# Changelog

All notable changes to `@m2c/server` are documented here.

## [0.12.0] - 2026-10-18

- Allow `createAuction` with either `productId` and optional `quantity`, or
  `transactionValue` and optional `description`. Reject mixed pricing inputs
  through TypeScript types and runtime validation. Requires the updated bid server.
- Expose verified catalog fulfillment as `ConversionEvent.catalogPurchase`,
  including product ID, name, quantity, currency, and integer microcent amounts.
- Reject inconsistent catalog snapshot totals. Backend-priced auctions and
  vendor shop purchases continue to omit this optional snapshot.
- Updated the exact `@m2c/core` dependency to 0.12.0.

## [0.11.0] - 2026-10-05

- `requestRefund` now returns the original `requestedAt` and fixed
  `mustConfirmBy` deadline. Historical refunds with no known deadline return
  `mustConfirmBy: null`.
- **Backend compatibility:** Refund responses must include both timestamp fields.
  Deploy the bid-server revisions that return them and retire older serving
  revisions before upgrading `@m2c/server`.
- Updated the exact `@m2c/core` dependency to 0.11.0.

## [0.10.0] - 2026-10-01

- Documented M2C's new auction input rules: `reference` must be an opaque ID
  (1-128 ASCII letters, digits, `.`, `_`, `:` or `-`), `segments` must come
  from the fixed `SupportedSegment` list, and `referrer` is reduced to its
  origin. Other `reference` or `segments` values now return `400`.
- `deviceType` must be `mobile`, `tablet`, `desktop`, `console`, or `tv`, and a
  refund `reason` must be `requested_by_customer`, `duplicate`, `fraudulent`,
  `not_received`, or `other`. Other values now return `400`.
- Updated the exact `@m2c/core` dependency to 0.10.0. Aligned all M2C SDKs at
  0.10.0, so the integration packages skip 0.9.

## [0.8.0] - 2026-09-05

- Added documented auction error codes and marked `auction_in_progress` as retryable.
- Migration: handle `no_eligible_vendors`, `no_bids`, and `no_valid_bids` alongside
  the fallback `no_winner` for auction 404 responses. A documented auction 409
  now maps to `auction_in_progress` instead of `conflict`; a documented auction
  422 maps to `idempotency_mismatch` instead of `unprocessable`.
- Retry `auction_in_progress` with the same idempotency key and exact request
  body. Investigate `idempotency_mismatch` without automatically creating a new key.
- Updated the exact `@m2c/core` dependency to 0.8.0.

## [0.7.2] - 2026-08-25

- Added optional session and purchase identifiers to verified conversion events.

## [0.7.1] - 2026-07-29

- Removed generic support, security, and contribution links from the package
  documentation and updated the exact `@m2c/core` dependency.

## [0.7.0] - 2026-07-29

- Aligned the core, server, vendor, and checkout-receiver integration SDK
  release train at version 0.7.0 and updated the exact `@m2c/core` dependency.

## [0.4.4] - 2026-07-28

- Bounded API response bodies while preserving the received HTTP status and
  retry classification when a body cannot be read safely.
- Added the typed `rejected` refund-request state and strict response-status
  validation.

## [0.4.3] - 2026-07-27

- Reused `@m2c/core` 0.4.2 for secure base URL validation, preserving the
  existing HTTPS, loopback, and explicit development opt-in behavior.

## [0.4.2] - 2026-07-24

- Added the optional monotonic `eventSequence` field to verified conversion
  events, including validation of its wire representation.
- Documented transactional compare-and-advance handling for fulfillment and
  reversals.