@vtex/faststore 0.0.5 → 0.0.6

package/dist/sdk/i18n/messages/en-US.js

@@ -1,6 +1,9 @@
 //#region src/sdk/i18n/messages/en-US.json
 var en_US_default = {
 	"fs/a11y.close": "Close",
+	"fs/form.clear": "Clear",
+	"fs/form.reset": "Reset",
+	"fs/form.submit": "Continue",
 	"fs/region.error.invalid-postal-code": "Enter a valid postal code.",
 	"fs/region.error.network": "Unable to set your region. Please try again.",
 	"fs/region.error.unserved-postal-code": "We do not deliver to this postal code yet.",

package/dist/sdk/i18n/messages/en-US.json

@@ -1,5 +1,8 @@
 {
   "fs/a11y.close": "Close",
+  "fs/form.clear": "Clear",
+  "fs/form.reset": "Reset",
+  "fs/form.submit": "Continue",
   "fs/region.error.invalid-postal-code": "Enter a valid postal code.",
   "fs/region.error.network": "Unable to set your region. Please try again.",
   "fs/region.error.unserved-postal-code": "We do not deliver to this postal code yet.",

package/dist/sdk/i18n/messages/en-US.json.d.ts

@@ -1,6 +1,9 @@
 //#region src/sdk/i18n/messages/en-US.json.d.ts
 declare const _exports: {
   "fs/a11y.close": string;
+  "fs/form.clear": string;
+  "fs/form.reset": string;
+  "fs/form.submit": string;
   "fs/region.error.invalid-postal-code": string;
   "fs/region.error.network": string;
   "fs/region.error.unserved-postal-code": string;

package/dist/sdk/i18n/messages/es-ES.js

@@ -1,6 +1,9 @@
 //#region src/sdk/i18n/messages/es-ES.json
 var es_ES_default = {
 	"fs/a11y.close": "Cerrar",
+	"fs/form.clear": "Limpiar",
+	"fs/form.reset": "Restablecer",
+	"fs/form.submit": "Continuar",
 	"fs/region.error.invalid-postal-code": "Introduce un código postal válido.",
 	"fs/region.error.network": "No se pudo definir tu región. Inténtalo de nuevo.",
 	"fs/region.error.unserved-postal-code": "Todavía no hacemos entregas en este código postal.",

package/dist/sdk/i18n/messages/es-ES.json

@@ -1,5 +1,8 @@
 {
   "fs/a11y.close": "Cerrar",
+  "fs/form.clear": "Limpiar",
+  "fs/form.reset": "Restablecer",
+  "fs/form.submit": "Continuar",
   "fs/region.error.invalid-postal-code": "Introduce un código postal válido.",
   "fs/region.error.network": "No se pudo definir tu región. Inténtalo de nuevo.",
   "fs/region.error.unserved-postal-code": "Todavía no hacemos entregas en este código postal.",

package/dist/sdk/i18n/messages/pt-BR.js

@@ -1,6 +1,9 @@
 //#region src/sdk/i18n/messages/pt-BR.json
 var pt_BR_default = {
 	"fs/a11y.close": "Fechar",
+	"fs/form.clear": "Limpar",
+	"fs/form.reset": "Redefinir",
+	"fs/form.submit": "Continuar",
 	"fs/region.error.invalid-postal-code": "Informe um CEP válido.",
 	"fs/region.error.network": "Não foi possível definir sua região. Tente novamente.",
 	"fs/region.error.unserved-postal-code": "Ainda não entregamos neste CEP.",

package/dist/sdk/i18n/messages/pt-BR.json

@@ -1,5 +1,8 @@
 {
   "fs/a11y.close": "Fechar",
+  "fs/form.clear": "Limpar",
+  "fs/form.reset": "Redefinir",
+  "fs/form.submit": "Continuar",
   "fs/region.error.invalid-postal-code": "Informe um CEP válido.",
   "fs/region.error.network": "Não foi possível definir sua região. Tente novamente.",
   "fs/region.error.unserved-postal-code": "Ainda não entregamos neste CEP.",

package/dist/sdk/identity/use-identity-actions.js

@@ -1,6 +1,7 @@
 "use client";
 import { defineActions } from "../../core/dist/actions/registry.js";
 import "../../core/dist/index.js";
+import { loggableErrorName } from "../../utils/loggable-error-name.js";
 import { CLIENT_PREFERENCES_UPDATE, CLIENT_PROFILE_UPDATE, CUSTOMER_PROFILE_UPDATE } from "./operations.js";
 import { useMutation } from "@apollo/client/react";
 import { useCallback, useMemo } from "react";
@@ -46,7 +47,7 @@ function useIdentityActions() {
 		try {
 			return (await profileMutation({ variables: { input: payload } })).data?.clientProfileUpdate?.userErrors ?? [];
 		} catch (error) {
-			console.error("[identity.clientProfileUpdate] clientProfileUpdate failed", error instanceof Error ? error.name : "UnknownError");
+			console.error("[identity.clientProfileUpdate] clientProfileUpdate failed", loggableErrorName(error));
 			return [NETWORK_PROFILE_ERROR];
 		}
 	}, [profileMutation]);
@@ -54,7 +55,7 @@ function useIdentityActions() {
 		try {
 			return (await preferencesMutation({ variables: { input: payload } })).data?.clientPreferencesUpdate?.userErrors ?? [];
 		} catch (error) {
-			console.error("[identity.clientPreferencesUpdate] clientPreferencesUpdate failed", error instanceof Error ? error.name : "UnknownError");
+			console.error("[identity.clientPreferencesUpdate] clientPreferencesUpdate failed", loggableErrorName(error));
 			return [NETWORK_PREFERENCE_ERROR];
 		}
 	}, [preferencesMutation]);

package/dist/sdk/identity/use-identity-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-identity-actions.js","names":[],"sources":["../../../src/sdk/identity/use-identity-actions.ts"],"sourcesContent":["'use client';\n\nimport { CombinedGraphQLErrors } from '@apollo/client/errors';\nimport { useMutation } from '@apollo/client/react';\nimport { defineActions } from '@vtex/fs-core';\nimport { useCallback, useMemo } from 'react';\nimport {\n  CLIENT_PREFERENCES_UPDATE,\n  CLIENT_PROFILE_UPDATE,\n  type ClientPreferenceKey,\n  type ClientProfileUserError,\n  CUSTOMER_PROFILE_UPDATE,\n  type CustomerProfileUpdateInput,\n  type CustomerProfileUserError,\n} from './operations.js';\n\n/**\n * The `identity` action namespace — the context-free owner of the shopper-profile,\n * consent-preference, and persistent-profile writes\n * (specs/fspg-859-email-field.md, specs/consent-opt-in-component.md,\n * docs/storefront-core/reference-free-particle-model.md § Write side — actions,\n * docs/storefront-core/adr-0010-actions-own-the-write-side.md).\n *\n * It mirrors `useCartActions`: a component anywhere in the tree dispatches the write through the\n * compiler-injected `$actions.identity.*` prop, and the handler calls the corresponding mutation.\n * Every write is **async / pessimistic** (Decision 1): the caller awaits the persisted result. Each\n * call returns its `userErrors` (empty on success) so the caller can surface server-side failures\n * inline; the returned entity self-updates the normalized cache and every reactive subscriber.\n *\n * The first two writes target the cart's sibling identity entities; `customerProfileUpdate` targets\n * the shopper's account profile, which needs no cart at all.\n */\n\n/**\n * Payload for the profile write. Callers persist only the fields they own; other fields are\n * untouched. The payload is passed through to `ClientProfileUpdateInput` unmapped, so this type\n * mirrors that input verbatim — a stacked field only needs a field to already exist here to reach\n * the wire.\n */\nexport type ClientProfileUpdatePayload = Readonly<{\n  email?: string;\n  firstName?: string;\n  lastName?: string;\n  phone?: string;\n  document?: string;\n}>;\n\n/** Payload for the preferences write — one opt-in flag; the other flag is left untouched. */\nexport type ClientPreferencesUpdatePayload = Readonly<Partial<Record<ClientPreferenceKey, boolean>>>;\n\n/**\n * Payload for the persistent-profile write. Mirrors `CustomerProfileUpdateInput` verbatim and is\n * forwarded unmapped, so an omitted field stays untouched upstream and an empty string erases.\n */\nexport type CustomerProfileUpdatePayload = CustomerProfileUpdateInput;\n\nexport type IdentityActions = Readonly<{\n  /**\n   * Persist the provided profile fields (partial) to the active cart's `clientProfileData`.\n   * Async — awaits the mutation before resolving. Returns the resulting `userErrors` (empty on\n   * success).\n   */\n  clientProfileUpdate: (payload: ClientProfileUpdatePayload) => Promise<readonly ClientProfileUserError[]>;\n  /**\n   * Persist the provided consent opt-in flag(s) (partial) to the shopper's `ClientPreferences`\n   * entity (order-form-backed). Async — awaits the mutation before resolving. Writes ONLY the\n   * requested field. Returns the resulting `userErrors` (empty on success).\n   */\n  clientPreferencesUpdate: (payload: ClientPreferencesUpdatePayload) => Promise<readonly ClientProfileUserError[]>;\n  /**\n   * Persist the provided profile fields (partial) to the shopper's persistent, cart-independent\n   * account profile. Async — awaits the mutation before resolving. Sends exactly the fields it is\n   * given: an omitted field is left untouched, an empty string erases. Returns the resulting\n   * `userErrors` (empty on success).\n   */\n  customerProfileUpdate: (payload: CustomerProfileUpdatePayload) => Promise<readonly CustomerProfileUserError[]>;\n}>;\n\nconst NETWORK_PROFILE_ERROR: ClientProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your details. Please try again.',\n};\n\nconst NETWORK_PREFERENCE_ERROR: ClientProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your preference. Please try again.',\n};\n\nconst NETWORK_CUSTOMER_PROFILE_ERROR: CustomerProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your profile. Please try again.',\n};\n\nconst UNAUTHORIZED_CUSTOMER_PROFILE_ERROR: CustomerProfileUserError = {\n  code: 'UNAUTHORIZED',\n  message: 'Your session has expired. Please sign in again.',\n};\n\n/**\n * The profile module answers an anonymous or expired session with a top-level `UNAUTHORIZED`, never\n * a `userError`. Collapsing it into `NETWORK_ERROR` would offer a retry that cannot succeed, so it\n * gets its own code and the caller can send the shopper back to sign-in.\n */\nfunction toCustomerProfileError(error: unknown): CustomerProfileUserError {\n  if (CombinedGraphQLErrors.is(error)) {\n    const unauthorized = error.errors.some(({ extensions }) => extensions?.code === 'UNAUTHORIZED');\n    if (unauthorized) return UNAUTHORIZED_CUSTOMER_PROFILE_ERROR;\n  }\n  return NETWORK_CUSTOMER_PROFILE_ERROR;\n}\n\n/**\n * The `identity` namespace hook. Registered with the first-party action registry via `identityActions`\n * below; the compiler-emitted `IdentityActionProvider` calls it and threads the narrowed methods into\n * each consumer's `$actions.identity`.\n */\nexport function useIdentityActions(): IdentityActions {\n  const [profileMutation] = useMutation(CLIENT_PROFILE_UPDATE);\n  const [preferencesMutation] = useMutation(CLIENT_PREFERENCES_UPDATE);\n  const [customerProfileMutation] = useMutation(CUSTOMER_PROFILE_UPDATE);\n\n  const clientProfileUpdate = useCallback<IdentityActions['clientProfileUpdate']>(\n    async (payload) => {\n      try {\n        const result = await profileMutation({ variables: { input: payload } });\n        return result.data?.clientProfileUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — the message can echo the submitted email (PII).\n        console.error(\n          '[identity.clientProfileUpdate] clientProfileUpdate failed',\n          error instanceof Error ? error.name : 'UnknownError',\n        );\n        return [NETWORK_PROFILE_ERROR];\n      }\n    },\n    [profileMutation],\n  );\n\n  const clientPreferencesUpdate = useCallback<IdentityActions['clientPreferencesUpdate']>(\n    async (payload) => {\n      try {\n        const result = await preferencesMutation({ variables: { input: payload } });\n        return result.data?.clientPreferencesUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — mirrors the profile write's PII-safe logging.\n        console.error(\n          '[identity.clientPreferencesUpdate] clientPreferencesUpdate failed',\n          error instanceof Error ? error.name : 'UnknownError',\n        );\n        return [NETWORK_PREFERENCE_ERROR];\n      }\n    },\n    [preferencesMutation],\n  );\n\n  const customerProfileUpdate = useCallback<IdentityActions['customerProfileUpdate']>(\n    async (payload) => {\n      try {\n        // Forwarded unmapped: an empty string is an explicit erase and must survive to the wire.\n        const result = await customerProfileMutation({ variables: { input: payload } });\n        return result.data?.customerProfileUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — the message can echo a submitted profile value (PII).\n        console.error(\n          '[identity.customerProfileUpdate] customerProfileUpdate failed',\n          error instanceof Error ? error.name : 'UnknownError',\n        );\n        return [toCustomerProfileError(error)];\n      }\n    },\n    [customerProfileMutation],\n  );\n\n  return useMemo(\n    () => ({ clientProfileUpdate, clientPreferencesUpdate, customerProfileUpdate }),\n    [clientProfileUpdate, clientPreferencesUpdate, customerProfileUpdate],\n  );\n}\n\n/**\n * Declares the `identity` action namespace — the single source of truth for its method/payload\n * metadata, runtime provider, and `use` hook (mirrors `cartActions`). The native catalog builder\n * (`scripts/build-catalog.mjs`) statically reads this call to emit `actions.json`; at runtime\n * `IdentityActionProvider` calls `useIdentityActions` directly.\n */\nexport const identityActions = defineActions({\n  namespace: 'identity',\n  description:\n    'Mutation-backed writes against the shopper identity entities (client profile, consent preferences, account profile).',\n  provider: { name: 'IdentityActionProvider', importPath: '@vtex/faststore/internal/client' },\n  methods: {\n    clientProfileUpdate: {\n      description:\n        'Persist profile fields (partial) to the active cart (async strategy). Sending email flips Session.isIdentified.',\n      payload: [\n        { name: 'email', type: 'string', optional: true },\n        { name: 'firstName', type: 'string', optional: true },\n        { name: 'lastName', type: 'string', optional: true },\n        { name: 'phone', type: 'string', optional: true },\n        { name: 'document', type: 'string', optional: true },\n      ],\n    },\n    clientPreferencesUpdate: {\n      description:\n        'Persist consent opt-in flags (partial) to the active cart (async strategy). Writes only the provided flag(s).',\n      payload: [\n        { name: 'optinNewsLetter', type: 'boolean', optional: true },\n        { name: 'savePersonalData', type: 'boolean', optional: true },\n      ],\n    },\n    customerProfileUpdate: {\n      description:\n        'Persist profile fields (partial) to the persistent account profile, not the cart (async strategy). Omitted fields are untouched; an empty string erases.',\n      payload: [\n        { name: 'firstName', type: 'string', optional: true },\n        { name: 'lastName', type: 'string', optional: true },\n        { name: 'homePhone', type: 'string', optional: true },\n        { name: 'mobilePhone', type: 'string', optional: true },\n        { name: 'document', type: 'string', optional: true },\n        { name: 'documentType', type: 'string', optional: true },\n        { name: 'birthDate', type: 'string', optional: true },\n        { name: 'gender', type: 'string', optional: true },\n      ],\n    },\n  },\n  use: useIdentityActions,\n});\n"],"mappings":";;;;;;;;AA8EA,MAAM,wBAAgD;CACpD,MAAM;CACN,SAAS;AACX;AAEA,MAAM,2BAAmD;CACvD,MAAM;CACN,SAAS;AACX;AAEA,MAAM,iCAA2D;CAC/D,MAAM;CACN,SAAS;AACX;AAEA,MAAM,sCAAgE;CACpE,MAAM;CACN,SAAS;AACX;;;;;;AAOA,SAAS,uBAAuB,OAA0C;CACxE,IAAI,sBAAsB,GAAG,KAAK,GACX;MAAA,MAAM,OAAO,MAAM,EAAE,iBAAiB,YAAY,SAAS,cACjE,GAAG,OAAO;CAAA;CAE3B,OAAO;AACT;;;;;;AAOA,SAAgB,qBAAsC;CACpD,MAAM,CAAC,mBAAmB,YAAY,qBAAqB;CAC3D,MAAM,CAAC,uBAAuB,YAAY,yBAAyB;CACnE,MAAM,CAAC,2BAA2B,YAAY,uBAAuB;CAErE,MAAM,sBAAsB,YAC1B,OAAO,YAAY;EACjB,IAAI;GAEF,QAAO,MADc,gBAAgB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CACxD,MAAM,qBAAqB,cAAc,CAAC;EAC1D,SAAS,OAAO;GAEd,QAAQ,MACN,6DACA,iBAAiB,QAAQ,MAAM,OAAO,cACxC;GACA,OAAO,CAAC,qBAAqB;EAC/B;CACF,GACA,CAAC,eAAe,CAClB;CAEA,MAAM,0BAA0B,YAC9B,OAAO,YAAY;EACjB,IAAI;GAEF,QAAO,MADc,oBAAoB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CAC5D,MAAM,yBAAyB,cAAc,CAAC;EAC9D,SAAS,OAAO;GAEd,QAAQ,MACN,qEACA,iBAAiB,QAAQ,MAAM,OAAO,cACxC;GACA,OAAO,CAAC,wBAAwB;EAClC;CACF,GACA,CAAC,mBAAmB,CACtB;CAEA,MAAM,wBAAwB,YAC5B,OAAO,YAAY;EACjB,IAAI;GAGF,QAAO,MADc,wBAAwB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CAChE,MAAM,uBAAuB,cAAc,CAAC;EAC5D,SAAS,OAAO;GAEd,QAAQ,MACN,iEACA,iBAAiB,QAAQ,MAAM,OAAO,cACxC;GACA,OAAO,CAAC,uBAAuB,KAAK,CAAC;EACvC;CACF,GACA,CAAC,uBAAuB,CAC1B;CAEA,OAAO,eACE;EAAE;EAAqB;EAAyB;CAAsB,IAC7E;EAAC;EAAqB;EAAyB;CAAqB,CACtE;AACF;AAQ+B,cAAc;CAC3C,WAAW;CACX,aACE;CACF,UAAU;EAAE,MAAM;EAA0B,YAAY;CAAkC;CAC1F,SAAS;EACP,qBAAqB;GACnB,aACE;GACF,SAAS;IACP;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU;IAAK;IAChD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU;IAAK;IAChD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;GACrD;EACF;EACA,yBAAyB;GACvB,aACE;GACF,SAAS,CACP;IAAE,MAAM;IAAmB,MAAM;IAAW,UAAU;GAAK,GAC3D;IAAE,MAAM;IAAoB,MAAM;IAAW,UAAU;GAAK,CAC9D;EACF;EACA,uBAAuB;GACrB,aACE;GACF,SAAS;IACP;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAe,MAAM;KAAU,UAAU;IAAK;IACtD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAgB,MAAM;KAAU,UAAU;IAAK;IACvD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAU,MAAM;KAAU,UAAU;IAAK;GACnD;EACF;CACF;CACA,KAAK;AACP,CAAC"}
+{"version":3,"file":"use-identity-actions.js","names":[],"sources":["../../../src/sdk/identity/use-identity-actions.ts"],"sourcesContent":["'use client';\n\nimport { CombinedGraphQLErrors } from '@apollo/client/errors';\nimport { useMutation } from '@apollo/client/react';\nimport { defineActions } from '@vtex/fs-core';\nimport { useCallback, useMemo } from 'react';\nimport { loggableErrorName } from '../../utils/loggable-error-name.js';\nimport {\n  CLIENT_PREFERENCES_UPDATE,\n  CLIENT_PROFILE_UPDATE,\n  type ClientPreferenceKey,\n  type ClientProfileUserError,\n  CUSTOMER_PROFILE_UPDATE,\n  type CustomerProfileUpdateInput,\n  type CustomerProfileUserError,\n} from './operations.js';\n\n/**\n * The `identity` action namespace — the context-free owner of the shopper-profile,\n * consent-preference, and persistent-profile writes\n * (specs/fspg-859-email-field.md, specs/consent-opt-in-component.md,\n * docs/storefront-core/reference-free-particle-model.md § Write side — actions,\n * docs/storefront-core/adr-0010-actions-own-the-write-side.md).\n *\n * It mirrors `useCartActions`: a component anywhere in the tree dispatches the write through the\n * compiler-injected `$actions.identity.*` prop, and the handler calls the corresponding mutation.\n * Every write is **async / pessimistic** (Decision 1): the caller awaits the persisted result. Each\n * call returns its `userErrors` (empty on success) so the caller can surface server-side failures\n * inline; the returned entity self-updates the normalized cache and every reactive subscriber.\n *\n * The first two writes target the cart's sibling identity entities; `customerProfileUpdate` targets\n * the shopper's account profile, which needs no cart at all.\n */\n\n/**\n * Payload for the profile write. Callers persist only the fields they own; other fields are\n * untouched. The payload is passed through to `ClientProfileUpdateInput` unmapped, so this type\n * mirrors that input verbatim — a stacked field only needs a field to already exist here to reach\n * the wire.\n */\nexport type ClientProfileUpdatePayload = Readonly<{\n  email?: string;\n  firstName?: string;\n  lastName?: string;\n  phone?: string;\n  document?: string;\n}>;\n\n/** Payload for the preferences write — one opt-in flag; the other flag is left untouched. */\nexport type ClientPreferencesUpdatePayload = Readonly<Partial<Record<ClientPreferenceKey, boolean>>>;\n\n/**\n * Payload for the persistent-profile write. Mirrors `CustomerProfileUpdateInput` verbatim and is\n * forwarded unmapped, so an omitted field stays untouched upstream and an empty string erases.\n */\nexport type CustomerProfileUpdatePayload = CustomerProfileUpdateInput;\n\nexport type IdentityActions = Readonly<{\n  /**\n   * Persist the provided profile fields (partial) to the active cart's `clientProfileData`.\n   * Async — awaits the mutation before resolving. Returns the resulting `userErrors` (empty on\n   * success).\n   */\n  clientProfileUpdate: (payload: ClientProfileUpdatePayload) => Promise<readonly ClientProfileUserError[]>;\n  /**\n   * Persist the provided consent opt-in flag(s) (partial) to the shopper's `ClientPreferences`\n   * entity (order-form-backed). Async — awaits the mutation before resolving. Writes ONLY the\n   * requested field. Returns the resulting `userErrors` (empty on success).\n   */\n  clientPreferencesUpdate: (payload: ClientPreferencesUpdatePayload) => Promise<readonly ClientProfileUserError[]>;\n  /**\n   * Persist the provided profile fields (partial) to the shopper's persistent, cart-independent\n   * account profile. Async — awaits the mutation before resolving. Sends exactly the fields it is\n   * given: an omitted field is left untouched, an empty string erases. Returns the resulting\n   * `userErrors` (empty on success).\n   */\n  customerProfileUpdate: (payload: CustomerProfileUpdatePayload) => Promise<readonly CustomerProfileUserError[]>;\n}>;\n\nconst NETWORK_PROFILE_ERROR: ClientProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your details. Please try again.',\n};\n\nconst NETWORK_PREFERENCE_ERROR: ClientProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your preference. Please try again.',\n};\n\nconst NETWORK_CUSTOMER_PROFILE_ERROR: CustomerProfileUserError = {\n  code: 'NETWORK_ERROR',\n  message: 'Unable to save your profile. Please try again.',\n};\n\nconst UNAUTHORIZED_CUSTOMER_PROFILE_ERROR: CustomerProfileUserError = {\n  code: 'UNAUTHORIZED',\n  message: 'Your session has expired. Please sign in again.',\n};\n\n/**\n * The profile module answers an anonymous or expired session with a top-level `UNAUTHORIZED`, never\n * a `userError`. Collapsing it into `NETWORK_ERROR` would offer a retry that cannot succeed, so it\n * gets its own code and the caller can send the shopper back to sign-in.\n */\nfunction toCustomerProfileError(error: unknown): CustomerProfileUserError {\n  if (CombinedGraphQLErrors.is(error)) {\n    const unauthorized = error.errors.some(({ extensions }) => extensions?.code === 'UNAUTHORIZED');\n    if (unauthorized) return UNAUTHORIZED_CUSTOMER_PROFILE_ERROR;\n  }\n  return NETWORK_CUSTOMER_PROFILE_ERROR;\n}\n\n/**\n * The `identity` namespace hook. Registered with the first-party action registry via `identityActions`\n * below; the compiler-emitted `IdentityActionProvider` calls it and threads the narrowed methods into\n * each consumer's `$actions.identity`.\n */\nexport function useIdentityActions(): IdentityActions {\n  const [profileMutation] = useMutation(CLIENT_PROFILE_UPDATE);\n  const [preferencesMutation] = useMutation(CLIENT_PREFERENCES_UPDATE);\n  const [customerProfileMutation] = useMutation(CUSTOMER_PROFILE_UPDATE);\n\n  const clientProfileUpdate = useCallback<IdentityActions['clientProfileUpdate']>(\n    async (payload) => {\n      try {\n        const result = await profileMutation({ variables: { input: payload } });\n        return result.data?.clientProfileUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — the message can echo the submitted email (PII).\n        console.error('[identity.clientProfileUpdate] clientProfileUpdate failed', loggableErrorName(error));\n        return [NETWORK_PROFILE_ERROR];\n      }\n    },\n    [profileMutation],\n  );\n\n  const clientPreferencesUpdate = useCallback<IdentityActions['clientPreferencesUpdate']>(\n    async (payload) => {\n      try {\n        const result = await preferencesMutation({ variables: { input: payload } });\n        return result.data?.clientPreferencesUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — mirrors the profile write's PII-safe logging.\n        console.error('[identity.clientPreferencesUpdate] clientPreferencesUpdate failed', loggableErrorName(error));\n        return [NETWORK_PREFERENCE_ERROR];\n      }\n    },\n    [preferencesMutation],\n  );\n\n  const customerProfileUpdate = useCallback<IdentityActions['customerProfileUpdate']>(\n    async (payload) => {\n      try {\n        // Forwarded unmapped: an empty string is an explicit erase and must survive to the wire.\n        const result = await customerProfileMutation({ variables: { input: payload } });\n        return result.data?.customerProfileUpdate?.userErrors ?? [];\n      } catch (error) {\n        // Log only the error name — the message can echo a submitted profile value (PII).\n        console.error(\n          '[identity.customerProfileUpdate] customerProfileUpdate failed',\n          error instanceof Error ? error.name : 'UnknownError',\n        );\n        return [toCustomerProfileError(error)];\n      }\n    },\n    [customerProfileMutation],\n  );\n\n  return useMemo(\n    () => ({ clientProfileUpdate, clientPreferencesUpdate, customerProfileUpdate }),\n    [clientProfileUpdate, clientPreferencesUpdate, customerProfileUpdate],\n  );\n}\n\n/**\n * Declares the `identity` action namespace — the single source of truth for its method/payload\n * metadata, runtime provider, and `use` hook (mirrors `cartActions`). The native catalog builder\n * (`scripts/build-catalog.mjs`) statically reads this call to emit `actions.json`; at runtime\n * `IdentityActionProvider` calls `useIdentityActions` directly.\n */\nexport const identityActions = defineActions({\n  namespace: 'identity',\n  description:\n    'Mutation-backed writes against the shopper identity entities (client profile, consent preferences, account profile).',\n  provider: { name: 'IdentityActionProvider', importPath: '@vtex/faststore/internal/client' },\n  methods: {\n    clientProfileUpdate: {\n      description:\n        'Persist profile fields (partial) to the active cart (async strategy). Sending email flips Session.isIdentified.',\n      payload: [\n        { name: 'email', type: 'string', optional: true },\n        { name: 'firstName', type: 'string', optional: true },\n        { name: 'lastName', type: 'string', optional: true },\n        { name: 'phone', type: 'string', optional: true },\n        { name: 'document', type: 'string', optional: true },\n      ],\n    },\n    clientPreferencesUpdate: {\n      description:\n        'Persist consent opt-in flags (partial) to the active cart (async strategy). Writes only the provided flag(s).',\n      payload: [\n        { name: 'optinNewsLetter', type: 'boolean', optional: true },\n        { name: 'savePersonalData', type: 'boolean', optional: true },\n      ],\n    },\n    customerProfileUpdate: {\n      description:\n        'Persist profile fields (partial) to the persistent account profile, not the cart (async strategy). Omitted fields are untouched; an empty string erases.',\n      payload: [\n        { name: 'firstName', type: 'string', optional: true },\n        { name: 'lastName', type: 'string', optional: true },\n        { name: 'homePhone', type: 'string', optional: true },\n        { name: 'mobilePhone', type: 'string', optional: true },\n        { name: 'document', type: 'string', optional: true },\n        { name: 'documentType', type: 'string', optional: true },\n        { name: 'birthDate', type: 'string', optional: true },\n        { name: 'gender', type: 'string', optional: true },\n      ],\n    },\n  },\n  use: useIdentityActions,\n});\n"],"mappings":";;;;;;;;;AA+EA,MAAM,wBAAgD;CACpD,MAAM;CACN,SAAS;AACX;AAEA,MAAM,2BAAmD;CACvD,MAAM;CACN,SAAS;AACX;AAEA,MAAM,iCAA2D;CAC/D,MAAM;CACN,SAAS;AACX;AAEA,MAAM,sCAAgE;CACpE,MAAM;CACN,SAAS;AACX;;;;;;AAOA,SAAS,uBAAuB,OAA0C;CACxE,IAAI,sBAAsB,GAAG,KAAK,GACX;MAAA,MAAM,OAAO,MAAM,EAAE,iBAAiB,YAAY,SAAS,cACjE,GAAG,OAAO;CAAA;CAE3B,OAAO;AACT;;;;;;AAOA,SAAgB,qBAAsC;CACpD,MAAM,CAAC,mBAAmB,YAAY,qBAAqB;CAC3D,MAAM,CAAC,uBAAuB,YAAY,yBAAyB;CACnE,MAAM,CAAC,2BAA2B,YAAY,uBAAuB;CAErE,MAAM,sBAAsB,YAC1B,OAAO,YAAY;EACjB,IAAI;GAEF,QAAO,MADc,gBAAgB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CACxD,MAAM,qBAAqB,cAAc,CAAC;EAC1D,SAAS,OAAO;GAEd,QAAQ,MAAM,6DAA6D,kBAAkB,KAAK,CAAC;GACnG,OAAO,CAAC,qBAAqB;EAC/B;CACF,GACA,CAAC,eAAe,CAClB;CAEA,MAAM,0BAA0B,YAC9B,OAAO,YAAY;EACjB,IAAI;GAEF,QAAO,MADc,oBAAoB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CAC5D,MAAM,yBAAyB,cAAc,CAAC;EAC9D,SAAS,OAAO;GAEd,QAAQ,MAAM,qEAAqE,kBAAkB,KAAK,CAAC;GAC3G,OAAO,CAAC,wBAAwB;EAClC;CACF,GACA,CAAC,mBAAmB,CACtB;CAEA,MAAM,wBAAwB,YAC5B,OAAO,YAAY;EACjB,IAAI;GAGF,QAAO,MADc,wBAAwB,EAAE,WAAW,EAAE,OAAO,QAAQ,EAAE,CAAC,EAAA,CAChE,MAAM,uBAAuB,cAAc,CAAC;EAC5D,SAAS,OAAO;GAEd,QAAQ,MACN,iEACA,iBAAiB,QAAQ,MAAM,OAAO,cACxC;GACA,OAAO,CAAC,uBAAuB,KAAK,CAAC;EACvC;CACF,GACA,CAAC,uBAAuB,CAC1B;CAEA,OAAO,eACE;EAAE;EAAqB;EAAyB;CAAsB,IAC7E;EAAC;EAAqB;EAAyB;CAAqB,CACtE;AACF;AAQ+B,cAAc;CAC3C,WAAW;CACX,aACE;CACF,UAAU;EAAE,MAAM;EAA0B,YAAY;CAAkC;CAC1F,SAAS;EACP,qBAAqB;GACnB,aACE;GACF,SAAS;IACP;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU;IAAK;IAChD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAS,MAAM;KAAU,UAAU;IAAK;IAChD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;GACrD;EACF;EACA,yBAAyB;GACvB,aACE;GACF,SAAS,CACP;IAAE,MAAM;IAAmB,MAAM;IAAW,UAAU;GAAK,GAC3D;IAAE,MAAM;IAAoB,MAAM;IAAW,UAAU;GAAK,CAC9D;EACF;EACA,uBAAuB;GACrB,aACE;GACF,SAAS;IACP;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAe,MAAM;KAAU,UAAU;IAAK;IACtD;KAAE,MAAM;KAAY,MAAM;KAAU,UAAU;IAAK;IACnD;KAAE,MAAM;KAAgB,MAAM;KAAU,UAAU;IAAK;IACvD;KAAE,MAAM;KAAa,MAAM;KAAU,UAAU;IAAK;IACpD;KAAE,MAAM;KAAU,MAAM;KAAU,UAAU;IAAK;GACnD;EACF;CACF;CACA,KAAK;AACP,CAAC"}

package/dist/sdk/payment/gateway-origin.js

@@ -0,0 +1,35 @@
+//#region src/sdk/payment/gateway-origin.ts
+/**
+* The one rule deciding whether a gateway origin may be interpolated into the card POST's URL
+* (specs/use-place-order.md, Decision 4). It lives in its own module rather than in `gateway.ts`
+* because `usePlaceOrder` needs it too, and that hook imports nothing executable from the module that
+* touches card data — a boundary its own tests assert against the file's source text.
+*
+* `PaymentStartTransactionPayload.gatewayUrl` is nullable, and `buildGatewayPaymentsRequest`
+* concatenates it (`${gatewayUrl}/api/pub/transactions/…`). Three untrusted values are real rather
+* than hypothetical, and each produces a URL that resolves against the storefront's own origin or
+* sends the card in plaintext:
+*
+* - `null` / `undefined` / `''` — the payload's own error shape (T18 nulls every field beside
+*   `userErrors`), yielding a relative path.
+* - the four-character string `"null"` — what `new URL('mailto:x').origin` evaluates to, so a
+*   non-special scheme upstream survives a parse-only check.
+* - an `http:` origin — parses fine and sends the PAN and CVV unencrypted.
+*
+* The `.vtexpayments.com.br` host suffix is deliberately *not* re-checked here. T18 resolves and
+* validates the origin server-side and is the authoritative source; repeating the suffix in shipped
+* client code would add nothing against the three failures above while hard-coding a deployment
+* assumption a sandbox or a future gateway host would break.
+*/
+function isTrustedGatewayOrigin(value) {
+	if (!value) return false;
+	try {
+		return new URL(value).protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { isTrustedGatewayOrigin };
+
+//# sourceMappingURL=gateway-origin.js.map

package/dist/sdk/payment/gateway-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-origin.js","names":[],"sources":["../../../src/sdk/payment/gateway-origin.ts"],"sourcesContent":["/**\n * The one rule deciding whether a gateway origin may be interpolated into the card POST's URL\n * (specs/use-place-order.md, Decision 4). It lives in its own module rather than in `gateway.ts`\n * because `usePlaceOrder` needs it too, and that hook imports nothing executable from the module that\n * touches card data — a boundary its own tests assert against the file's source text.\n *\n * `PaymentStartTransactionPayload.gatewayUrl` is nullable, and `buildGatewayPaymentsRequest`\n * concatenates it (`${gatewayUrl}/api/pub/transactions/…`). Three untrusted values are real rather\n * than hypothetical, and each produces a URL that resolves against the storefront's own origin or\n * sends the card in plaintext:\n *\n * - `null` / `undefined` / `''` — the payload's own error shape (T18 nulls every field beside\n *   `userErrors`), yielding a relative path.\n * - the four-character string `\"null\"` — what `new URL('mailto:x').origin` evaluates to, so a\n *   non-special scheme upstream survives a parse-only check.\n * - an `http:` origin — parses fine and sends the PAN and CVV unencrypted.\n *\n * The `.vtexpayments.com.br` host suffix is deliberately *not* re-checked here. T18 resolves and\n * validates the origin server-side and is the authoritative source; repeating the suffix in shipped\n * client code would add nothing against the three failures above while hard-coding a deployment\n * assumption a sandbox or a future gateway host would break.\n */\nexport function isTrustedGatewayOrigin(value: string | null | undefined): value is string {\n  if (!value) return false;\n\n  try {\n    return new URL(value).protocol === 'https:';\n  } catch {\n    // Not an absolute URL — `'/api'`, `'acme.vtexpayments.com.br'`, `'not-a-url'`.\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,uBAAuB,OAAmD;CACxF,IAAI,CAAC,OAAO,OAAO;CAEnB,IAAI;EACF,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,aAAa;CACrC,QAAQ;EAEN,OAAO;CACT;AACF"}

package/dist/sdk/payment/gateway.d.ts

@@ -0,0 +1,85 @@
+import "./operations.js";
+//#region src/sdk/payment/gateway.d.ts
+/**
+ * Non-sensitive descriptor of the open transaction. Every field maps to a value the caller already
+ * holds — `paymentStartTransaction`'s payload (T3) or the `Payment` read model (T1) — except
+ * `gatewayUrl` and `merchantName`, which that payload does not carry today (Gaps 1 and 2 in the spec).
+ * Amounts are in the currency's **minor units**; `PaymentStartTransactionPayload.value.amount` is a
+ * decimal, so the caller converts once, visibly, rather than having this module assume an exponent.
+ */
+export type PaymentGatewayTransaction = Readonly<{
+  /**
+   * Gateway origin, e.g. `https://acme.vtexpayments.com.br`. Server-resolved by T18 and read off
+   * `paymentStartTransaction`'s payload; never derived here. It is nullable there and required here,
+   * so the builder re-checks it (`isTrustedGatewayOrigin`) rather than trusting the type.
+   */
+  gatewayUrl: string;
+  /** `PaymentStartTransactionPayload.transactionId`. */
+  transactionId: string;
+  /** VTEX merchant name for this transaction. Resolved server-side by T3 but not exposed on its payload. */
+  merchantName: string;
+  /** `PaymentStartTransactionPayload.orderGroup` — the gateway's `orderId` query parameter. */
+  orderGroup: string;
+  /** `PaymentStartTransactionPayload.userProfileId`; null for a guest order, so the query parameter is left out. */
+  userProfileId: string | null;
+  /** `Payment.selectedMethodId` — the VTEX payment-system id. */
+  paymentSystem: string;
+  /** `PaymentMethod.groupName`, e.g. `creditCardPaymentGroup`. */
+  groupName: string;
+  /** `PaymentStartTransactionPayload.value.currencyCode`. */
+  currencyCode: string;
+  /** Transaction total, in minor units. */
+  valueInCents: number;
+  /** Pre-interest base (`PaymentInstallmentOption.baseValue`), in minor units. */
+  referenceValueInCents: number;
+  /** `Payment.selectedInstallment.count`; 1 when the shopper never picked a plan. */
+  installments: number;
+  /** Per-installment amount (`PaymentInstallment.value`), in minor units. */
+  installmentsValueInCents: number;
+  /** `PaymentInstallment.interestRate`; 0 for the interest-free 1x default. */
+  interestRate: number;
+  /** Absolute return URL. Phase-2 redirect mode only; omitted in v1's direct mode. */
+  callbackUrl?: string;
+  /**
+   * Billing differs from the delivery address. Defaults to `false`, because `setBillingAddress` persists
+   * billing on the order form's `invoiceData` (T3) and the gateway reads it from there rather than from
+   * this body. The call site that would override it is T13's `usePlaceOrder`, the one place the
+   * descriptor is assembled; T11 owns the live verification of the assumption and publishes the flag to
+   * T5's `draft` for T13 to read. Confirming it never reopens this module.
+   */
+  billingAddressDifferent?: boolean;
+}>;
+/** A newly entered card. Runtime argument only — never declared, never logged, never cached. */
+export type PaymentGatewayNewCard = Readonly<{
+  kind: 'new';
+  /** Full card number. The builder strips whatever separators the method's `numberMask` inserted. */
+  number: string;
+  /** Security code (CVV). */
+  securityCode: string;
+  /** Expiry. Normalized to `MM/YY`, so a `MM/YYYY` mask is accepted. */
+  expirationDate: string;
+  holderName: string;
+  /** Shopper document (a CPF). The builder strips its punctuation. */
+  document?: string;
+  /** Shopper-assigned label, when the save-card control collected one. */
+  cardLabel?: string;
+  /** The card-save flag itself — the other half of `payment.saveCard`'s consent write (RFC D5). */
+  saveCard?: boolean;
+}>;
+/** A previously saved card: its account reference plus the CVV the shopper re-enters. */
+export type PaymentGatewaySavedCard = Readonly<{
+  kind: 'saved';
+  /** `SavedCard.accountId`. */
+  accountId: string;
+  /** `SavedCard.bin` — not sensitive; the read model exposes it for installment lookup. */
+  bin: string;
+  /** Security code (CVV). */
+  securityCode: string;
+}>;
+export type PaymentGatewayCard = PaymentGatewayNewCard | PaymentGatewaySavedCard;
+export type SendPaymentsRequest = Readonly<{
+  transaction: PaymentGatewayTransaction;
+  card: PaymentGatewayCard;
+}>;
+//#endregion
+//# sourceMappingURL=gateway.d.ts.map

package/dist/sdk/payment/gateway.js

@@ -0,0 +1,183 @@
+import { isTrustedGatewayOrigin } from "./gateway-origin.js";
+//#region src/sdk/payment/gateway.ts
+/**
+* The direct-to-gateway card POST (specs/payment-action-namespace.md, US-6) — the PCI boundary of the
+* credit-card feature. A new card's number and CVV, or a saved card's CVV, go from the browser straight
+* to the VTEX payment gateway and never transit our GraphQL layer or the normalized Apollo cache
+* (RFC D13; ADR-0010's sanctioned façade flavor).
+*
+* This module imports no Apollo and no GraphQL symbol on purpose: the code that holds card data has no
+* route to the cache, and that property is checkable by reading the imports above. Card data arrives as
+* a runtime argument from the card-entry component's local state (T7) — it is never a declared action
+* payload, a fragment field, or a schema-bindable prop, so the AI Store Builder and the visual editor
+* have no name to map a value onto.
+*
+* Nothing on this path is ever logged, serialized, or stored anywhere but the request body: the caller
+* in `use-payment-actions.ts` logs a static message plus the error's `name` only.
+*
+* The request shape is behavior evidence from the legacy checkout
+* (`fastcheckout@cd09bec3`, `packages/apps/client/src/screens/Payment/components/CardForm/services/gateway.service.ts`)
+* — never a port. Where the legacy hardcoded a value under a `TODO` (installment count, interest rate,
+* reference value) this builder reads it off the transaction descriptor instead.
+*/
+/** Client-synthesized code for a failed gateway leg — distinct from the BFF's `NETWORK_ERROR`. */
+const PAYMENT_GATEWAY_ERROR_CODE = "GATEWAY_ERROR";
+/** The single userError both a rejected request and a non-2xx response resolve to. */
+const PAYMENT_GATEWAY_USER_ERROR = {
+	code: PAYMENT_GATEWAY_ERROR_CODE,
+	message: "Unable to complete the payment. Please try again."
+};
+/** VTEX bins the leading eight digits, not six — the legacy's own `sanitizedBin` slice. */
+const BIN_LENGTH = 8;
+/**
+* Strips the separators a mask inserted. `PaymentMethodValidator.numberMask` is server-driven (T1) and the
+* card-entry component (T7) renders the input through it, so its local state holds `4111 1111 1111 1111`
+* rather than the digits. The legacy normalized here, in the builder, before its own BIN slice
+* (`card.cardNumber = card.cardNumber.replace(/ /g, '')`) — the boundary is the one place the obligation
+* cannot be forgotten, and a spaced BIN is a lookup the gateway fails with no diagnosable error.
+*/
+function toDigits(value) {
+	return value.replace(/\D/g, "");
+}
+/** `MM/YY` whatever the mask produced (`MM/YYYY`, `MMYY`) — the legacy's own two-slice normalization. */
+function toDueDate(expirationDate) {
+	const digits = toDigits(expirationDate);
+	return `${digits.slice(0, 2)}/${digits.slice(-2)}`;
+}
+/** The card half of the body — the BIN and the `fields` map, both derived from one normalization pass. */
+function toCardBody(card) {
+	if (card.kind === "saved") return {
+		bin: card.bin,
+		fields: {
+			bin: card.bin,
+			validationCode: card.securityCode
+		}
+	};
+	const number = toDigits(card.number);
+	const bin = number.slice(0, BIN_LENGTH);
+	return {
+		bin,
+		fields: {
+			bin,
+			cardNumber: number,
+			document: card.document === void 0 ? null : card.document.replace(/\W/g, ""),
+			dueDate: toDueDate(card.expirationDate),
+			holderName: card.holderName,
+			validationCode: card.securityCode,
+			cardLabel: card.cardLabel,
+			savePaymentData: card.saveCard ?? false
+		}
+	};
+}
+/**
+* Builds the gateway URL and body. Billing is deliberately absent from the body: `setBillingAddress`
+* already persisted it on the order form's `invoiceData` (T3), so the gateway reads it from there — hence
+* the `billingAddressDifferent: false` default the two billing flags derive from. `originalPaymentIndex`
+* is the legacy's own constant for a single-payment order.
+*
+* The origin check is the last line of defence, not the first: `usePlaceOrder` already refuses an
+* untrusted origin *before* asking a holder for the card (T13, Decision 4). A builder has no userError
+* channel, so it throws — `sendPayments` catches, collapses it to `GATEWAY_ERROR`, and logs the error's
+* name only, so nothing about the card reaches a log. The throw happens before the body is assembled.
+*/
+function buildGatewayPaymentsRequest({ transaction, card }) {
+	if (!isTrustedGatewayOrigin(transaction.gatewayUrl)) throw new Error("Refusing to post card data: the transaction carries no trusted https gateway origin.");
+	const params = new URLSearchParams({ orderId: transaction.orderGroup });
+	if (transaction.userProfileId !== null) params.append("userProfileId", transaction.userProfileId);
+	if (transaction.callbackUrl !== void 0) params.append("callbackUrl", transaction.callbackUrl);
+	const url = `${transaction.gatewayUrl}/api/pub/transactions/${transaction.transactionId}/payments?${params}`;
+	const { bin, fields } = toCardBody(card);
+	const billingAddressDifferent = transaction.billingAddressDifferent ?? false;
+	return {
+		url,
+		body: [{
+			accountId: card.kind === "saved" ? card.accountId : null,
+			bin,
+			chooseToUseNewCard: card.kind === "new",
+			currencyCode: transaction.currencyCode,
+			fields,
+			groupName: transaction.groupName,
+			hasDefaultBillingAddress: !billingAddressDifferent,
+			id: transaction.merchantName,
+			installmentValue: transaction.installmentsValueInCents,
+			installments: transaction.installments,
+			installmentsInterestRate: transaction.interestRate,
+			installmentsValue: transaction.installmentsValueInCents,
+			interestRate: transaction.interestRate,
+			isBillingAddressDifferent: billingAddressDifferent,
+			originalPaymentIndex: 1,
+			paymentSystem: transaction.paymentSystem,
+			referenceValue: transaction.referenceValueInCents,
+			tokenId: null,
+			transaction: {
+				id: transaction.transactionId,
+				merchantName: transaction.merchantName
+			},
+			value: transaction.valueInCents
+		}]
+	};
+}
+/**
+* T29 (FR-6, OQ-7): this leg's own abort budget. Before this task the direct-to-gateway POST carried no
+* `AbortSignal` and no timeout at all, so a gateway that never answered left `placing` true and the CTA
+* dead for the life of the mount (Route C, `place-order.md`'s Known limitations). The BFF's own default
+* is 10s (`apps/storefront-api-core/.../api-timeout.ts:9`), but a card authorization can legitimately
+* run longer than a GraphQL round trip, and this exact number is not confirmed with payments (spec
+* OQ-7) — a placeholder pending that answer, not a tuned production value.
+*
+* Exported so `gateway.test.ts`'s own abort-budget test can assert the abort fires at exactly this
+* duration, rather than against `vi.runAllTimersAsync()`, which fires any pending timer regardless of
+* duration and would stay green even if this were edited to `300_000`. That mechanism test alone is
+* still self-referential about this constant's own *value* — it advances the fake clock by whatever
+* `GATEWAY_REQUEST_TIMEOUT_MS` currently holds, so on its own it cannot catch an edit to the constant
+* either (fix round 2, verification finding V2). `gateway.test.ts` also asserts this constant against
+* the literal `30_000` directly, in its own dedicated test — that is what actually fails if this
+* constant's value ever changes.
+*/
+const GATEWAY_REQUEST_TIMEOUT_MS = 3e4;
+/**
+* Posts the card straight to the gateway and resolves the gateway leg's `userErrors` (empty on success).
+* A non-2xx response resolves one `GATEWAY_ERROR`; a rejected request — including this leg's own
+* timeout firing, or `options.signal` aborting — propagates, and the handler in `use-payment-actions.ts`
+* collapses it to the same one. Neither outcome reads the response body: it may echo the request, and
+* it tells the shopper nothing more actionable than "try again".
+*
+* `options.signal`, when given, aborts this request in *addition to* — never instead of — this module's
+* own timeout: a caller opts into an earlier or externally triggered abort, but cannot opt out of the
+* budget that keeps this leg from hanging forever (FR-6, US-3). Composed with a plain `AbortController`
+* rather than `AbortSignal.any`/`AbortSignal.timeout` so the timeout is driven by an ordinary
+* `setTimeout`, the one implementation a test can advance deterministically with fake timers.
+*
+* No caller in this package passes `options.signal` today — it exists to satisfy the spec's own
+* Technical Contract (`specs/make-an-order-attempt-survive-a.md`) ahead of a future integration. Fix
+* pass, Low finding: the listener this composes onto `externalSignal` is now removed in the `finally`
+* below on every exit path, not only when it fires — previously, a caller that supplied a long-lived
+* signal (as opposed to a fresh one per call) would accumulate one listener, and this function's own
+* dead `AbortController`, per call that resolved normally.
+*/
+async function postPaymentsToGateway(request, options) {
+	const { url, body } = buildGatewayPaymentsRequest(request);
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => controller.abort(new DOMException("The gateway request timed out.", "TimeoutError")), GATEWAY_REQUEST_TIMEOUT_MS);
+	const externalSignal = options?.signal;
+	const onExternalAbort = () => controller.abort(externalSignal?.reason);
+	if (externalSignal) {
+		if (externalSignal.aborted) controller.abort(externalSignal.reason);
+		else externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+	}
+	try {
+		return (await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body),
+			signal: controller.signal
+		})).ok ? [] : [PAYMENT_GATEWAY_USER_ERROR];
+	} finally {
+		clearTimeout(timeoutId);
+		externalSignal?.removeEventListener("abort", onExternalAbort);
+	}
+}
+//#endregion
+export { GATEWAY_REQUEST_TIMEOUT_MS, PAYMENT_GATEWAY_ERROR_CODE, PAYMENT_GATEWAY_USER_ERROR, buildGatewayPaymentsRequest, postPaymentsToGateway };
+
+//# sourceMappingURL=gateway.js.map

package/dist/sdk/payment/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","names":[],"sources":["../../../src/sdk/payment/gateway.ts"],"sourcesContent":["/**\n * The direct-to-gateway card POST (specs/payment-action-namespace.md, US-6) — the PCI boundary of the\n * credit-card feature. A new card's number and CVV, or a saved card's CVV, go from the browser straight\n * to the VTEX payment gateway and never transit our GraphQL layer or the normalized Apollo cache\n * (RFC D13; ADR-0010's sanctioned façade flavor).\n *\n * This module imports no Apollo and no GraphQL symbol on purpose: the code that holds card data has no\n * route to the cache, and that property is checkable by reading the imports above. Card data arrives as\n * a runtime argument from the card-entry component's local state (T7) — it is never a declared action\n * payload, a fragment field, or a schema-bindable prop, so the AI Store Builder and the visual editor\n * have no name to map a value onto.\n *\n * Nothing on this path is ever logged, serialized, or stored anywhere but the request body: the caller\n * in `use-payment-actions.ts` logs a static message plus the error's `name` only.\n *\n * The request shape is behavior evidence from the legacy checkout\n * (`fastcheckout@cd09bec3`, `packages/apps/client/src/screens/Payment/components/CardForm/services/gateway.service.ts`)\n * — never a port. Where the legacy hardcoded a value under a `TODO` (installment count, interest rate,\n * reference value) this builder reads it off the transaction descriptor instead.\n */\n\nimport { isTrustedGatewayOrigin } from './gateway-origin.js';\nimport type { PaymentUserError } from './operations.js';\n\n/** Client-synthesized code for a failed gateway leg — distinct from the BFF's `NETWORK_ERROR`. */\nexport const PAYMENT_GATEWAY_ERROR_CODE = 'GATEWAY_ERROR';\n\n/** The single userError both a rejected request and a non-2xx response resolve to. */\nexport const PAYMENT_GATEWAY_USER_ERROR: PaymentUserError = {\n  code: PAYMENT_GATEWAY_ERROR_CODE,\n  message: 'Unable to complete the payment. Please try again.',\n};\n\n/**\n * Non-sensitive descriptor of the open transaction. Every field maps to a value the caller already\n * holds — `paymentStartTransaction`'s payload (T3) or the `Payment` read model (T1) — except\n * `gatewayUrl` and `merchantName`, which that payload does not carry today (Gaps 1 and 2 in the spec).\n * Amounts are in the currency's **minor units**; `PaymentStartTransactionPayload.value.amount` is a\n * decimal, so the caller converts once, visibly, rather than having this module assume an exponent.\n */\nexport type PaymentGatewayTransaction = Readonly<{\n  /**\n   * Gateway origin, e.g. `https://acme.vtexpayments.com.br`. Server-resolved by T18 and read off\n   * `paymentStartTransaction`'s payload; never derived here. It is nullable there and required here,\n   * so the builder re-checks it (`isTrustedGatewayOrigin`) rather than trusting the type.\n   */\n  gatewayUrl: string;\n  /** `PaymentStartTransactionPayload.transactionId`. */\n  transactionId: string;\n  /** VTEX merchant name for this transaction. Resolved server-side by T3 but not exposed on its payload. */\n  merchantName: string;\n  /** `PaymentStartTransactionPayload.orderGroup` — the gateway's `orderId` query parameter. */\n  orderGroup: string;\n  /** `PaymentStartTransactionPayload.userProfileId`; null for a guest order, so the query parameter is left out. */\n  userProfileId: string | null;\n  /** `Payment.selectedMethodId` — the VTEX payment-system id. */\n  paymentSystem: string;\n  /** `PaymentMethod.groupName`, e.g. `creditCardPaymentGroup`. */\n  groupName: string;\n  /** `PaymentStartTransactionPayload.value.currencyCode`. */\n  currencyCode: string;\n  /** Transaction total, in minor units. */\n  valueInCents: number;\n  /** Pre-interest base (`PaymentInstallmentOption.baseValue`), in minor units. */\n  referenceValueInCents: number;\n  /** `Payment.selectedInstallment.count`; 1 when the shopper never picked a plan. */\n  installments: number;\n  /** Per-installment amount (`PaymentInstallment.value`), in minor units. */\n  installmentsValueInCents: number;\n  /** `PaymentInstallment.interestRate`; 0 for the interest-free 1x default. */\n  interestRate: number;\n  /** Absolute return URL. Phase-2 redirect mode only; omitted in v1's direct mode. */\n  callbackUrl?: string;\n  /**\n   * Billing differs from the delivery address. Defaults to `false`, because `setBillingAddress` persists\n   * billing on the order form's `invoiceData` (T3) and the gateway reads it from there rather than from\n   * this body. The call site that would override it is T13's `usePlaceOrder`, the one place the\n   * descriptor is assembled; T11 owns the live verification of the assumption and publishes the flag to\n   * T5's `draft` for T13 to read. Confirming it never reopens this module.\n   */\n  billingAddressDifferent?: boolean;\n}>;\n\n/** A newly entered card. Runtime argument only — never declared, never logged, never cached. */\nexport type PaymentGatewayNewCard = Readonly<{\n  kind: 'new';\n  /** Full card number. The builder strips whatever separators the method's `numberMask` inserted. */\n  number: string;\n  /** Security code (CVV). */\n  securityCode: string;\n  /** Expiry. Normalized to `MM/YY`, so a `MM/YYYY` mask is accepted. */\n  expirationDate: string;\n  holderName: string;\n  /** Shopper document (a CPF). The builder strips its punctuation. */\n  document?: string;\n  /** Shopper-assigned label, when the save-card control collected one. */\n  cardLabel?: string;\n  /** The card-save flag itself — the other half of `payment.saveCard`'s consent write (RFC D5). */\n  saveCard?: boolean;\n}>;\n\n/** A previously saved card: its account reference plus the CVV the shopper re-enters. */\nexport type PaymentGatewaySavedCard = Readonly<{\n  kind: 'saved';\n  /** `SavedCard.accountId`. */\n  accountId: string;\n  /** `SavedCard.bin` — not sensitive; the read model exposes it for installment lookup. */\n  bin: string;\n  /** Security code (CVV). */\n  securityCode: string;\n}>;\n\nexport type PaymentGatewayCard = PaymentGatewayNewCard | PaymentGatewaySavedCard;\n\nexport type SendPaymentsRequest = Readonly<{\n  transaction: PaymentGatewayTransaction;\n  card: PaymentGatewayCard;\n}>;\n\n/** The assembled request. Exported so the body shape is unit-testable without issuing a POST. */\nexport type GatewayPaymentsRequest = Readonly<{ url: string; body: readonly unknown[] }>;\n\n/** VTEX bins the leading eight digits, not six — the legacy's own `sanitizedBin` slice. */\nconst BIN_LENGTH = 8;\n\n/**\n * Strips the separators a mask inserted. `PaymentMethodValidator.numberMask` is server-driven (T1) and the\n * card-entry component (T7) renders the input through it, so its local state holds `4111 1111 1111 1111`\n * rather than the digits. The legacy normalized here, in the builder, before its own BIN slice\n * (`card.cardNumber = card.cardNumber.replace(/ /g, '')`) — the boundary is the one place the obligation\n * cannot be forgotten, and a spaced BIN is a lookup the gateway fails with no diagnosable error.\n */\nfunction toDigits(value: string): string {\n  return value.replace(/\\D/g, '');\n}\n\n/** `MM/YY` whatever the mask produced (`MM/YYYY`, `MMYY`) — the legacy's own two-slice normalization. */\nfunction toDueDate(expirationDate: string): string {\n  const digits = toDigits(expirationDate);\n  return `${digits.slice(0, 2)}/${digits.slice(-2)}`;\n}\n\n/** The card half of the body — the BIN and the `fields` map, both derived from one normalization pass. */\nfunction toCardBody(card: PaymentGatewayCard): { bin: string; fields: Record<string, unknown> } {\n  if (card.kind === 'saved') {\n    return { bin: card.bin, fields: { bin: card.bin, validationCode: card.securityCode } };\n  }\n\n  const number = toDigits(card.number);\n  const bin = number.slice(0, BIN_LENGTH);\n\n  return {\n    bin,\n    fields: {\n      bin,\n      cardNumber: number,\n      // The legacy's own `\\W` strip, so a CPF typed `123.456.789-00` reaches the gateway unpunctuated.\n      document: card.document === undefined ? null : card.document.replace(/\\W/g, ''),\n      dueDate: toDueDate(card.expirationDate),\n      holderName: card.holderName,\n      validationCode: card.securityCode,\n      cardLabel: card.cardLabel,\n      savePaymentData: card.saveCard ?? false,\n    },\n  };\n}\n\n/**\n * Builds the gateway URL and body. Billing is deliberately absent from the body: `setBillingAddress`\n * already persisted it on the order form's `invoiceData` (T3), so the gateway reads it from there — hence\n * the `billingAddressDifferent: false` default the two billing flags derive from. `originalPaymentIndex`\n * is the legacy's own constant for a single-payment order.\n *\n * The origin check is the last line of defence, not the first: `usePlaceOrder` already refuses an\n * untrusted origin *before* asking a holder for the card (T13, Decision 4). A builder has no userError\n * channel, so it throws — `sendPayments` catches, collapses it to `GATEWAY_ERROR`, and logs the error's\n * name only, so nothing about the card reaches a log. The throw happens before the body is assembled.\n */\nexport function buildGatewayPaymentsRequest({ transaction, card }: SendPaymentsRequest): GatewayPaymentsRequest {\n  if (!isTrustedGatewayOrigin(transaction.gatewayUrl)) {\n    throw new Error('Refusing to post card data: the transaction carries no trusted https gateway origin.');\n  }\n\n  const params = new URLSearchParams({ orderId: transaction.orderGroup });\n  if (transaction.userProfileId !== null) params.append('userProfileId', transaction.userProfileId);\n  if (transaction.callbackUrl !== undefined) params.append('callbackUrl', transaction.callbackUrl);\n\n  const url = `${transaction.gatewayUrl}/api/pub/transactions/${transaction.transactionId}/payments?${params}`;\n\n  const { bin, fields } = toCardBody(card);\n  const billingAddressDifferent = transaction.billingAddressDifferent ?? false;\n\n  const payment = {\n    accountId: card.kind === 'saved' ? card.accountId : null,\n    bin,\n    chooseToUseNewCard: card.kind === 'new',\n    currencyCode: transaction.currencyCode,\n    fields,\n    groupName: transaction.groupName,\n    hasDefaultBillingAddress: !billingAddressDifferent,\n    id: transaction.merchantName,\n    installmentValue: transaction.installmentsValueInCents,\n    installments: transaction.installments,\n    installmentsInterestRate: transaction.interestRate,\n    installmentsValue: transaction.installmentsValueInCents,\n    interestRate: transaction.interestRate,\n    isBillingAddressDifferent: billingAddressDifferent,\n    originalPaymentIndex: 1,\n    paymentSystem: transaction.paymentSystem,\n    referenceValue: transaction.referenceValueInCents,\n    tokenId: null,\n    transaction: { id: transaction.transactionId, merchantName: transaction.merchantName },\n    value: transaction.valueInCents,\n  };\n\n  return { url, body: [payment] };\n}\n\n/**\n * T29 (FR-6, OQ-7): this leg's own abort budget. Before this task the direct-to-gateway POST carried no\n * `AbortSignal` and no timeout at all, so a gateway that never answered left `placing` true and the CTA\n * dead for the life of the mount (Route C, `place-order.md`'s Known limitations). The BFF's own default\n * is 10s (`apps/storefront-api-core/.../api-timeout.ts:9`), but a card authorization can legitimately\n * run longer than a GraphQL round trip, and this exact number is not confirmed with payments (spec\n * OQ-7) — a placeholder pending that answer, not a tuned production value.\n *\n * Exported so `gateway.test.ts`'s own abort-budget test can assert the abort fires at exactly this\n * duration, rather than against `vi.runAllTimersAsync()`, which fires any pending timer regardless of\n * duration and would stay green even if this were edited to `300_000`. That mechanism test alone is\n * still self-referential about this constant's own *value* — it advances the fake clock by whatever\n * `GATEWAY_REQUEST_TIMEOUT_MS` currently holds, so on its own it cannot catch an edit to the constant\n * either (fix round 2, verification finding V2). `gateway.test.ts` also asserts this constant against\n * the literal `30_000` directly, in its own dedicated test — that is what actually fails if this\n * constant's value ever changes.\n */\nexport const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\n/**\n * Posts the card straight to the gateway and resolves the gateway leg's `userErrors` (empty on success).\n * A non-2xx response resolves one `GATEWAY_ERROR`; a rejected request — including this leg's own\n * timeout firing, or `options.signal` aborting — propagates, and the handler in `use-payment-actions.ts`\n * collapses it to the same one. Neither outcome reads the response body: it may echo the request, and\n * it tells the shopper nothing more actionable than \"try again\".\n *\n * `options.signal`, when given, aborts this request in *addition to* — never instead of — this module's\n * own timeout: a caller opts into an earlier or externally triggered abort, but cannot opt out of the\n * budget that keeps this leg from hanging forever (FR-6, US-3). Composed with a plain `AbortController`\n * rather than `AbortSignal.any`/`AbortSignal.timeout` so the timeout is driven by an ordinary\n * `setTimeout`, the one implementation a test can advance deterministically with fake timers.\n *\n * No caller in this package passes `options.signal` today — it exists to satisfy the spec's own\n * Technical Contract (`specs/make-an-order-attempt-survive-a.md`) ahead of a future integration. Fix\n * pass, Low finding: the listener this composes onto `externalSignal` is now removed in the `finally`\n * below on every exit path, not only when it fires — previously, a caller that supplied a long-lived\n * signal (as opposed to a fresh one per call) would accumulate one listener, and this function's own\n * dead `AbortController`, per call that resolved normally.\n */\nexport async function postPaymentsToGateway(\n  request: SendPaymentsRequest,\n  options?: { signal?: AbortSignal },\n): Promise<readonly PaymentUserError[]> {\n  const { url, body } = buildGatewayPaymentsRequest(request);\n\n  const controller = new AbortController();\n  const timeoutId = setTimeout(\n    () => controller.abort(new DOMException('The gateway request timed out.', 'TimeoutError')),\n    GATEWAY_REQUEST_TIMEOUT_MS,\n  );\n  const externalSignal = options?.signal;\n  const onExternalAbort = () => controller.abort(externalSignal?.reason);\n  if (externalSignal) {\n    if (externalSignal.aborted) {\n      controller.abort(externalSignal.reason);\n    } else {\n      externalSignal.addEventListener('abort', onExternalAbort, { once: true });\n    }\n  }\n\n  try {\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n      signal: controller.signal,\n    });\n\n    return response.ok ? [] : [PAYMENT_GATEWAY_USER_ERROR];\n  } finally {\n    clearTimeout(timeoutId);\n    externalSignal?.removeEventListener('abort', onExternalAbort);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,6BAA6B;;AAG1C,MAAa,6BAA+C;CAC1D,MAAM;CACN,SAAS;AACX;;AA4FA,MAAM,aAAa;;;;;;;;AASnB,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,QAAQ,OAAO,EAAE;AAChC;;AAGA,SAAS,UAAU,gBAAgC;CACjD,MAAM,SAAS,SAAS,cAAc;CACtC,OAAO,GAAG,OAAO,MAAM,GAAG,CAAC,EAAE,GAAG,OAAO,MAAM,EAAE;AACjD;;AAGA,SAAS,WAAW,MAA4E;CAC9F,IAAI,KAAK,SAAS,SAChB,OAAO;EAAE,KAAK,KAAK;EAAK,QAAQ;GAAE,KAAK,KAAK;GAAK,gBAAgB,KAAK;EAAa;CAAE;CAGvF,MAAM,SAAS,SAAS,KAAK,MAAM;CACnC,MAAM,MAAM,OAAO,MAAM,GAAG,UAAU;CAEtC,OAAO;EACL;EACA,QAAQ;GACN;GACA,YAAY;GAEZ,UAAU,KAAK,aAAa,KAAA,IAAY,OAAO,KAAK,SAAS,QAAQ,OAAO,EAAE;GAC9E,SAAS,UAAU,KAAK,cAAc;GACtC,YAAY,KAAK;GACjB,gBAAgB,KAAK;GACrB,WAAW,KAAK;GAChB,iBAAiB,KAAK,YAAY;EACpC;CACF;AACF;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,EAAE,aAAa,QAAqD;CAC9G,IAAI,CAAC,uBAAuB,YAAY,UAAU,GAChD,MAAM,IAAI,MAAM,sFAAsF;CAGxG,MAAM,SAAS,IAAI,gBAAgB,EAAE,SAAS,YAAY,WAAW,CAAC;CACtE,IAAI,YAAY,kBAAkB,MAAM,OAAO,OAAO,iBAAiB,YAAY,aAAa;CAChG,IAAI,YAAY,gBAAgB,KAAA,GAAW,OAAO,OAAO,eAAe,YAAY,WAAW;CAE/F,MAAM,MAAM,GAAG,YAAY,WAAW,wBAAwB,YAAY,cAAc,YAAY;CAEpG,MAAM,EAAE,KAAK,WAAW,WAAW,IAAI;CACvC,MAAM,0BAA0B,YAAY,2BAA2B;CAyBvE,OAAO;EAAE;EAAK,MAAM,CAAC;GAtBnB,WAAW,KAAK,SAAS,UAAU,KAAK,YAAY;GACpD;GACA,oBAAoB,KAAK,SAAS;GAClC,cAAc,YAAY;GAC1B;GACA,WAAW,YAAY;GACvB,0BAA0B,CAAC;GAC3B,IAAI,YAAY;GAChB,kBAAkB,YAAY;GAC9B,cAAc,YAAY;GAC1B,0BAA0B,YAAY;GACtC,mBAAmB,YAAY;GAC/B,cAAc,YAAY;GAC1B,2BAA2B;GAC3B,sBAAsB;GACtB,eAAe,YAAY;GAC3B,gBAAgB,YAAY;GAC5B,SAAS;GACT,aAAa;IAAE,IAAI,YAAY;IAAe,cAAc,YAAY;GAAa;GACrF,OAAO,YAAY;EAGM,CAAC;CAAE;AAChC;;;;;;;;;;;;;;;;;;AAmBA,MAAa,6BAA6B;;;;;;;;;;;;;;;;;;;;;AAsB1C,eAAsB,sBACpB,SACA,SACsC;CACtC,MAAM,EAAE,KAAK,SAAS,4BAA4B,OAAO;CAEzD,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,YAAY,iBACV,WAAW,MAAM,IAAI,aAAa,kCAAkC,cAAc,CAAC,GACzF,0BACF;CACA,MAAM,iBAAiB,SAAS;CAChC,MAAM,wBAAwB,WAAW,MAAM,gBAAgB,MAAM;CACrE,IAAI,gBAAgB;EAClB,IAAI,eAAe,SACjB,WAAW,MAAM,eAAe,MAAM;OAEtC,eAAe,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAE5E;CAEA,IAAI;EAQF,QAAO,MAPgB,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU,IAAI;GACzB,QAAQ,WAAW;EACrB,CAAC,EAAA,CAEe,KAAK,CAAC,IAAI,CAAC,0BAA0B;CACvD,UAAU;EACR,aAAa,SAAS;EACtB,gBAAgB,oBAAoB,SAAS,eAAe;CAC9D;AACF"}

package/dist/sdk/payment/operations.d.ts

@@ -0,0 +1,52 @@
+import "../cart/operations.js";
+import { TypedDocumentNode } from "@apollo/client";
+//#region src/sdk/payment/operations.d.ts
+/**
+ * Payment write-model GraphQL operations (specs/payment-action-namespace.md, T4) — the five mutations
+ * `api-module:PaymentWriteModel` shipped (T3, `checkout/schema.graphql` § 11). Nothing here is
+ * invented: every mutation, input field, and payload field is pinned to that schema.
+ *
+ * Authored with the hand `gql` tag — the codegen `graphql()` factory is reserved for the reactive read
+ * path — and excluded from the codegen `documents` glob (see `codegen.ts`): the `gql` tag alone is
+ * still plucked by `graphql-codegen`, which would duplicate these hand-written types in
+ * `sdk/generated/`. Mirrors `shipping/option-select-operations.ts` and `identity/operations.ts`.
+ *
+ * No field at any nesting depth carries a card number or CVV — the read model guarantees it (RFC D13),
+ * and the one call that does carry them never touches GraphQL at all (see `gateway.ts`).
+ *
+ * Failures follow ADR-00007's two-path contract: domain outcomes arrive as payload `userErrors`;
+ * transport and top-level GraphQL failures are infrastructure, collapsed by the handlers in
+ * `use-payment-actions.ts` to the one client-synthesized code, `PAYMENT_NETWORK_ERROR_CODE`.
+ */
+/** A payment domain error. Every mutation's error type is `{ code, message }`; codes stay strings. */
+export type PaymentUserError = Readonly<{
+  code: string;
+  message: string;
+}>;
+export type PaymentMoney = Readonly<{
+  __typename?: 'Money';
+  amount: number;
+  currencyCode: string;
+}>;
+/** A `bin` with an `accountId` is validated against the saved card's own BIN (MISMATCHED_BIN_FOR_SAVED_CARD). */
+export type PaymentMethodSelectInput = Readonly<{
+  methodId: string;
+  bin?: string;
+  accountId?: string;
+}>;
+/** With `sameAsDelivery: true` every other field is ignored and the server performs no upstream write. */
+export type PaymentBillingAddressUpdateInput = Readonly<{
+  sameAsDelivery: boolean;
+  addressType?: string;
+  postalCode?: string;
+  country?: string;
+  street?: string;
+  number?: string;
+  complement?: string;
+  neighborhood?: string;
+  city?: string;
+  state?: string;
+  reference?: string;
+}>;
+//#endregion
+//# sourceMappingURL=operations.d.ts.map