autumn-js 1.2.26 → 1.2.28

package/dist/backend/core/index.mjs

@@ -2,28 +2,28 @@ import "../chunk-WYDGEDEU.mjs";
 import "../chunk-VXND2UDT.mjs";
 import {
   handleRouteByName
-} from "../chunk-LJZUMUU3.mjs";
+} from "../chunk-66OVIMBS.mjs";
 import {
   createCoreHandler
-} from "../chunk-ZVZEA5YL.mjs";
-import "../chunk-UCGI7CYU.mjs";
-import "../chunk-55C2WWXQ.mjs";
-import "../chunk-TBQ27LIK.mjs";
-import "../chunk-J44WR3QZ.mjs";
+} from "../chunk-RBV55GF7.mjs";
 import "../chunk-TSF4YCUO.mjs";
 import {
   buildRouter
 } from "../chunk-UAR3TMWI.mjs";
+import "../chunk-GTZJYVV6.mjs";
 import {
   routeConfigs
-} from "../chunk-MAU6WWTL.mjs";
+} from "../chunk-W6NPZLA5.mjs";
+import "../chunk-IXUCY7AU.mjs";
 import "../chunk-OTXV5FY7.mjs";
+import {
+  sanitizeBody
+} from "../chunk-I7CD6EB6.mjs";
 import {
   secretKeyCheck
 } from "../chunk-VZIMT7AO.mjs";
-import {
-  sanitizeBody
-} from "../chunk-Z6QP3YEA.mjs";
+import "../chunk-TBQ27LIK.mjs";
+import "../chunk-J44WR3QZ.mjs";
 import {
   backendError,
   backendSuccess,

package/dist/backend/core/routes/index.d.mts

@@ -1,7 +1,8 @@
 export { RouteMatch, buildRouter } from './routeBuilder.mjs';
 export { routeConfigs } from './routeConfigs.mjs';
 import 'rou3';
-import '../../routeTypes-BcR8yEXe.mjs';
-import '../../authTypes-B7b2mex1.mjs';
+import '../../routeTypes-924R85Bn.mjs';
+import '../../authTypes-CxFcWXh3.mjs';
 import 'zod/v4';
+import '../utils/sanitizeBody.mjs';
 import '../types/responseTypes.mjs';

package/dist/backend/core/routes/index.d.ts

@@ -1,7 +1,8 @@
 export { RouteMatch, buildRouter } from './routeBuilder.js';
 export { routeConfigs } from './routeConfigs.js';
 import 'rou3';
-import '../../routeTypes-CXj2d3BE.js';
-import '../../authTypes-B7b2mex1.js';
+import '../../routeTypes-Db2ZFQC4.js';
+import '../../authTypes-CxFcWXh3.js';
 import 'zod/v4';
+import '../utils/sanitizeBody.js';
 import '../types/responseTypes.js';

package/dist/backend/core/routes/index.js

@@ -130,7 +130,9 @@ var attachAddItemTierSchema = import_v42.z.object({
 var attachInvoiceModeSchema = import_v42.z.object({
   enabled: import_v42.z.boolean(),
   enablePlanImmediately: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional(),
-  finalize: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional()
+  finalize: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional(),
+  invoiceTemplateId: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
+  netTermsDays: import_v42.z.union([import_v42.z.number(), import_v42.z.undefined()]).optional()
 });
 var attachAttachDiscountSchema = import_v42.z.object({
   rewardId: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
@@ -264,7 +266,9 @@ var attachCustomizeOutboundSchema = import_v42.z.object({
 var attachInvoiceModeOutboundSchema = import_v42.z.object({
   enabled: import_v42.z.boolean(),
   enable_plan_immediately: import_v42.z.boolean(),
-  finalize: import_v42.z.boolean()
+  finalize: import_v42.z.boolean(),
+  invoice_template_id: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
+  net_terms_days: import_v42.z.union([import_v42.z.number(), import_v42.z.undefined()]).optional()
 });
 var attachAttachDiscountOutboundSchema = import_v42.z.object({
   reward_id: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
@@ -820,7 +824,9 @@ var multiAttachFeatureQuantitySchema = import_v47.z.object({
 var multiAttachInvoiceModeSchema = import_v47.z.object({
   enabled: import_v47.z.boolean(),
   enablePlanImmediately: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional(),
-  finalize: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional()
+  finalize: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional(),
+  invoiceTemplateId: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
+  netTermsDays: import_v47.z.union([import_v47.z.number(), import_v47.z.undefined()]).optional()
 });
 var multiAttachAttachDiscountSchema = import_v47.z.object({
   rewardId: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
@@ -911,7 +917,9 @@ var multiAttachFreeTrialParamsOutboundSchema = import_v47.z.object({
 var multiAttachInvoiceModeOutboundSchema = import_v47.z.object({
   enabled: import_v47.z.boolean(),
   enable_plan_immediately: import_v47.z.boolean(),
-  finalize: import_v47.z.boolean()
+  finalize: import_v47.z.boolean(),
+  invoice_template_id: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
+  net_terms_days: import_v47.z.union([import_v47.z.number(), import_v47.z.undefined()]).optional()
 });
 var multiAttachAttachDiscountOutboundSchema = import_v47.z.object({
   reward_id: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
@@ -1119,7 +1127,9 @@ var previewAttachAddItemTierSchema = import_v49.z.object({
 var previewAttachInvoiceModeSchema = import_v49.z.object({
   enabled: import_v49.z.boolean(),
   enablePlanImmediately: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional(),
-  finalize: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional()
+  finalize: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional(),
+  invoiceTemplateId: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
+  netTermsDays: import_v49.z.union([import_v49.z.number(), import_v49.z.undefined()]).optional()
 });
 var previewAttachAttachDiscountSchema = import_v49.z.object({
   rewardId: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
@@ -1323,7 +1333,9 @@ var previewAttachCustomizeOutboundSchema = import_v49.z.object({
 var previewAttachInvoiceModeOutboundSchema = import_v49.z.object({
   enabled: import_v49.z.boolean(),
   enable_plan_immediately: import_v49.z.boolean(),
-  finalize: import_v49.z.boolean()
+  finalize: import_v49.z.boolean(),
+  invoice_template_id: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
+  net_terms_days: import_v49.z.union([import_v49.z.number(), import_v49.z.undefined()]).optional()
 });
 var previewAttachAttachDiscountOutboundSchema = import_v49.z.object({
   reward_id: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
@@ -1574,7 +1586,9 @@ var previewMultiAttachPlanFeatureQuantitySchema = import_v410.z.object({
 var previewMultiAttachInvoiceModeSchema = import_v410.z.object({
   enabled: import_v410.z.boolean(),
   enablePlanImmediately: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional(),
-  finalize: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional()
+  finalize: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional(),
+  invoiceTemplateId: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
+  netTermsDays: import_v410.z.union([import_v410.z.number(), import_v410.z.undefined()]).optional()
 });
 var previewMultiAttachAttachDiscountSchema = import_v410.z.object({
   rewardId: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
@@ -1735,7 +1749,9 @@ var previewMultiAttachFreeTrialParamsOutboundSchema = import_v410.z.object({
 var previewMultiAttachInvoiceModeOutboundSchema = import_v410.z.object({
   enabled: import_v410.z.boolean(),
   enable_plan_immediately: import_v410.z.boolean(),
-  finalize: import_v410.z.boolean()
+  finalize: import_v410.z.boolean(),
+  invoice_template_id: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
+  net_terms_days: import_v410.z.union([import_v410.z.number(), import_v410.z.undefined()]).optional()
 });
 var previewMultiAttachAttachDiscountOutboundSchema = import_v410.z.object({
   reward_id: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
@@ -1961,7 +1977,9 @@ var previewUpdateAddItemTierSchema = import_v411.z.object({
 var previewUpdateInvoiceModeSchema = import_v411.z.object({
   enabled: import_v411.z.boolean(),
   enablePlanImmediately: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional(),
-  finalize: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional()
+  finalize: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional(),
+  invoiceTemplateId: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
+  netTermsDays: import_v411.z.union([import_v411.z.number(), import_v411.z.undefined()]).optional()
 });
 var previewUpdateAttachDiscountSchema = import_v411.z.object({
   rewardId: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
@@ -2156,7 +2174,9 @@ var previewUpdateCustomizeOutboundSchema = import_v411.z.object({
 var previewUpdateInvoiceModeOutboundSchema = import_v411.z.object({
   enabled: import_v411.z.boolean(),
   enable_plan_immediately: import_v411.z.boolean(),
-  finalize: import_v411.z.boolean()
+  finalize: import_v411.z.boolean(),
+  invoice_template_id: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
+  net_terms_days: import_v411.z.union([import_v411.z.number(), import_v411.z.undefined()]).optional()
 });
 var previewUpdateAttachDiscountOutboundSchema = import_v411.z.object({
   reward_id: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
@@ -2730,7 +2750,9 @@ var billingUpdateAddItemTierSchema = import_v414.z.object({
 var billingUpdateInvoiceModeSchema = import_v414.z.object({
   enabled: import_v414.z.boolean(),
   enablePlanImmediately: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional(),
-  finalize: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional()
+  finalize: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional(),
+  invoiceTemplateId: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
+  netTermsDays: import_v414.z.union([import_v414.z.number(), import_v414.z.undefined()]).optional()
 });
 var billingUpdateAttachDiscountSchema = import_v414.z.object({
   rewardId: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
@@ -2861,7 +2883,9 @@ var billingUpdateCustomizeOutboundSchema = import_v414.z.object({
 var billingUpdateInvoiceModeOutboundSchema = import_v414.z.object({
   enabled: import_v414.z.boolean(),
   enable_plan_immediately: import_v414.z.boolean(),
-  finalize: import_v414.z.boolean()
+  finalize: import_v414.z.boolean(),
+  invoice_template_id: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
+  net_terms_days: import_v414.z.union([import_v414.z.number(), import_v414.z.undefined()]).optional()
 });
 var billingUpdateAttachDiscountOutboundSchema = import_v414.z.object({
   reward_id: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
@@ -3055,18 +3079,22 @@ var backendError = ({
 };
 
 // src/backend/core/utils/sanitizeBody.ts
-var PROTECTED_FIELDS = [
+var DEFAULT_PROTECTED_BODY_FIELDS = [
   "customerId",
+  "customerData",
   "name",
   "email",
-  "metadata",
   "stripeId"
 ];
-var sanitizeBody = (body) => {
+var CUSTOMER_PROTECTED_BODY_FIELDS = [
+  ...DEFAULT_PROTECTED_BODY_FIELDS,
+  "metadata"
+];
+var sanitizeBody = (body, protectedFields = DEFAULT_PROTECTED_BODY_FIELDS) => {
   const rawBody = body || {};
   const sanitized = {};
   for (const [key, value] of Object.entries(rawBody)) {
-    if (!PROTECTED_FIELDS.includes(key)) {
+    if (!protectedFields.includes(key)) {
       sanitized[key] = value;
     }
   }
@@ -3088,8 +3116,9 @@ var routeConfigs = [
       // expand: z.array(z.enum(CustomerExpand)).optional(),
       expand: import_v415.z.array(import_v415.z.string()).optional()
     }),
+    protectedBodyFields: CUSTOMER_PROTECTED_BODY_FIELDS,
     customHandler: async ({ autumn, identity, body }) => {
-      const sanitizedBody = sanitizeBody(body);
+      const sanitizedBody = sanitizeBody(body, CUSTOMER_PROTECTED_BODY_FIELDS);
       if (!identity?.customerId && sanitizedBody.errorOnNotFound === false) {
         return backendSuccess({ statusCode: 204, body: null });
       }

package/dist/backend/core/routes/index.mjs

@@ -4,10 +4,10 @@ import {
 } from "../../chunk-UAR3TMWI.mjs";
 import {
   routeConfigs
-} from "../../chunk-MAU6WWTL.mjs";
+} from "../../chunk-W6NPZLA5.mjs";
 import "../../chunk-OTXV5FY7.mjs";
+import "../../chunk-I7CD6EB6.mjs";
 import "../../chunk-VZIMT7AO.mjs";
-import "../../chunk-Z6QP3YEA.mjs";
 import "../../chunk-N7NFYY54.mjs";
 export {
   buildRouter,

package/dist/backend/core/routes/routeBuilder.d.mts

@@ -1,7 +1,8 @@
 import { RouterContext } from 'rou3';
-import { R as RouteDefinition } from '../../routeTypes-BcR8yEXe.mjs';
-import '../../authTypes-B7b2mex1.mjs';
+import { b as RouteDefinition } from '../../routeTypes-924R85Bn.mjs';
+import '../../authTypes-CxFcWXh3.mjs';
 import 'zod/v4';
+import '../utils/sanitizeBody.mjs';
 import '../types/responseTypes.mjs';
 
 type RouteMatch = {

package/dist/backend/core/routes/routeBuilder.d.ts

@@ -1,7 +1,8 @@
 import { RouterContext } from 'rou3';
-import { R as RouteDefinition } from '../../routeTypes-CXj2d3BE.js';
-import '../../authTypes-B7b2mex1.js';
+import { b as RouteDefinition } from '../../routeTypes-Db2ZFQC4.js';
+import '../../authTypes-CxFcWXh3.js';
 import 'zod/v4';
+import '../utils/sanitizeBody.js';
 import '../types/responseTypes.js';
 
 type RouteMatch = {

package/dist/backend/core/routes/routeConfigs.d.mts

@@ -1,6 +1,7 @@
-import { R as RouteDefinition, b as RouteName } from '../../routeTypes-BcR8yEXe.mjs';
-import '../../authTypes-B7b2mex1.mjs';
+import { b as RouteDefinition, c as RouteName } from '../../routeTypes-924R85Bn.mjs';
+import '../../authTypes-CxFcWXh3.mjs';
 import 'zod/v4';
+import '../utils/sanitizeBody.mjs';
 import '../types/responseTypes.mjs';
 
 /** Route configurations for autumn-js backend */

package/dist/backend/core/routes/routeConfigs.d.ts

@@ -1,6 +1,7 @@
-import { R as RouteDefinition, b as RouteName } from '../../routeTypes-CXj2d3BE.js';
-import '../../authTypes-B7b2mex1.js';
+import { b as RouteDefinition, c as RouteName } from '../../routeTypes-Db2ZFQC4.js';
+import '../../authTypes-CxFcWXh3.js';
 import 'zod/v4';
+import '../utils/sanitizeBody.js';
 import '../types/responseTypes.js';
 
 /** Route configurations for autumn-js backend */

package/dist/backend/core/routes/routeConfigs.js

@@ -113,7 +113,9 @@ var attachAddItemTierSchema = import_v42.z.object({
 var attachInvoiceModeSchema = import_v42.z.object({
   enabled: import_v42.z.boolean(),
   enablePlanImmediately: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional(),
-  finalize: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional()
+  finalize: import_v42.z.union([import_v42.z.boolean(), import_v42.z.undefined()]).optional(),
+  invoiceTemplateId: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
+  netTermsDays: import_v42.z.union([import_v42.z.number(), import_v42.z.undefined()]).optional()
 });
 var attachAttachDiscountSchema = import_v42.z.object({
   rewardId: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
@@ -247,7 +249,9 @@ var attachCustomizeOutboundSchema = import_v42.z.object({
 var attachInvoiceModeOutboundSchema = import_v42.z.object({
   enabled: import_v42.z.boolean(),
   enable_plan_immediately: import_v42.z.boolean(),
-  finalize: import_v42.z.boolean()
+  finalize: import_v42.z.boolean(),
+  invoice_template_id: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
+  net_terms_days: import_v42.z.union([import_v42.z.number(), import_v42.z.undefined()]).optional()
 });
 var attachAttachDiscountOutboundSchema = import_v42.z.object({
   reward_id: import_v42.z.union([import_v42.z.string(), import_v42.z.undefined()]).optional(),
@@ -803,7 +807,9 @@ var multiAttachFeatureQuantitySchema = import_v47.z.object({
 var multiAttachInvoiceModeSchema = import_v47.z.object({
   enabled: import_v47.z.boolean(),
   enablePlanImmediately: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional(),
-  finalize: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional()
+  finalize: import_v47.z.union([import_v47.z.boolean(), import_v47.z.undefined()]).optional(),
+  invoiceTemplateId: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
+  netTermsDays: import_v47.z.union([import_v47.z.number(), import_v47.z.undefined()]).optional()
 });
 var multiAttachAttachDiscountSchema = import_v47.z.object({
   rewardId: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
@@ -894,7 +900,9 @@ var multiAttachFreeTrialParamsOutboundSchema = import_v47.z.object({
 var multiAttachInvoiceModeOutboundSchema = import_v47.z.object({
   enabled: import_v47.z.boolean(),
   enable_plan_immediately: import_v47.z.boolean(),
-  finalize: import_v47.z.boolean()
+  finalize: import_v47.z.boolean(),
+  invoice_template_id: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
+  net_terms_days: import_v47.z.union([import_v47.z.number(), import_v47.z.undefined()]).optional()
 });
 var multiAttachAttachDiscountOutboundSchema = import_v47.z.object({
   reward_id: import_v47.z.union([import_v47.z.string(), import_v47.z.undefined()]).optional(),
@@ -1102,7 +1110,9 @@ var previewAttachAddItemTierSchema = import_v49.z.object({
 var previewAttachInvoiceModeSchema = import_v49.z.object({
   enabled: import_v49.z.boolean(),
   enablePlanImmediately: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional(),
-  finalize: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional()
+  finalize: import_v49.z.union([import_v49.z.boolean(), import_v49.z.undefined()]).optional(),
+  invoiceTemplateId: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
+  netTermsDays: import_v49.z.union([import_v49.z.number(), import_v49.z.undefined()]).optional()
 });
 var previewAttachAttachDiscountSchema = import_v49.z.object({
   rewardId: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
@@ -1306,7 +1316,9 @@ var previewAttachCustomizeOutboundSchema = import_v49.z.object({
 var previewAttachInvoiceModeOutboundSchema = import_v49.z.object({
   enabled: import_v49.z.boolean(),
   enable_plan_immediately: import_v49.z.boolean(),
-  finalize: import_v49.z.boolean()
+  finalize: import_v49.z.boolean(),
+  invoice_template_id: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
+  net_terms_days: import_v49.z.union([import_v49.z.number(), import_v49.z.undefined()]).optional()
 });
 var previewAttachAttachDiscountOutboundSchema = import_v49.z.object({
   reward_id: import_v49.z.union([import_v49.z.string(), import_v49.z.undefined()]).optional(),
@@ -1557,7 +1569,9 @@ var previewMultiAttachPlanFeatureQuantitySchema = import_v410.z.object({
 var previewMultiAttachInvoiceModeSchema = import_v410.z.object({
   enabled: import_v410.z.boolean(),
   enablePlanImmediately: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional(),
-  finalize: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional()
+  finalize: import_v410.z.union([import_v410.z.boolean(), import_v410.z.undefined()]).optional(),
+  invoiceTemplateId: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
+  netTermsDays: import_v410.z.union([import_v410.z.number(), import_v410.z.undefined()]).optional()
 });
 var previewMultiAttachAttachDiscountSchema = import_v410.z.object({
   rewardId: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
@@ -1718,7 +1732,9 @@ var previewMultiAttachFreeTrialParamsOutboundSchema = import_v410.z.object({
 var previewMultiAttachInvoiceModeOutboundSchema = import_v410.z.object({
   enabled: import_v410.z.boolean(),
   enable_plan_immediately: import_v410.z.boolean(),
-  finalize: import_v410.z.boolean()
+  finalize: import_v410.z.boolean(),
+  invoice_template_id: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
+  net_terms_days: import_v410.z.union([import_v410.z.number(), import_v410.z.undefined()]).optional()
 });
 var previewMultiAttachAttachDiscountOutboundSchema = import_v410.z.object({
   reward_id: import_v410.z.union([import_v410.z.string(), import_v410.z.undefined()]).optional(),
@@ -1944,7 +1960,9 @@ var previewUpdateAddItemTierSchema = import_v411.z.object({
 var previewUpdateInvoiceModeSchema = import_v411.z.object({
   enabled: import_v411.z.boolean(),
   enablePlanImmediately: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional(),
-  finalize: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional()
+  finalize: import_v411.z.union([import_v411.z.boolean(), import_v411.z.undefined()]).optional(),
+  invoiceTemplateId: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
+  netTermsDays: import_v411.z.union([import_v411.z.number(), import_v411.z.undefined()]).optional()
 });
 var previewUpdateAttachDiscountSchema = import_v411.z.object({
   rewardId: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
@@ -2139,7 +2157,9 @@ var previewUpdateCustomizeOutboundSchema = import_v411.z.object({
 var previewUpdateInvoiceModeOutboundSchema = import_v411.z.object({
   enabled: import_v411.z.boolean(),
   enable_plan_immediately: import_v411.z.boolean(),
-  finalize: import_v411.z.boolean()
+  finalize: import_v411.z.boolean(),
+  invoice_template_id: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
+  net_terms_days: import_v411.z.union([import_v411.z.number(), import_v411.z.undefined()]).optional()
 });
 var previewUpdateAttachDiscountOutboundSchema = import_v411.z.object({
   reward_id: import_v411.z.union([import_v411.z.string(), import_v411.z.undefined()]).optional(),
@@ -2713,7 +2733,9 @@ var billingUpdateAddItemTierSchema = import_v414.z.object({
 var billingUpdateInvoiceModeSchema = import_v414.z.object({
   enabled: import_v414.z.boolean(),
   enablePlanImmediately: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional(),
-  finalize: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional()
+  finalize: import_v414.z.union([import_v414.z.boolean(), import_v414.z.undefined()]).optional(),
+  invoiceTemplateId: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
+  netTermsDays: import_v414.z.union([import_v414.z.number(), import_v414.z.undefined()]).optional()
 });
 var billingUpdateAttachDiscountSchema = import_v414.z.object({
   rewardId: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
@@ -2844,7 +2866,9 @@ var billingUpdateCustomizeOutboundSchema = import_v414.z.object({
 var billingUpdateInvoiceModeOutboundSchema = import_v414.z.object({
   enabled: import_v414.z.boolean(),
   enable_plan_immediately: import_v414.z.boolean(),
-  finalize: import_v414.z.boolean()
+  finalize: import_v414.z.boolean(),
+  invoice_template_id: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
+  net_terms_days: import_v414.z.union([import_v414.z.number(), import_v414.z.undefined()]).optional()
 });
 var billingUpdateAttachDiscountOutboundSchema = import_v414.z.object({
   reward_id: import_v414.z.union([import_v414.z.string(), import_v414.z.undefined()]).optional(),
@@ -3038,18 +3062,22 @@ var backendError = ({
 };
 
 // src/backend/core/utils/sanitizeBody.ts
-var PROTECTED_FIELDS = [
+var DEFAULT_PROTECTED_BODY_FIELDS = [
   "customerId",
+  "customerData",
   "name",
   "email",
-  "metadata",
   "stripeId"
 ];
-var sanitizeBody = (body) => {
+var CUSTOMER_PROTECTED_BODY_FIELDS = [
+  ...DEFAULT_PROTECTED_BODY_FIELDS,
+  "metadata"
+];
+var sanitizeBody = (body, protectedFields = DEFAULT_PROTECTED_BODY_FIELDS) => {
   const rawBody = body || {};
   const sanitized = {};
   for (const [key, value] of Object.entries(rawBody)) {
-    if (!PROTECTED_FIELDS.includes(key)) {
+    if (!protectedFields.includes(key)) {
       sanitized[key] = value;
     }
   }
@@ -3071,8 +3099,9 @@ var routeConfigs = [
       // expand: z.array(z.enum(CustomerExpand)).optional(),
       expand: import_v415.z.array(import_v415.z.string()).optional()
     }),
+    protectedBodyFields: CUSTOMER_PROTECTED_BODY_FIELDS,
     customHandler: async ({ autumn, identity, body }) => {
-      const sanitizedBody = sanitizeBody(body);
+      const sanitizedBody = sanitizeBody(body, CUSTOMER_PROTECTED_BODY_FIELDS);
       if (!identity?.customerId && sanitizedBody.errorOnNotFound === false) {
         return backendSuccess({ statusCode: 204, body: null });
       }

package/dist/backend/core/routes/routeConfigs.mjs

@@ -1,9 +1,9 @@
 import {
   routeConfigs
-} from "../../chunk-MAU6WWTL.mjs";
+} from "../../chunk-W6NPZLA5.mjs";
 import "../../chunk-OTXV5FY7.mjs";
+import "../../chunk-I7CD6EB6.mjs";
 import "../../chunk-VZIMT7AO.mjs";
-import "../../chunk-Z6QP3YEA.mjs";
 import "../../chunk-N7NFYY54.mjs";
 export {
   routeConfigs

package/dist/backend/core/types/authTypes.d.mts

@@ -1 +1 @@
-export { A as AuthResult, C as CustomerData, a as CustomerId, R as ResolvedIdentity } from '../../authTypes-B7b2mex1.mjs';
+export { A as AuthResult, a as CustomerData, c as CustomerId, R as ResolvedIdentity } from '../../authTypes-CxFcWXh3.mjs';

package/dist/backend/core/types/authTypes.d.ts

@@ -1 +1 @@
-export { A as AuthResult, C as CustomerData, a as CustomerId, R as ResolvedIdentity } from '../../authTypes-B7b2mex1.js';
+export { A as AuthResult, a as CustomerData, c as CustomerId, R as ResolvedIdentity } from '../../authTypes-CxFcWXh3.js';

package/dist/backend/core/types/handlerTypes.d.mts

@@ -1,7 +1,8 @@
-import { A as AuthResult } from '../../authTypes-B7b2mex1.mjs';
-import { R as RouteDefinition } from '../../routeTypes-BcR8yEXe.mjs';
+import { A as AuthResult } from '../../authTypes-CxFcWXh3.mjs';
+import { b as RouteDefinition } from '../../routeTypes-924R85Bn.mjs';
 import './responseTypes.mjs';
 import 'zod/v4';
+import '../utils/sanitizeBody.mjs';
 
 /** Unified request format for all framework adapters */
 type UnifiedRequest = {

package/dist/backend/core/types/handlerTypes.d.ts

@@ -1,7 +1,8 @@
-import { A as AuthResult } from '../../authTypes-B7b2mex1.js';
-import { R as RouteDefinition } from '../../routeTypes-CXj2d3BE.js';
+import { A as AuthResult } from '../../authTypes-CxFcWXh3.js';
+import { b as RouteDefinition } from '../../routeTypes-Db2ZFQC4.js';
 import './responseTypes.js';
 import 'zod/v4';
+import '../utils/sanitizeBody.js';
 
 /** Unified request format for all framework adapters */
 type UnifiedRequest = {

package/dist/backend/core/types/index.d.mts

@@ -1,5 +1,6 @@
-export { A as AuthResult, C as CustomerData, a as CustomerId, R as ResolvedIdentity } from '../../authTypes-B7b2mex1.mjs';
+export { A as AuthResult, a as CustomerData, c as CustomerId, R as ResolvedIdentity } from '../../authTypes-CxFcWXh3.mjs';
 export { CoreHandlerOptions, UnifiedRequest, UnifiedResponse } from './handlerTypes.mjs';
 export { BackendErrorBody, BackendResult } from './responseTypes.mjs';
-export { C as CustomHandlerArgs, a as CustomHandlerFn, c as ROUTE_NAMES, R as RouteDefinition, b as RouteName } from '../../routeTypes-BcR8yEXe.mjs';
+export { C as CustomHandlerArgs, a as CustomHandlerFn, R as ROUTE_NAMES, b as RouteDefinition, c as RouteName } from '../../routeTypes-924R85Bn.mjs';
 import 'zod/v4';
+import '../utils/sanitizeBody.mjs';

package/dist/backend/core/types/index.d.ts

@@ -1,5 +1,6 @@
-export { A as AuthResult, C as CustomerData, a as CustomerId, R as ResolvedIdentity } from '../../authTypes-B7b2mex1.js';
+export { A as AuthResult, a as CustomerData, c as CustomerId, R as ResolvedIdentity } from '../../authTypes-CxFcWXh3.js';
 export { CoreHandlerOptions, UnifiedRequest, UnifiedResponse } from './handlerTypes.js';
 export { BackendErrorBody, BackendResult } from './responseTypes.js';
-export { C as CustomHandlerArgs, a as CustomHandlerFn, c as ROUTE_NAMES, R as RouteDefinition, b as RouteName } from '../../routeTypes-CXj2d3BE.js';
+export { C as CustomHandlerArgs, a as CustomHandlerFn, R as ROUTE_NAMES, b as RouteDefinition, c as RouteName } from '../../routeTypes-Db2ZFQC4.js';
 import 'zod/v4';
+import '../utils/sanitizeBody.js';

package/dist/backend/core/types/routeTypes.d.mts

@@ -1,4 +1,5 @@
-export { C as CustomHandlerArgs, a as CustomHandlerFn, c as ROUTE_NAMES, R as RouteDefinition, b as RouteName } from '../../routeTypes-BcR8yEXe.mjs';
+export { C as CustomHandlerArgs, a as CustomHandlerFn, R as ROUTE_NAMES, b as RouteDefinition, c as RouteName } from '../../routeTypes-924R85Bn.mjs';
 import 'zod/v4';
-import '../../authTypes-B7b2mex1.mjs';
+import '../utils/sanitizeBody.mjs';
+import '../../authTypes-CxFcWXh3.mjs';
 import './responseTypes.mjs';

package/dist/backend/core/types/routeTypes.d.ts

@@ -1,4 +1,5 @@
-export { C as CustomHandlerArgs, a as CustomHandlerFn, c as ROUTE_NAMES, R as RouteDefinition, b as RouteName } from '../../routeTypes-CXj2d3BE.js';
+export { C as CustomHandlerArgs, a as CustomHandlerFn, R as ROUTE_NAMES, b as RouteDefinition, c as RouteName } from '../../routeTypes-Db2ZFQC4.js';
 import 'zod/v4';
-import '../../authTypes-B7b2mex1.js';
+import '../utils/sanitizeBody.js';
+import '../../authTypes-CxFcWXh3.js';
 import './responseTypes.js';

package/dist/backend/core/utils/index.d.mts

@@ -1,4 +1,4 @@
 export { secretKeyCheck } from './secretKeyCheck.mjs';
 export { backendError, backendSuccess, isBackendResult } from './backendRes.mjs';
-export { sanitizeBody } from './sanitizeBody.mjs';
+export { CUSTOMER_PROTECTED_BODY_FIELDS, DEFAULT_PROTECTED_BODY_FIELDS, ProtectedBodyField, sanitizeBody } from './sanitizeBody.mjs';
 import '../types/responseTypes.mjs';

package/dist/backend/core/utils/index.d.ts

@@ -1,4 +1,4 @@
 export { secretKeyCheck } from './secretKeyCheck.js';
 export { backendError, backendSuccess, isBackendResult } from './backendRes.js';
-export { sanitizeBody } from './sanitizeBody.js';
+export { CUSTOMER_PROTECTED_BODY_FIELDS, DEFAULT_PROTECTED_BODY_FIELDS, ProtectedBodyField, sanitizeBody } from './sanitizeBody.js';
 import '../types/responseTypes.js';

package/dist/backend/core/utils/index.js

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/backend/core/utils/index.ts
 var utils_exports = {};
 __export(utils_exports, {
+  CUSTOMER_PROTECTED_BODY_FIELDS: () => CUSTOMER_PROTECTED_BODY_FIELDS,
+  DEFAULT_PROTECTED_BODY_FIELDS: () => DEFAULT_PROTECTED_BODY_FIELDS,
   backendError: () => backendError,
   backendSuccess: () => backendSuccess,
   isBackendResult: () => isBackendResult,
@@ -71,18 +73,22 @@ var isBackendResult = (value) => {
 };
 
 // src/backend/core/utils/sanitizeBody.ts
-var PROTECTED_FIELDS = [
+var DEFAULT_PROTECTED_BODY_FIELDS = [
   "customerId",
+  "customerData",
   "name",
   "email",
-  "metadata",
   "stripeId"
 ];
-var sanitizeBody = (body) => {
+var CUSTOMER_PROTECTED_BODY_FIELDS = [
+  ...DEFAULT_PROTECTED_BODY_FIELDS,
+  "metadata"
+];
+var sanitizeBody = (body, protectedFields = DEFAULT_PROTECTED_BODY_FIELDS) => {
   const rawBody = body || {};
   const sanitized = {};
   for (const [key, value] of Object.entries(rawBody)) {
-    if (!PROTECTED_FIELDS.includes(key)) {
+    if (!protectedFields.includes(key)) {
       sanitized[key] = value;
     }
   }
@@ -90,6 +96,8 @@ var sanitizeBody = (body) => {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CUSTOMER_PROTECTED_BODY_FIELDS,
+  DEFAULT_PROTECTED_BODY_FIELDS,
   backendError,
   backendSuccess,
   isBackendResult,

package/dist/backend/core/utils/index.mjs

@@ -1,16 +1,20 @@
 import "../../chunk-OTXV5FY7.mjs";
+import {
+  CUSTOMER_PROTECTED_BODY_FIELDS,
+  DEFAULT_PROTECTED_BODY_FIELDS,
+  sanitizeBody
+} from "../../chunk-I7CD6EB6.mjs";
 import {
   secretKeyCheck
 } from "../../chunk-VZIMT7AO.mjs";
-import {
-  sanitizeBody
-} from "../../chunk-Z6QP3YEA.mjs";
 import {
   backendError,
   backendSuccess,
   isBackendResult
 } from "../../chunk-N7NFYY54.mjs";
 export {
+  CUSTOMER_PROTECTED_BODY_FIELDS,
+  DEFAULT_PROTECTED_BODY_FIELDS,
   backendError,
   backendSuccess,
   isBackendResult,

package/dist/backend/core/utils/sanitizeBody.d.mts

@@ -1,4 +1,8 @@
+/** Fields that must come from identity, not frontend */
+declare const DEFAULT_PROTECTED_BODY_FIELDS: readonly ["customerId", "customerData", "name", "email", "stripeId"];
+declare const CUSTOMER_PROTECTED_BODY_FIELDS: readonly ["customerId", "customerData", "name", "email", "stripeId", "metadata"];
+type ProtectedBodyField = (typeof DEFAULT_PROTECTED_BODY_FIELDS)[number] | (typeof CUSTOMER_PROTECTED_BODY_FIELDS)[number];
 /** Strip protected fields from body to prevent spoofing */
-declare const sanitizeBody: (body: unknown) => Record<string, unknown>;
+declare const sanitizeBody: (body: unknown, protectedFields?: readonly ProtectedBodyField[]) => Record<string, unknown>;
 
-export { sanitizeBody };
+export { CUSTOMER_PROTECTED_BODY_FIELDS, DEFAULT_PROTECTED_BODY_FIELDS, type ProtectedBodyField, sanitizeBody };