' | '/site-content/money-in-iran' | '/site-content/privacy' | '/site-content/responsible-travel' | '/site-content/tailor-made' | '/site-content/terms' | '/site-content/travel-insurance' | '/site-features' | '/site-navigation' | '/sitemap' | '/support-requests' | '/tour-categories' | '/tours' | '/tours/{slug}' | '/tours/{slug}/accommodations' | '/tours/{slug}/availability' | '/tours/{slug}/departures' | '/tours/{slug}/experiences' | '/tours/{slug}/itinerary' | '/tours/{slug}/page' | '/tours/{slug}/preview' | '/tours/{slug}/preview/page' | '/tours/{slug}/questions' | '/tours/{slug}/reviews' | '/tours/{slug}/reviews-summary' | '/tours/{slug}/route' | '/travel-insurance/rates' | '/travel-knowledge' | '/travel-status' | '/traveller-stories';
 export type GeneratedPublicApiOperation = 'GET /booking-intents/{id}' | 'GET /bot-protection' | 'GET /destinations' | 'GET /destinations/{slug}' | 'GET /homepage' | 'GET /locales' | 'GET /localization/previews/{candidateId}' | 'GET /localization/releases/{releaseId}' | 'GET /localization/ui-catalogs/{snapshotId}' | 'GET /marketing-unsubscribes' | 'GET /newsletter/confirm' | 'GET /reviews' | 'GET /search' | 'GET /search-suggestions' | 'GET /site-content/about' | 'GET /site-content/accessibility-statement' | 'GET /site-content/booking-cancellation-policy' | 'GET /site-content/contact' | 'GET /site-content/cookie-policy' | 'GET /site-content/destination-iran' | 'GET /site-content/destinations/{country}' | 'GET /site-content/faqs' | 'GET /site-content/footer' | 'GET /site-content/header' | 'GET /site-content/health-safety-support' | 'GET /site-content/home' | 'GET /site-content/iran-travel-status' | 'GET /site-content/iran-visa-information' | 'GET /site-content/money-in-iran' | 'GET /site-content/privacy' | 'GET /site-content/responsible-travel' | 'GET /site-content/tailor-made' | 'GET /site-content/terms' | 'GET /site-content/travel-insurance' | 'GET /site-features' | 'GET /site-navigation' | 'GET /sitemap' | 'GET /tour-categories' | 'GET /tours' | 'GET /tours/{slug}' | 'GET /tours/{slug}/accommodations' | 'GET /tours/{slug}/availability' | 'GET /tours/{slug}/departures' | 'GET /tours/{slug}/experiences' | 'GET /tours/{slug}/itinerary' | 'GET /tours/{slug}/page' | 'GET /tours/{slug}/preview' | 'GET /tours/{slug}/preview/page' | 'GET /tours/{slug}/questions' | 'GET /tours/{slug}/reviews' | 'GET /tours/{slug}/reviews-summary' | 'GET /tours/{slug}/route' | 'GET /travel-insurance/rates' | 'GET /travel-knowledge' | 'GET /travel-status' | 'GET /traveller-stories' | 'POST /booking-intents' | 'POST /brochure-leads' | 'POST /inquiries' | 'POST /marketing-unsubscribes' | 'POST /newsletter/subscriptions' | 'POST /support-requests';
 export type GeneratedPublicApiActiveOperation = 'GET /bot-protection' | 'GET /destinations' | 'GET /destinations/{slug}' | 'GET /homepage' | 'GET /locales' | 'GET /localization/previews/{candidateId}' | 'GET /localization/releases/{releaseId}' | 'GET /localization/ui-catalogs/{snapshotId}' | 'GET /marketing-unsubscribes' | 'GET /newsletter/confirm' | 'GET /reviews' | 'GET /search' | 'GET /search-suggestions' | 'GET /site-content/about' | 'GET /site-content/accessibility-statement' | 'GET /site-content/booking-cancellation-policy' | 'GET /site-content/contact' | 'GET /site-content/cookie-policy' | 'GET /site-content/destination-iran' | 'GET /site-content/destinations/{country}' | 'GET /site-content/faqs' | 'GET /site-content/footer' | 'GET /site-content/header' | 'GET /site-content/health-safety-support' | 'GET /site-content/home' | 'GET /site-content/iran-travel-status' | 'GET /site-content/iran-visa-information' | 'GET /site-content/money-in-iran' | 'GET /site-content/privacy' | 'GET /site-content/responsible-travel' | 'GET /site-content/tailor-made' | 'GET /site-content/terms' | 'GET /site-content/travel-insurance' | 'GET /site-features' | 'GET /site-navigation' | 'GET /sitemap' | 'GET /tour-categories' | 'GET /tours' | 'GET /tours/{slug}' | 'GET /tours/{slug}/accommodations' | 'GET /tours/{slug}/availability' | 'GET /tours/{slug}/departures' | 'GET /tours/{slug}/experiences' | 'GET /tours/{slug}/itinerary' | 'GET /tours/{slug}/page' | 'GET /tours/{slug}/preview' | 'GET /tours/{slug}/preview/page' | 'GET /tours/{slug}/questions' | 'GET /tours/{slug}/reviews' | 'GET /tours/{slug}/reviews-summary' | 'GET /tours/{slug}/route' | 'GET /travel-insurance/rates' | 'GET /travel-knowledge' | 'GET /travel-status' | 'GET /traveller-stories' | 'POST /booking-intents' | 'POST /brochure-leads' | 'POST /inquiries' | 'POST /marketing-unsubscribes' | 'POST /newsletter/subscriptions' | 'POST /support-requests';

package/dist/types.d.ts

@@ -1535,8 +1535,13 @@ export type PublicTravelStatusResponse = {
         freshness: PublicTravelStatusFreshness;
     };
 };
-/** Closed public route vocabulary. Routing is resolved by the rendering layer. */
-export type PublicSiteRouteKey = 'home' | 'tours' | 'tour-categories' | 'destinations' | 'about' | 'contact' | 'inquire' | 'faqs' | 'privacy' | 'terms' | 'responsible-travel' | 'iran-travel-status' | 'iran-visa-information' | 'money-in-iran' | 'travel-insurance' | 'health-safety-support' | 'booking-cancellation-policy' | 'cookie-policy' | 'accessibility-statement' | 'destination-iran' | 'reviews' | 'travel-trade' | 'tailor-made' | 'ask-a-specialist' | 'journal' | 'travel-guide' | 'airport-transfers';
+/**
+ * Closed public route vocabulary. Routing is resolved by the rendering layer.
+ * `contact-booking` and `contact-travelling-now` are opaque contact intents for
+ * the fixed support-request topics; consumers must drop a key they do not
+ * recognise.
+ */
+export type PublicSiteRouteKey = 'home' | 'tours' | 'tour-categories' | 'destinations' | 'about' | 'contact' | 'inquire' | 'faqs' | 'privacy' | 'terms' | 'responsible-travel' | 'iran-travel-status' | 'iran-visa-information' | 'money-in-iran' | 'travel-insurance' | 'health-safety-support' | 'booking-cancellation-policy' | 'cookie-policy' | 'accessibility-statement' | 'destination-iran' | 'reviews' | 'travel-trade' | 'tailor-made' | 'ask-a-specialist' | 'journal' | 'travel-guide' | 'airport-transfers' | 'destination-iraq' | 'destination-georgia' | 'contact-booking' | 'contact-travelling-now';
 export type PublicSiteCta = {
     label: string;
     routeKey: PublicSiteRouteKey;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surfiran/public-api-client",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "TypeScript types and client for SURFIRAN CRM Public API V1",
   "type": "module",
   "engines": {