@withwiz/coupon 0.1.0 → 0.3.0

package/dist/index.cjs

@@ -55,7 +55,25 @@ var LIMITS = {
   PAGINATION_DEFAULT_LIMIT: 50,
   PAGINATION_MAX_LIMIT: 200,
   NAME_MAX_LENGTH: 200,
-  CURRENCY_LENGTH: 3
+  CURRENCY_LENGTH: 3,
+  /**
+   * [L] Caller-supplied identifier caps. Ids (coupon / campaign / cursor) are
+   * bounded by the audit log's `resourceId VarChar(64)`; `orderRef` by the
+   * redemption table's `VarChar(128)`. User / actor ids share the same bound
+   * so an unbounded string can never reach a Json or text column unchecked.
+   */
+  ID_MAX_LENGTH: 64,
+  USER_ID_MAX_LENGTH: 128,
+  ORDER_REF_MAX_LENGTH: 128,
+  /** [L] Upper bound on serialized `metadata` (bytes of JSON text). */
+  METADATA_MAX_BYTES: 16384,
+  /** [L] Per-list entry cap and per-entry length cap for eligibility rules. */
+  ELIGIBILITY_MAX_ENTRIES: 1e3,
+  ELIGIBILITY_ENTRY_MAX_LENGTH: 128,
+  /** [L] Length cap for `context.plan / productId / categoryId`. */
+  CONTEXT_VALUE_MAX_LENGTH: 128,
+  /** Upper bound for `duration.months` on a REPEATING discount. */
+  DURATION_MAX_MONTHS: 36
 };
 var AUDIT_ACTION = {
   COUPON_CREATED: "coupon.created",
@@ -264,6 +282,7 @@ function validateDiscountPolicy(policy) {
     if (policy.currency !== void 0) {
       ensureCurrency(policy.currency);
     }
+    validateDuration(policy.duration);
     return;
   }
   if (policy.kind === "FIXED") {
@@ -281,6 +300,7 @@ function validateDiscountPolicy(policy) {
         );
       }
     }
+    validateDuration(policy.duration);
     return;
   }
   throw new InvalidDiscountPolicyError(
@@ -353,6 +373,27 @@ function extractPolicyCurrency(policy) {
   if (policy.kind === "PERCENT") return policy.currency;
   return void 0;
 }
+function validateDuration(duration) {
+  if (duration === void 0) return;
+  if (!duration || typeof duration !== "object") {
+    throw new InvalidDiscountPolicyError("duration must be an object");
+  }
+  const kind = duration.kind;
+  if (kind === "ONCE" || kind === "FOREVER") return;
+  if (kind === "REPEATING") {
+    const months = duration.months;
+    if (typeof months !== "number" || !Number.isInteger(months) || months < 1 || months > LIMITS.DURATION_MAX_MONTHS) {
+      throw new InvalidDiscountPolicyError(
+        `duration.months must be an integer in [1, ${LIMITS.DURATION_MAX_MONTHS}] (got ${String(months)})`
+      );
+    }
+    return;
+  }
+  throw new InvalidDiscountPolicyError(`unknown duration kind: ${String(kind)}`);
+}
+function resolveDuration(policy) {
+  return policy.duration ?? { kind: "ONCE" };
+}
 
 // src/eligibility.ts
 function checkEligibility(input) {
@@ -570,6 +611,15 @@ function assertIdentifier(kind, key, value) {
   }
   return value;
 }
+function resolveSchemaName(schema) {
+  if (schema === void 0) return void 0;
+  if (typeof schema !== "string" || !IDENTIFIER_RE.test(schema)) {
+    throw new InvalidModelNameError(
+      `Invalid schema name: ${JSON.stringify(schema)}. Expected a plain identifier matching ${IDENTIFIER_RE.source}.`
+    );
+  }
+  return schema;
+}
 function resolveModelNames(overrides) {
   const out = { ...DEFAULT_MODEL_NAMES };
   for (const key of MODEL_KEYS) {
@@ -596,19 +646,21 @@ function pick(db, key, name) {
   }
   return delegate;
 }
-function createDelegateResolver(models, tables) {
+function createDelegateResolver(models, tables, schema) {
   const resolver = {
     models,
-    tables
+    tables,
+    schema
   };
   for (const key of MODEL_KEYS) {
     resolver[key] = (db) => pick(db, key, models[key]);
   }
   return resolver;
 }
-function lockCouponRow(tx, table, couponId, tenantId) {
+function lockCouponRow(tx, table, couponId, tenantId, schema) {
+  const target = schema ? `"${schema}"."${table}"` : `"${table}"`;
   const parts = [
-    `SELECT * FROM "${table}" WHERE "id" = `,
+    `SELECT * FROM ${target} WHERE "id" = `,
     ` AND "tenantId" = `,
     ` FOR UPDATE`
   ];
@@ -617,6 +669,40 @@ function lockCouponRow(tx, table, couponId, tenantId) {
   });
   return tx.$queryRaw(strings, couponId, tenantId);
 }
+function assertOptionalString(name, value, max) {
+  if (value === void 0 || value === null) return;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new ValidationError(`${name} must be a non-empty string`);
+  }
+  if (value.length > max) {
+    throw new ValidationError(`${name} length exceeds max (${max})`);
+  }
+}
+function assertRequiredString(name, value, max) {
+  if (value === void 0 || value === null) {
+    throw new ValidationError(`${name} is required`);
+  }
+  assertOptionalString(name, value, max);
+}
+function assertContext(context) {
+  if (context === void 0 || context === null) return;
+  if (typeof context !== "object" || Array.isArray(context)) {
+    throw new ValidationError("context must be a plain object");
+  }
+  const c = context;
+  assertOptionalString("context.plan", c.plan, LIMITS.CONTEXT_VALUE_MAX_LENGTH);
+  assertOptionalString("context.productId", c.productId, LIMITS.CONTEXT_VALUE_MAX_LENGTH);
+  assertOptionalString("context.categoryId", c.categoryId, LIMITS.CONTEXT_VALUE_MAX_LENGTH);
+}
+function assertCouponStatus(status) {
+  if (status === void 0) return;
+  const allowed = Object.values(COUPON_STATUS);
+  if (typeof status !== "string" || !allowed.includes(status)) {
+    throw new ValidationError(
+      `status must be one of ${allowed.join(", ")}`
+    );
+  }
+}
 function assertTenantId(value) {
   if (typeof value !== "string" || value.length === 0) {
     throw new ValidationError("tenantId is required");
@@ -678,6 +764,17 @@ function assertMetadata(meta) {
       );
     }
   }
+  let serialized;
+  try {
+    serialized = JSON.stringify(rec);
+  } catch {
+    throw new ValidationError("metadata must be JSON-serializable");
+  }
+  if (Buffer.byteLength(serialized, "utf8") > LIMITS.METADATA_MAX_BYTES) {
+    throw new ValidationError(
+      `metadata exceeds max size (${LIMITS.METADATA_MAX_BYTES} bytes)`
+    );
+  }
   return rec;
 }
 function assertPaginationLimit(limit) {
@@ -729,6 +826,16 @@ function assertEligibility(rules) {
         `eligibility.${key} must be an array of non-empty strings`
       );
     }
+    if (v.length > LIMITS.ELIGIBILITY_MAX_ENTRIES) {
+      throw new ValidationError(
+        `eligibility.${key} exceeds max entries (${LIMITS.ELIGIBILITY_MAX_ENTRIES})`
+      );
+    }
+    if (v.some((x) => x.length > LIMITS.ELIGIBILITY_ENTRY_MAX_LENGTH)) {
+      throw new ValidationError(
+        `eligibility.${key} entry exceeds max length (${LIMITS.ELIGIBILITY_ENTRY_MAX_LENGTH})`
+      );
+    }
     out[key] = v;
   }
   return out;
@@ -745,6 +852,9 @@ function validateCreateCouponInput(input) {
   validateDiscountPolicy(input.discount);
   assertDateRange(input.startsAt ?? null, input.endsAt ?? null);
   assertMetadata(input.metadata);
+  assertCouponStatus(input.status);
+  assertOptionalString("campaignId", input.campaignId, LIMITS.ID_MAX_LENGTH);
+  assertOptionalString("actorId", input.actorId, LIMITS.USER_ID_MAX_LENGTH);
   if (input.maxRedemptions !== void 0 && input.maxRedemptions !== null) {
     if (typeof input.maxRedemptions !== "number" || !Number.isInteger(input.maxRedemptions) || input.maxRedemptions <= 0) {
       throw new ValidationError("maxRedemptions must be a positive integer or null");
@@ -780,14 +890,16 @@ function validateIssueBulkInput(input) {
   validateDiscountPolicy(input.discount);
   assertDateRange(input.startsAt ?? null, input.endsAt ?? null);
   assertMetadata(input.metadata);
+  assertOptionalString("campaignId", input.campaignId, LIMITS.ID_MAX_LENGTH);
+  assertOptionalString("actorId", input.actorId, LIMITS.USER_ID_MAX_LENGTH);
 }
 function validateIssueCouponInput(input) {
   if (!input || typeof input !== "object") {
     throw new ValidationError("input must be an object");
   }
-  if (typeof input.couponId !== "string" || input.couponId.length === 0) {
-    throw new ValidationError("couponId is required");
-  }
+  assertRequiredString("couponId", input.couponId, LIMITS.ID_MAX_LENGTH);
+  assertOptionalString("issuedToUserId", input.issuedToUserId, LIMITS.USER_ID_MAX_LENGTH);
+  assertOptionalString("issuedBy", input.issuedBy, LIMITS.USER_ID_MAX_LENGTH);
   assertMetadata(input.metadata);
 }
 function validateValidateInput(input) {
@@ -797,6 +909,8 @@ function validateValidateInput(input) {
   if (typeof input.code !== "string" || input.code.length === 0) {
     throw new ValidationError("code is required");
   }
+  assertOptionalString("userId", input.userId, LIMITS.USER_ID_MAX_LENGTH);
+  assertContext(input.context);
   if (input.subtotal !== void 0) {
     if (typeof input.subtotal !== "number" || !Number.isInteger(input.subtotal) || input.subtotal < 0) {
       throw new ValidationError("subtotal must be a non-negative integer");
@@ -817,6 +931,9 @@ function validateRedeemInput(input) {
     throw new ValidationError("subtotal must be a non-negative integer");
   }
   assertCurrency(input.currency);
+  assertOptionalString("userId", input.userId, LIMITS.USER_ID_MAX_LENGTH);
+  assertOptionalString("orderRef", input.orderRef, LIMITS.ORDER_REF_MAX_LENGTH);
+  assertContext(input.context);
   assertMetadata(input.metadata);
 }
 function validateCreateCampaignInput(input) {
@@ -834,6 +951,7 @@ function validateCreateCampaignInput(input) {
   validateDiscountPolicy(input.discount);
   assertDateRange(input.startsAt ?? null, input.endsAt ?? null);
   assertMetadata(input.metadata);
+  assertOptionalString("actorId", input.actorId, LIMITS.USER_ID_MAX_LENGTH);
   if (input.maxCoupons !== void 0 && input.maxCoupons !== null) {
     if (typeof input.maxCoupons !== "number" || !Number.isInteger(input.maxCoupons) || input.maxCoupons <= 0) {
       throw new ValidationError(
@@ -847,19 +965,29 @@ function validateCreateCampaignInput(input) {
     }
   }
 }
+var discountDurationSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({ kind: zod.z.literal("ONCE") }),
+  zod.z.object({
+    kind: zod.z.literal("REPEATING"),
+    months: zod.z.number().int().min(1).max(LIMITS.DURATION_MAX_MONTHS)
+  }),
+  zod.z.object({ kind: zod.z.literal("FOREVER") })
+]);
 zod.z.discriminatedUnion("kind", [
   zod.z.object({
     kind: zod.z.literal("PERCENT"),
     percent: zod.z.number().gt(0).lte(100),
     maxDiscount: zod.z.number().int().nonnegative().optional(),
     minOrder: zod.z.number().int().nonnegative().optional(),
-    currency: zod.z.string().length(3).optional()
+    currency: zod.z.string().length(3).optional(),
+    duration: discountDurationSchema.optional()
   }),
   zod.z.object({
     kind: zod.z.literal("FIXED"),
     amount: zod.z.number().int().positive(),
     currency: zod.z.string().length(3),
-    minOrder: zod.z.number().int().nonnegative().optional()
+    minOrder: zod.z.number().int().nonnegative().optional(),
+    duration: discountDurationSchema.optional()
   })
 ]);
 
@@ -867,6 +995,9 @@ zod.z.discriminatedUnion("kind", [
 function w(v) {
   return v;
 }
+function isUniqueViolation(err) {
+  return typeof err === "object" && err !== null && err.code === "P2002";
+}
 var NOOP_LOGGER = {
   debug() {
   },
@@ -899,7 +1030,8 @@ function resolveConfig(config) {
     // allow-now: default fallback when config.now is omitted
     logger: config.logger ?? NOOP_LOGGER,
     models,
-    tables: resolveTableNames(models, config.tables)
+    tables: resolveTableNames(models, config.tables),
+    schema: resolveSchemaName(config.schema)
   };
 }
 async function safeEmit(handler, logger, event) {
@@ -912,6 +1044,13 @@ async function safeEmit(handler, logger, event) {
     });
   }
 }
+function assertUserIdForPerUserLimit(userId) {
+  if (typeof userId !== "string" || userId.length === 0) {
+    throw new ValidationError(
+      "userId is required: this coupon enforces maxRedemptionsPerUser"
+    );
+  }
+}
 async function resolveLazyStatus(delegates, tx, coupon, now) {
   if (coupon.status === COUPON_STATUS.ARCHIVED) {
     return { kind: "reject", reason: "ARCHIVED", coupon };
@@ -970,7 +1109,7 @@ function withIdTieBreak(orderBy) {
 function createCouponClient(config) {
   const cfg = resolveConfig(config);
   const prisma = cfg.prisma;
-  const delegates = createDelegateResolver(cfg.models, cfg.tables);
+  const delegates = createDelegateResolver(cfg.models, cfg.tables, cfg.schema);
   const tid = (v) => resolveTenantId(v, cfg.defaultTenantId);
   async function paginate(delegate, where, limit, cursor, mapFn, orderBy = { createdAt: "desc" }) {
     const take = limit + 1;
@@ -1003,20 +1142,21 @@ function createCouponClient(config) {
         const created = await delegates.coupon(tx).create({ data: row });
         return rowToCoupon(created);
       } catch (err) {
+        if (!isUniqueViolation(err)) throw err;
         lastError = err;
         if (baseCode) {
           throw new ValidationError(
             `coupon code already exists in tenant`,
-            { prismaError: err instanceof Error ? err.message : String(err) },
-            { tenantId, couponCode: baseCode }
+            void 0,
+            { tenantId, couponCode: baseCode, cause: err }
           );
         }
       }
     }
     throw new ValidationError(
       `failed to create coupon after ${maxAttempts} attempts (unique code collision)`,
-      { lastError: lastError instanceof Error ? lastError.message : String(lastError) },
-      { tenantId }
+      void 0,
+      { tenantId, cause: lastError }
     );
   }
   const coupons = {
@@ -1121,15 +1261,25 @@ function createCouponClient(config) {
       let skipped = 0;
       let totalAttempts = 0;
       await prisma.$transaction(async (tx) => {
+        const seen = /* @__PURE__ */ new Set();
         for (let i = 0; i < input.count; i++) {
           let placed = null;
           for (let attempt = 1; attempt <= maxAttempts; attempt++) {
             totalAttempts++;
-            const code = cfg.codeGenerator({ length: codeLength });
+            const canonical = canonicalizeCode(
+              cfg.codeGenerator({ length: codeLength })
+            );
+            const collided = seen.has(canonical) || await delegates.coupon(tx).findFirst({
+              where: { tenantId, code: canonical },
+              select: { id: true }
+            }) !== null;
+            if (collided) {
+              if (attempt === maxAttempts) skipped++;
+              continue;
+            }
+            let row;
             try {
-              sanitizeCode(code);
-              const canonical = canonicalizeCode(code);
-              const row = await delegates.coupon(tx).create({
+              row = await delegates.coupon(tx).create({
                 data: {
                   id: cfg.idGenerator(),
                   tenantId,
@@ -1145,13 +1295,17 @@ function createCouponClient(config) {
                   metadata: w(metadata ?? null)
                 }
               });
-              placed = rowToCoupon(row);
-              break;
             } catch (err) {
-              if (attempt === maxAttempts) {
-                skipped++;
-              }
+              if (!isUniqueViolation(err)) throw err;
+              throw new ValidationError(
+                "bulk issuance aborted: coupon code collided with a concurrent insert",
+                void 0,
+                { tenantId, couponCode: canonical, cause: err }
+              );
             }
+            seen.add(canonical);
+            placed = rowToCoupon(row);
+            break;
           }
           if (placed) {
             created.push(placed);
@@ -1244,9 +1398,7 @@ function createCouponClient(config) {
     },
     async get(args) {
       const tenantId = tid(args.tenantId);
-      if (!args.id || typeof args.id !== "string") {
-        throw new ValidationError("id is required");
-      }
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
       const row = await delegates.coupon(prisma).findFirst({
         where: { id: args.id, tenantId }
       });
@@ -1255,6 +1407,8 @@ function createCouponClient(config) {
     async list(args) {
       const tenantId = tid(args.tenantId);
       const limit = assertPaginationLimit(args.limit);
+      assertOptionalString("cursor", args.cursor, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("campaignId", args.campaignId, LIMITS.ID_MAX_LENGTH);
       const where = { tenantId };
       if (args.campaignId) where.campaignId = args.campaignId;
       if (args.status) where.status = args.status;
@@ -1269,6 +1423,8 @@ function createCouponClient(config) {
     },
     async pause(args) {
       const tenantId = tid(args.tenantId);
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("actorId", args.actorId, LIMITS.USER_ID_MAX_LENGTH);
       const now = cfg.now();
       const coupon = await prisma.$transaction(async (tx) => {
         const row = await delegates.coupon(tx).findFirst({
@@ -1302,6 +1458,8 @@ function createCouponClient(config) {
     },
     async resume(args) {
       const tenantId = tid(args.tenantId);
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("actorId", args.actorId, LIMITS.USER_ID_MAX_LENGTH);
       const now = cfg.now();
       const coupon = await prisma.$transaction(async (tx) => {
         const row = await delegates.coupon(tx).findFirst({
@@ -1335,6 +1493,8 @@ function createCouponClient(config) {
     },
     async archive(args) {
       const tenantId = tid(args.tenantId);
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("actorId", args.actorId, LIMITS.USER_ID_MAX_LENGTH);
       const now = cfg.now();
       const coupon = await prisma.$transaction(async (tx) => {
         const row = await delegates.coupon(tx).findFirst({
@@ -1392,7 +1552,8 @@ function createCouponClient(config) {
       if (!elig.ok) {
         return { ok: false, reason: elig.reason };
       }
-      if (coupon.maxRedemptionsPerUser !== null && input.userId) {
+      if (coupon.maxRedemptionsPerUser !== null) {
+        assertUserIdForPerUserLimit(input.userId);
         const count = await delegates.couponRedemption(tx).count({
           where: {
             tenantId,
@@ -1434,7 +1595,8 @@ function createCouponClient(config) {
       tx,
       delegates.tables.coupon,
       couponId,
-      tenantId
+      tenantId,
+      delegates.schema
     );
     if (!Array.isArray(locked) || locked.length === 0) {
       throw new CouponNotFoundError("Coupon not found", { tenantId, couponId });
@@ -1476,7 +1638,8 @@ function createCouponClient(config) {
     if (!elig.ok) {
       throw eligibilityReasonToError(elig.reason);
     }
-    if (coupon.maxRedemptionsPerUser !== null && input.userId) {
+    if (coupon.maxRedemptionsPerUser !== null) {
+      assertUserIdForPerUserLimit(input.userId);
       const userCount = await delegates.couponRedemption(tx).count({
         where: {
           tenantId,
@@ -1550,6 +1713,7 @@ function createCouponClient(config) {
       });
       redemption = rowToRedemption(inserted);
     } catch (err) {
+      if (!isUniqueViolation(err)) throw err;
       throw new CouponAlreadyRedeemedError(void 0, {
         tenantId,
         couponId: coupon.id,
@@ -1557,7 +1721,7 @@ function createCouponClient(config) {
         cause: err
       });
     }
-    if (coupon.maxRedemptionsPerUser !== null && input.userId) {
+    if (coupon.maxRedemptionsPerUser !== null) {
       const userCountFinal = await delegates.couponRedemption(tx).count({
         where: {
           tenantId,
@@ -1657,20 +1821,30 @@ function createCouponClient(config) {
       const metadata = assertMetadata(input.metadata);
       const now = cfg.now();
       const campaign = await prisma.$transaction(async (tx) => {
-        const row = await delegates.campaign(tx).create({
-          data: {
-            id: cfg.idGenerator(),
-            tenantId,
-            name: input.name,
-            status: CAMPAIGN_STATUS.ACTIVE,
-            discount: w(input.discount),
-            eligibility: w(eligibility),
-            startsAt: input.startsAt ?? null,
-            endsAt: input.endsAt ?? null,
-            maxCoupons: input.maxCoupons ?? null,
-            metadata: w(metadata ?? null)
-          }
-        });
+        let row;
+        try {
+          row = await delegates.campaign(tx).create({
+            data: {
+              id: cfg.idGenerator(),
+              tenantId,
+              name: input.name,
+              status: CAMPAIGN_STATUS.ACTIVE,
+              discount: w(input.discount),
+              eligibility: w(eligibility),
+              startsAt: input.startsAt ?? null,
+              endsAt: input.endsAt ?? null,
+              maxCoupons: input.maxCoupons ?? null,
+              metadata: w(metadata ?? null)
+            }
+          });
+        } catch (err) {
+          if (!isUniqueViolation(err)) throw err;
+          throw new ValidationError(
+            "campaign name already exists in tenant",
+            void 0,
+            { tenantId, cause: err }
+          );
+        }
         const campaign2 = rowToCampaign(row);
         await writeAudit(delegates.couponAuditLog(tx), {
           tenantId,
@@ -1692,7 +1866,7 @@ function createCouponClient(config) {
     },
     async get(args) {
       const tenantId = tid(args.tenantId);
-      if (!args.id) throw new ValidationError("id is required");
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
       const row = await delegates.campaign(prisma).findFirst({
         where: { id: args.id, tenantId }
       });
@@ -1701,6 +1875,7 @@ function createCouponClient(config) {
     async list(args) {
       const tenantId = tid(args.tenantId);
       const limit = assertPaginationLimit(args.limit);
+      assertOptionalString("cursor", args.cursor, LIMITS.ID_MAX_LENGTH);
       const where = { tenantId };
       if (args.status) where.status = args.status;
       return paginate(
@@ -1714,9 +1889,8 @@ function createCouponClient(config) {
     },
     async issue(args) {
       if (!args || typeof args !== "object") throw new ValidationError("args required");
-      if (typeof args.campaignId !== "string" || !args.campaignId) {
-        throw new ValidationError("campaignId is required");
-      }
+      assertRequiredString("campaignId", args.campaignId, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("actorId", args.actorId, LIMITS.USER_ID_MAX_LENGTH);
       if (typeof args.count !== "number" || !Number.isInteger(args.count) || args.count <= 0 || args.count > LIMITS.BULK_MAX_COUNT) {
         throw new ValidationError(
           `count must be a positive integer <= ${LIMITS.BULK_MAX_COUNT}`
@@ -1746,12 +1920,14 @@ function createCouponClient(config) {
         endsAt: campaign.endsAt,
         maxAttempts: args.maxAttempts,
         eligibility: campaign.eligibility,
+        maxRedemptions: args.maxRedemptions,
+        maxRedemptionsPerUser: args.maxRedemptionsPerUser,
         actorId: args.actorId
       });
     },
     async summary(args) {
       const tenantId = tid(args.tenantId);
-      if (!args.id) throw new ValidationError("id is required");
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
       const campRow = await delegates.campaign(prisma).findFirst({
         where: { id: args.id, tenantId }
       });
@@ -1804,7 +1980,8 @@ function createCouponClient(config) {
     },
     async close(args) {
       const tenantId = tid(args.tenantId);
-      if (!args.id) throw new ValidationError("id is required");
+      assertRequiredString("id", args.id, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("actorId", args.actorId, LIMITS.USER_ID_MAX_LENGTH);
       const now = cfg.now();
       const campaign = await prisma.$transaction(async (tx) => {
         const row = await delegates.campaign(tx).findFirst({
@@ -1842,6 +2019,9 @@ function createCouponClient(config) {
     async listIssuances(args) {
       const tenantId = tid(args.tenantId);
       const limit = assertPaginationLimit(args.limit);
+      assertOptionalString("cursor", args.cursor, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("couponId", args.couponId, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("issuedToUserId", args.issuedToUserId, LIMITS.USER_ID_MAX_LENGTH);
       const where = { tenantId };
       if (args.couponId) where.couponId = args.couponId;
       if (args.issuedToUserId) where.issuedToUserId = args.issuedToUserId;
@@ -1857,6 +2037,9 @@ function createCouponClient(config) {
     async listRedemptions(args) {
       const tenantId = tid(args.tenantId);
       const limit = assertPaginationLimit(args.limit);
+      assertOptionalString("cursor", args.cursor, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("couponId", args.couponId, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("redeemedByUserId", args.redeemedByUserId, LIMITS.USER_ID_MAX_LENGTH);
       const where = { tenantId };
       if (args.couponId) where.couponId = args.couponId;
       if (args.redeemedByUserId) where.redeemedByUserId = args.redeemedByUserId;
@@ -1872,6 +2055,8 @@ function createCouponClient(config) {
     async listLogs(args) {
       const tenantId = tid(args.tenantId);
       const limit = assertPaginationLimit(args.limit);
+      assertOptionalString("cursor", args.cursor, LIMITS.ID_MAX_LENGTH);
+      assertOptionalString("resourceId", args.resourceId, LIMITS.ID_MAX_LENGTH);
       const where = { tenantId };
       if (args.action) where.action = args.action;
       if (args.resourceId) where.resourceId = args.resourceId;
@@ -1925,4 +2110,5 @@ exports.TenantMismatchError = TenantMismatchError;
 exports.ValidationError = ValidationError;
 exports.calculateDiscount = calculate;
 exports.createCouponClient = createCouponClient;
+exports.resolveDuration = resolveDuration;
 exports.validateDiscountPolicy = validateDiscountPolicy;