@waffo/pancake-ts 0.2.1 → 0.3.0

package/dist/index.d.cts

@@ -18,6 +18,18 @@ interface WaffoPancakeConfig {
      */
     webhookPublicKey?: WebhookPublicKeys;
 }
+/**
+ * Options for {@link HttpClient.post}.
+ * Not exported publicly — used by resource classes.
+ */
+interface PostOptions {
+    /**
+     * Time window in seconds for idempotency key rotation.
+     * When set, a floored timestamp is mixed into the key so identical params
+     * produce a new key after the window elapses (e.g. 60 = per-minute dedup).
+     */
+    idempotencyWindow?: number;
+}
 /**
  * Single error object within the `errors` array.
  *
@@ -175,14 +187,6 @@ declare enum MediaType {
     Image = "image",
     Video = "video"
 }
-/**
- * Checkout session product type.
- * @see waffo-pancake-order-service/app/lib/types.ts
- */
-declare enum CheckoutSessionProductType {
-    Onetime = "onetime",
-    Subscription = "subscription"
-}
 /** Error layer identifier in the call stack. */
 declare enum ErrorLayer {
     Gateway = "gateway",
@@ -200,13 +204,19 @@ declare enum ErrorLayer {
 }
 /**
  * Parameters for issuing a buyer session token.
+ *
+ * Provide either `storeId` or `productId` (at least one required).
+ * When `productId` is given without `storeId`, the server derives the store from the product.
+ *
  * @see waffo-pancake-user-service/app/lib/utils/jwt.ts IssueSessionTokenRequest
  */
 interface IssueSessionTokenParams {
     /** Buyer identity (email or any merchant-provided identifier string) */
     buyerIdentity: string;
-    /** Store ID */
-    storeId: string;
+    /** Store ID (optional when `productId` is provided) */
+    storeId?: string;
+    /** Product ID — used to derive the store when `storeId` is omitted */
+    productId?: string;
 }
 /**
  * Issued session token response.
@@ -613,12 +623,8 @@ interface BillingDetail {
  * @see waffo-pancake-order-service/app/lib/types.ts CreateCheckoutSessionRequest
  */
 interface CreateCheckoutSessionParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Optional price snapshot override (reads from DB if omitted) */
@@ -745,20 +751,14 @@ interface RefundTicket {
  *
  * @example
  * const result = await client.checkout.anonymous.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  * });
  * // Redirect to result.checkoutUrl
  */
 interface AnonymousCheckoutParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Optional price snapshot override (reads from DB if omitted) */
@@ -782,21 +782,15 @@ interface AnonymousCheckoutParams {
  *
  * @example
  * const result = await client.checkout.authenticated.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  *   buyerIdentity: "customer@example.com",
  * });
  * // Redirect to result.checkoutUrl (includes #token=...)
  */
 interface AuthenticatedCheckoutParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Buyer identity (email or merchant-provided identifier) */
@@ -989,15 +983,19 @@ declare class HttpClient {
      *
      * Behavior:
      * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+     * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+     *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
      * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
      * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
      *
      * @param path - API path (e.g. `/v1/actions/store/create-store`)
      * @param body - Request body object
+     * @param options - Optional settings
+     * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
      * @returns Parsed `data` field from the response
      * @throws {WaffoPancakeError} When the API returns errors
      */
-    post<T>(path: string, body: object): Promise<T>;
+    post<T>(path: string, body: object, options?: PostOptions): Promise<T>;
 }
 
 /** Authentication resource — issue session tokens for buyers. */
@@ -1011,10 +1009,18 @@ declare class AuthResource {
      * @returns Issued session token with expiration
      *
      * @example
+     * // By store ID
      * const { token, expiresAt } = await client.auth.issueSessionToken({
      *   storeId: "STO_xxx",
      *   buyerIdentity: "customer@example.com",
      * });
+     *
+     * @example
+     * // By product ID (store derived automatically)
+     * const { token, expiresAt } = await client.auth.issueSessionToken({
+     *   productId: "PROD_xxx",
+     *   buyerIdentity: "customer@example.com",
+     * });
      */
     issueSessionToken(params: IssueSessionTokenParams): Promise<SessionToken>;
 }
@@ -1165,9 +1171,7 @@ declare class CheckoutAnonymousResource {
      *
      * @example
      * const result = await client.checkout.anonymous.create({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      * });
      * // Redirect to result.checkoutUrl
@@ -1199,9 +1203,7 @@ declare class CheckoutAuthenticatedResource {
      *
      * @example
      * const result = await client.checkout.authenticated.create({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      *   buyerIdentity: "customer@example.com",
      * });
@@ -1222,18 +1224,14 @@ declare class CheckoutAuthenticatedResource {
  * @example
  * // Anonymous checkout (no identity)
  * const result = await client.checkout.anonymous.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  * });
  *
  * @example
  * // Authenticated checkout (with buyer identity)
  * const result = await client.checkout.authenticated.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  *   buyerIdentity: "customer@example.com",
  * });
@@ -1257,9 +1255,7 @@ declare class CheckoutResource {
      *
      * @example
      * const session = await client.checkout.createSession({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      *   buyerEmail: "customer@example.com",
      * });
@@ -1669,9 +1665,7 @@ declare class WebhooksResource {
  *
  * // Create a checkout session
  * const session = await client.checkout.createSession({
- *   storeId: store.id,
  *   productId: product.id,
- *   productType: "onetime",
  *   currency: "USD",
  * });
  * // => redirect customer to session.checkoutUrl
@@ -1804,4 +1798,4 @@ declare class WaffoPancakeError extends Error {
  */
 declare function verifyWebhook<T = Record<string, unknown>>(payload: string, signatureHeader: string | undefined | null, options?: VerifyWebhookOptions): WebhookEvent<T>;
 
-export { type AddMerchantParams, type AddMerchantResult, type AnonymousCheckoutParams, type ApiError, type ApiErrorResponse, type ApiResponse, type ApiSuccessResponse, type AuthenticatedCheckoutParams, type AuthenticatedCheckoutResult, type BillingDetail, BillingPeriod, type CancelOnetimeOrderParams, type CancelOnetimeOrderResult, type CancelSubscriptionParams, type CancelSubscriptionResult, CheckoutSessionProductType, type CheckoutSessionResult, type CheckoutSettings, type CheckoutThemeSettings, type CreateCheckoutSessionParams, type CreateOnetimeProductParams, type CreateRefundTicketParams, type CreateStoreParams, type CreateSubscriptionProductGroupParams, type CreateSubscriptionProductParams, type DeleteStoreParams, type DeleteSubscriptionProductGroupParams, EntityStatus, Environment, ErrorLayer, type GraphQLParams, type GraphQLResponse, type GroupRules, type IssueSessionTokenParams, type MediaItem, MediaType, type NotificationSettings, OnetimeOrderStatus, type OnetimeProductDetail, PaymentStatus, type PriceInfo, type Prices, ProductVersionStatus, type PublishOnetimeProductParams, type PublishSubscriptionProductGroupParams, type PublishSubscriptionProductParams, type ReactivateSubscriptionParams, type ReactivateSubscriptionResult, RefundStatus, type RefundTicket, RefundTicketStatus, type RemoveMerchantParams, type RemoveMerchantResult, type RequestedAmount, type ResubmitRefundTicketParams, type SessionToken, type Store, StoreRole, SubscriptionOrderStatus, type SubscriptionProductDetail, type SubscriptionProductGroup, TaxCategory, type UpdateOnetimeProductParams, type UpdateOnetimeStatusParams, type UpdateRoleParams, type UpdateRoleResult, type UpdateStoreParams, type UpdateSubscriptionProductGroupParams, type UpdateSubscriptionProductParams, type UpdateSubscriptionStatusParams, type VerifyWebhookOptions, WaffoPancake, type WaffoPancakeConfig, WaffoPancakeError, type WebhookEvent, type WebhookEventData, WebhookEventType, type WebhookPublicKeys, type WebhookSettings, verifyWebhook };
+export { type AddMerchantParams, type AddMerchantResult, type AnonymousCheckoutParams, type ApiError, type ApiErrorResponse, type ApiResponse, type ApiSuccessResponse, type AuthenticatedCheckoutParams, type AuthenticatedCheckoutResult, type BillingDetail, BillingPeriod, type CancelOnetimeOrderParams, type CancelOnetimeOrderResult, type CancelSubscriptionParams, type CancelSubscriptionResult, type CheckoutSessionResult, type CheckoutSettings, type CheckoutThemeSettings, type CreateCheckoutSessionParams, type CreateOnetimeProductParams, type CreateRefundTicketParams, type CreateStoreParams, type CreateSubscriptionProductGroupParams, type CreateSubscriptionProductParams, type DeleteStoreParams, type DeleteSubscriptionProductGroupParams, EntityStatus, Environment, ErrorLayer, type GraphQLParams, type GraphQLResponse, type GroupRules, type IssueSessionTokenParams, type MediaItem, MediaType, type NotificationSettings, OnetimeOrderStatus, type OnetimeProductDetail, PaymentStatus, type PriceInfo, type Prices, ProductVersionStatus, type PublishOnetimeProductParams, type PublishSubscriptionProductGroupParams, type PublishSubscriptionProductParams, type ReactivateSubscriptionParams, type ReactivateSubscriptionResult, RefundStatus, type RefundTicket, RefundTicketStatus, type RemoveMerchantParams, type RemoveMerchantResult, type RequestedAmount, type ResubmitRefundTicketParams, type SessionToken, type Store, StoreRole, SubscriptionOrderStatus, type SubscriptionProductDetail, type SubscriptionProductGroup, TaxCategory, type UpdateOnetimeProductParams, type UpdateOnetimeStatusParams, type UpdateRoleParams, type UpdateRoleResult, type UpdateStoreParams, type UpdateSubscriptionProductGroupParams, type UpdateSubscriptionProductParams, type UpdateSubscriptionStatusParams, type VerifyWebhookOptions, WaffoPancake, type WaffoPancakeConfig, WaffoPancakeError, type WebhookEvent, type WebhookEventData, WebhookEventType, type WebhookPublicKeys, type WebhookSettings, verifyWebhook };

package/dist/index.d.ts

@@ -18,6 +18,18 @@ interface WaffoPancakeConfig {
      */
     webhookPublicKey?: WebhookPublicKeys;
 }
+/**
+ * Options for {@link HttpClient.post}.
+ * Not exported publicly — used by resource classes.
+ */
+interface PostOptions {
+    /**
+     * Time window in seconds for idempotency key rotation.
+     * When set, a floored timestamp is mixed into the key so identical params
+     * produce a new key after the window elapses (e.g. 60 = per-minute dedup).
+     */
+    idempotencyWindow?: number;
+}
 /**
  * Single error object within the `errors` array.
  *
@@ -175,14 +187,6 @@ declare enum MediaType {
     Image = "image",
     Video = "video"
 }
-/**
- * Checkout session product type.
- * @see waffo-pancake-order-service/app/lib/types.ts
- */
-declare enum CheckoutSessionProductType {
-    Onetime = "onetime",
-    Subscription = "subscription"
-}
 /** Error layer identifier in the call stack. */
 declare enum ErrorLayer {
     Gateway = "gateway",
@@ -200,13 +204,19 @@ declare enum ErrorLayer {
 }
 /**
  * Parameters for issuing a buyer session token.
+ *
+ * Provide either `storeId` or `productId` (at least one required).
+ * When `productId` is given without `storeId`, the server derives the store from the product.
+ *
  * @see waffo-pancake-user-service/app/lib/utils/jwt.ts IssueSessionTokenRequest
  */
 interface IssueSessionTokenParams {
     /** Buyer identity (email or any merchant-provided identifier string) */
     buyerIdentity: string;
-    /** Store ID */
-    storeId: string;
+    /** Store ID (optional when `productId` is provided) */
+    storeId?: string;
+    /** Product ID — used to derive the store when `storeId` is omitted */
+    productId?: string;
 }
 /**
  * Issued session token response.
@@ -613,12 +623,8 @@ interface BillingDetail {
  * @see waffo-pancake-order-service/app/lib/types.ts CreateCheckoutSessionRequest
  */
 interface CreateCheckoutSessionParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Optional price snapshot override (reads from DB if omitted) */
@@ -745,20 +751,14 @@ interface RefundTicket {
  *
  * @example
  * const result = await client.checkout.anonymous.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  * });
  * // Redirect to result.checkoutUrl
  */
 interface AnonymousCheckoutParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Optional price snapshot override (reads from DB if omitted) */
@@ -782,21 +782,15 @@ interface AnonymousCheckoutParams {
  *
  * @example
  * const result = await client.checkout.authenticated.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  *   buyerIdentity: "customer@example.com",
  * });
  * // Redirect to result.checkoutUrl (includes #token=...)
  */
 interface AuthenticatedCheckoutParams {
-    /** Store ID */
-    storeId: string;
     /** Product ID */
     productId: string;
-    /** Product type */
-    productType: `${CheckoutSessionProductType}`;
     /** Currency code (ISO 4217) */
     currency: string;
     /** Buyer identity (email or merchant-provided identifier) */
@@ -989,15 +983,19 @@ declare class HttpClient {
      *
      * Behavior:
      * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+     * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+     *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
      * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
      * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
      *
      * @param path - API path (e.g. `/v1/actions/store/create-store`)
      * @param body - Request body object
+     * @param options - Optional settings
+     * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
      * @returns Parsed `data` field from the response
      * @throws {WaffoPancakeError} When the API returns errors
      */
-    post<T>(path: string, body: object): Promise<T>;
+    post<T>(path: string, body: object, options?: PostOptions): Promise<T>;
 }
 
 /** Authentication resource — issue session tokens for buyers. */
@@ -1011,10 +1009,18 @@ declare class AuthResource {
      * @returns Issued session token with expiration
      *
      * @example
+     * // By store ID
      * const { token, expiresAt } = await client.auth.issueSessionToken({
      *   storeId: "STO_xxx",
      *   buyerIdentity: "customer@example.com",
      * });
+     *
+     * @example
+     * // By product ID (store derived automatically)
+     * const { token, expiresAt } = await client.auth.issueSessionToken({
+     *   productId: "PROD_xxx",
+     *   buyerIdentity: "customer@example.com",
+     * });
      */
     issueSessionToken(params: IssueSessionTokenParams): Promise<SessionToken>;
 }
@@ -1165,9 +1171,7 @@ declare class CheckoutAnonymousResource {
      *
      * @example
      * const result = await client.checkout.anonymous.create({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      * });
      * // Redirect to result.checkoutUrl
@@ -1199,9 +1203,7 @@ declare class CheckoutAuthenticatedResource {
      *
      * @example
      * const result = await client.checkout.authenticated.create({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      *   buyerIdentity: "customer@example.com",
      * });
@@ -1222,18 +1224,14 @@ declare class CheckoutAuthenticatedResource {
  * @example
  * // Anonymous checkout (no identity)
  * const result = await client.checkout.anonymous.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  * });
  *
  * @example
  * // Authenticated checkout (with buyer identity)
  * const result = await client.checkout.authenticated.create({
- *   storeId: "STO_xxx",
  *   productId: "PROD_xxx",
- *   productType: "onetime",
  *   currency: "USD",
  *   buyerIdentity: "customer@example.com",
  * });
@@ -1257,9 +1255,7 @@ declare class CheckoutResource {
      *
      * @example
      * const session = await client.checkout.createSession({
-     *   storeId: "STO_xxx",
      *   productId: "PROD_xxx",
-     *   productType: "onetime",
      *   currency: "USD",
      *   buyerEmail: "customer@example.com",
      * });
@@ -1669,9 +1665,7 @@ declare class WebhooksResource {
  *
  * // Create a checkout session
  * const session = await client.checkout.createSession({
- *   storeId: store.id,
  *   productId: product.id,
- *   productType: "onetime",
  *   currency: "USD",
  * });
  * // => redirect customer to session.checkoutUrl
@@ -1804,4 +1798,4 @@ declare class WaffoPancakeError extends Error {
  */
 declare function verifyWebhook<T = Record<string, unknown>>(payload: string, signatureHeader: string | undefined | null, options?: VerifyWebhookOptions): WebhookEvent<T>;
 
-export { type AddMerchantParams, type AddMerchantResult, type AnonymousCheckoutParams, type ApiError, type ApiErrorResponse, type ApiResponse, type ApiSuccessResponse, type AuthenticatedCheckoutParams, type AuthenticatedCheckoutResult, type BillingDetail, BillingPeriod, type CancelOnetimeOrderParams, type CancelOnetimeOrderResult, type CancelSubscriptionParams, type CancelSubscriptionResult, CheckoutSessionProductType, type CheckoutSessionResult, type CheckoutSettings, type CheckoutThemeSettings, type CreateCheckoutSessionParams, type CreateOnetimeProductParams, type CreateRefundTicketParams, type CreateStoreParams, type CreateSubscriptionProductGroupParams, type CreateSubscriptionProductParams, type DeleteStoreParams, type DeleteSubscriptionProductGroupParams, EntityStatus, Environment, ErrorLayer, type GraphQLParams, type GraphQLResponse, type GroupRules, type IssueSessionTokenParams, type MediaItem, MediaType, type NotificationSettings, OnetimeOrderStatus, type OnetimeProductDetail, PaymentStatus, type PriceInfo, type Prices, ProductVersionStatus, type PublishOnetimeProductParams, type PublishSubscriptionProductGroupParams, type PublishSubscriptionProductParams, type ReactivateSubscriptionParams, type ReactivateSubscriptionResult, RefundStatus, type RefundTicket, RefundTicketStatus, type RemoveMerchantParams, type RemoveMerchantResult, type RequestedAmount, type ResubmitRefundTicketParams, type SessionToken, type Store, StoreRole, SubscriptionOrderStatus, type SubscriptionProductDetail, type SubscriptionProductGroup, TaxCategory, type UpdateOnetimeProductParams, type UpdateOnetimeStatusParams, type UpdateRoleParams, type UpdateRoleResult, type UpdateStoreParams, type UpdateSubscriptionProductGroupParams, type UpdateSubscriptionProductParams, type UpdateSubscriptionStatusParams, type VerifyWebhookOptions, WaffoPancake, type WaffoPancakeConfig, WaffoPancakeError, type WebhookEvent, type WebhookEventData, WebhookEventType, type WebhookPublicKeys, type WebhookSettings, verifyWebhook };
+export { type AddMerchantParams, type AddMerchantResult, type AnonymousCheckoutParams, type ApiError, type ApiErrorResponse, type ApiResponse, type ApiSuccessResponse, type AuthenticatedCheckoutParams, type AuthenticatedCheckoutResult, type BillingDetail, BillingPeriod, type CancelOnetimeOrderParams, type CancelOnetimeOrderResult, type CancelSubscriptionParams, type CancelSubscriptionResult, type CheckoutSessionResult, type CheckoutSettings, type CheckoutThemeSettings, type CreateCheckoutSessionParams, type CreateOnetimeProductParams, type CreateRefundTicketParams, type CreateStoreParams, type CreateSubscriptionProductGroupParams, type CreateSubscriptionProductParams, type DeleteStoreParams, type DeleteSubscriptionProductGroupParams, EntityStatus, Environment, ErrorLayer, type GraphQLParams, type GraphQLResponse, type GroupRules, type IssueSessionTokenParams, type MediaItem, MediaType, type NotificationSettings, OnetimeOrderStatus, type OnetimeProductDetail, PaymentStatus, type PriceInfo, type Prices, ProductVersionStatus, type PublishOnetimeProductParams, type PublishSubscriptionProductGroupParams, type PublishSubscriptionProductParams, type ReactivateSubscriptionParams, type ReactivateSubscriptionResult, RefundStatus, type RefundTicket, RefundTicketStatus, type RemoveMerchantParams, type RemoveMerchantResult, type RequestedAmount, type ResubmitRefundTicketParams, type SessionToken, type Store, StoreRole, SubscriptionOrderStatus, type SubscriptionProductDetail, type SubscriptionProductGroup, TaxCategory, type UpdateOnetimeProductParams, type UpdateOnetimeStatusParams, type UpdateRoleParams, type UpdateRoleResult, type UpdateStoreParams, type UpdateSubscriptionProductGroupParams, type UpdateSubscriptionProductParams, type UpdateSubscriptionStatusParams, type VerifyWebhookOptions, WaffoPancake, type WaffoPancakeConfig, WaffoPancakeError, type WebhookEvent, type WebhookEventData, WebhookEventType, type WebhookPublicKeys, type WebhookSettings, verifyWebhook };

package/dist/index.js

@@ -179,18 +179,26 @@ var HttpClient = class {
    *
    * Behavior:
    * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+   * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+   *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
    * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
    * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
    *
    * @param path - API path (e.g. `/v1/actions/store/create-store`)
    * @param body - Request body object
+   * @param options - Optional settings
+   * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
    * @returns Parsed `data` field from the response
    * @throws {WaffoPancakeError} When the API returns errors
    */
-  async post(path, body) {
+  async post(path, body, options) {
     const bodyStr = JSON.stringify(body);
-    const timestamp = Math.floor(Date.now() / 1e3).toString();
+    const now = Date.now();
+    const timestampSec = Math.floor(now / 1e3);
+    const timestamp = timestampSec.toString();
     const signature = signRequest("POST", path, timestamp, bodyStr, this.privateKey);
+    const idempotencyBase = `${this.merchantId}:${path}:${bodyStr}`;
+    const idempotencyInput = options?.idempotencyWindow ? `${idempotencyBase}:${Math.floor(timestampSec / options.idempotencyWindow)}` : idempotencyBase;
     const response = await this._fetch(`${this.baseUrl}${path}`, {
       method: "POST",
       headers: {
@@ -198,7 +206,7 @@ var HttpClient = class {
         "X-Merchant-Id": this.merchantId,
         "X-Timestamp": timestamp,
         "X-Signature": signature,
-        "X-Idempotency-Key": createHash2("sha256").update(`${this.merchantId}:${path}:${bodyStr}`).digest("hex")
+        "X-Idempotency-Key": createHash2("sha256").update(idempotencyInput).digest("hex")
       },
       body: bodyStr
     });
@@ -293,9 +301,7 @@ function validateBillingDetail(detail) {
   }
 }
 function validateCheckoutCommon(params) {
-  validateShortId("storeId", params.storeId, "STO");
   validateShortId("productId", params.productId, "PROD");
-  validateEnum("productType", params.productType, ["onetime", "subscription"]);
   validateCurrencyCode("currency", params.currency);
   if (params.priceSnapshot) {
     validateAmountString("priceSnapshot.amount", params.priceSnapshot.amount);
@@ -321,13 +327,31 @@ var AuthResource = class {
    * @returns Issued session token with expiration
    *
    * @example
+   * // By store ID
    * const { token, expiresAt } = await client.auth.issueSessionToken({
    *   storeId: "STO_xxx",
    *   buyerIdentity: "customer@example.com",
    * });
+   *
+   * @example
+   * // By product ID (store derived automatically)
+   * const { token, expiresAt } = await client.auth.issueSessionToken({
+   *   productId: "PROD_xxx",
+   *   buyerIdentity: "customer@example.com",
+   * });
    */
   async issueSessionToken(params) {
-    validateShortId("storeId", params.storeId, "STO");
+    if (!params.storeId && !params.productId) {
+      throw new WaffoPancakeError(400, [
+        { message: "Missing required field: provide storeId or productId", layer: "sdk" }
+      ]);
+    }
+    if (params.storeId) {
+      validateShortId("storeId", params.storeId, "STO");
+    }
+    if (params.productId) {
+      validateShortId("productId", params.productId, "PROD");
+    }
     validateRequired("buyerIdentity", params.buyerIdentity);
     return this.http.post("/v1/actions/auth/issue-session-token", params);
   }
@@ -474,9 +498,7 @@ var CheckoutAnonymousResource = class {
    *
    * @example
    * const result = await client.checkout.anonymous.create({
-   *   storeId: "STO_xxx",
    *   productId: "PROD_xxx",
-   *   productType: "onetime",
    *   currency: "USD",
    * });
    * // Redirect to result.checkoutUrl
@@ -485,7 +507,8 @@ var CheckoutAnonymousResource = class {
     validateCheckoutCommon(params);
     return this.http.post(
       "/v1/actions/checkout/create-session",
-      params
+      params,
+      { idempotencyWindow: 60 }
     );
   }
 };
@@ -509,9 +532,7 @@ var CheckoutAuthenticatedResource = class {
    *
    * @example
    * const result = await client.checkout.authenticated.create({
-   *   storeId: "STO_xxx",
    *   productId: "PROD_xxx",
-   *   productType: "onetime",
    *   currency: "USD",
    *   buyerIdentity: "customer@example.com",
    * });
@@ -523,13 +544,13 @@ var CheckoutAuthenticatedResource = class {
     const { buyerIdentity, buyerEmail, ...sessionFields } = params;
     const [tokenResult, sessionResult] = await Promise.all([
       this.http.post("/v1/actions/auth/issue-session-token", {
-        storeId: params.storeId,
+        productId: params.productId,
         buyerIdentity
-      }),
+      }, { idempotencyWindow: 60 }),
       this.http.post("/v1/actions/checkout/create-session", {
         ...sessionFields,
         buyerEmail: buyerEmail ?? buyerIdentity
-      })
+      }, { idempotencyWindow: 60 })
     ]);
     return {
       sessionId: sessionResult.sessionId,
@@ -563,16 +584,14 @@ var CheckoutResource = class {
    *
    * @example
    * const session = await client.checkout.createSession({
-   *   storeId: "STO_xxx",
    *   productId: "PROD_xxx",
-   *   productType: "onetime",
    *   currency: "USD",
    *   buyerEmail: "customer@example.com",
    * });
    * // Redirect to session.checkoutUrl
    */
   async createSession(params) {
-    return this.http.post("/v1/actions/checkout/create-session", params);
+    return this.http.post("/v1/actions/checkout/create-session", params, { idempotencyWindow: 60 });
   }
 };
 
@@ -1248,11 +1267,6 @@ var MediaType = /* @__PURE__ */ ((MediaType2) => {
   MediaType2["Video"] = "video";
   return MediaType2;
 })(MediaType || {});
-var CheckoutSessionProductType = /* @__PURE__ */ ((CheckoutSessionProductType2) => {
-  CheckoutSessionProductType2["Onetime"] = "onetime";
-  CheckoutSessionProductType2["Subscription"] = "subscription";
-  return CheckoutSessionProductType2;
-})(CheckoutSessionProductType || {});
 var ErrorLayer = /* @__PURE__ */ ((ErrorLayer2) => {
   ErrorLayer2["Gateway"] = "gateway";
   ErrorLayer2["User"] = "user";
@@ -1281,7 +1295,6 @@ var WebhookEventType = /* @__PURE__ */ ((WebhookEventType2) => {
 })(WebhookEventType || {});
 export {
   BillingPeriod,
-  CheckoutSessionProductType,
   EntityStatus,
   Environment,
   ErrorLayer,