@cronvello/shop-sdk 0.2.2 → 0.3.0

package/dist/{error-D3Jrcd-j.d.ts → error-DZAuAQ8Z.d.ts}

@@ -1,4 +1,4 @@
-import { Mb as apiRoutes } from './index-DC6jGVkP.js';
+import { Mb as apiRoutes } from './index-CcbN4xcE.js';
 
 type ShopRouteKey = keyof typeof apiRoutes;
 type ShopRoute<K extends ShopRouteKey> = (typeof apiRoutes)[K];
@@ -104,7 +104,7 @@ type ShopDiagnoseOptions = {
  */
 declare function diagnoseShop(options?: ShopDiagnoseOptions): Promise<ShopDiagnosis>;
 
-declare const CONTRACT_SHA256 = "05f34929e71fb2fcb3a4c04707facca22ee46f8960a4cc47ce0a3f1a6df36056";
+declare const CONTRACT_SHA256 = "32f132210ee188c28a330c9db5c6db6eaf5b7c3a65ecc041e029aca6e1335a60";
 
 type ShopErrorDetails = {
     status: number;

package/dist/{error-1WqH-FhJ.d.cts → error-QHUSBOHv.d.cts}

@@ -1,4 +1,4 @@
-import { Mb as apiRoutes } from './index-DC6jGVkP.cjs';
+import { Mb as apiRoutes } from './index-CcbN4xcE.cjs';
 
 type ShopRouteKey = keyof typeof apiRoutes;
 type ShopRoute<K extends ShopRouteKey> = (typeof apiRoutes)[K];
@@ -104,7 +104,7 @@ type ShopDiagnoseOptions = {
  */
 declare function diagnoseShop(options?: ShopDiagnoseOptions): Promise<ShopDiagnosis>;
 
-declare const CONTRACT_SHA256 = "05f34929e71fb2fcb3a4c04707facca22ee46f8960a4cc47ce0a3f1a6df36056";
+declare const CONTRACT_SHA256 = "32f132210ee188c28a330c9db5c6db6eaf5b7c3a65ecc041e029aca6e1335a60";
 
 type ShopErrorDetails = {
     status: number;

package/dist/{index-DC6jGVkP.d.cts → index-CcbN4xcE.d.cts}

@@ -8351,6 +8351,12 @@ type ExternalAppsServiceStatusResponseData = {
     authMethod: string | null;
     oauthClientId: string | null;
     oauthClientSecretFingerprint: string | null;
+    credentialFingerprints: Array<{
+        role: "api_key" | "previous_api_key" | "public_api_key" | "oauth_client_secret";
+        fingerprint: string;
+        current: boolean;
+        expiresAt?: string | any | null;
+    }>;
     entitlementPath: string | null;
     usageOveragePath: string | null;
 };
@@ -8687,7 +8693,7 @@ declare const apiRoutes_external_apps: {
         readonly meta: {
             readonly tags: readonly ["external-apps"];
             readonly summary: "Get external app registration status (B2B)";
-            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
+            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. `credentialFingerprints` lists one such fingerprint per credential we hold for that app (api_key, previous_api_key during a rotation grace period, public_api_key, oauth_client_secret). It lets the caller locate the value in the app's runtime environment by equality instead of guessing a variable name - the name differs per app, the value does not. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
         };
         readonly types: {
             params: ExternalAppsServiceStatusParams;
@@ -25488,7 +25494,7 @@ declare const apiRoutes: {
         readonly meta: {
             readonly tags: readonly ["external-apps"];
             readonly summary: "Get external app registration status (B2B)";
-            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
+            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. `credentialFingerprints` lists one such fingerprint per credential we hold for that app (api_key, previous_api_key during a rotation grace period, public_api_key, oauth_client_secret). It lets the caller locate the value in the app's runtime environment by equality instead of guessing a variable name - the name differs per app, the value does not. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
         };
         readonly types: {
             params: ExternalAppsServiceStatusParams;

package/dist/{index-DC6jGVkP.d.ts → index-CcbN4xcE.d.ts}

@@ -8351,6 +8351,12 @@ type ExternalAppsServiceStatusResponseData = {
     authMethod: string | null;
     oauthClientId: string | null;
     oauthClientSecretFingerprint: string | null;
+    credentialFingerprints: Array<{
+        role: "api_key" | "previous_api_key" | "public_api_key" | "oauth_client_secret";
+        fingerprint: string;
+        current: boolean;
+        expiresAt?: string | any | null;
+    }>;
     entitlementPath: string | null;
     usageOveragePath: string | null;
 };
@@ -8687,7 +8693,7 @@ declare const apiRoutes_external_apps: {
         readonly meta: {
             readonly tags: readonly ["external-apps"];
             readonly summary: "Get external app registration status (B2B)";
-            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
+            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. `credentialFingerprints` lists one such fingerprint per credential we hold for that app (api_key, previous_api_key during a rotation grace period, public_api_key, oauth_client_secret). It lets the caller locate the value in the app's runtime environment by equality instead of guessing a variable name - the name differs per app, the value does not. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
         };
         readonly types: {
             params: ExternalAppsServiceStatusParams;
@@ -25488,7 +25494,7 @@ declare const apiRoutes: {
         readonly meta: {
             readonly tags: readonly ["external-apps"];
             readonly summary: "Get external app registration status (B2B)";
-            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
+            readonly description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. `credentialFingerprints` lists one such fingerprint per credential we hold for that app (api_key, previous_api_key during a rotation grace period, public_api_key, oauth_client_secret). It lets the caller locate the value in the app's runtime environment by equality instead of guessing a variable name - the name differs per app, the value does not. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from.";
         };
         readonly types: {
             params: ExternalAppsServiceStatusParams;

package/dist/index.cjs

@@ -2091,7 +2091,7 @@ var apiRoutes_external_apps = {
     meta: {
       tags: ["external-apps"],
       summary: "Get external app registration status (B2B)",
-      description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from."
+      description: "Returns registration status for an app identified by its string appId. Used by AMP to discover existing connections. Includes authMethod and, for OAuth apps, the oauth client_id we will present to that app plus a truncated SHA-256 fingerprint of the stored client secret, so the other side can prove a rotation actually landed here. Never the secret itself. `credentialFingerprints` lists one such fingerprint per credential we hold for that app (api_key, previous_api_key during a rotation grace period, public_api_key, oauth_client_secret). It lets the caller locate the value in the app's runtime environment by equality instead of guessing a variable name - the name differs per app, the value does not. Also reports the entitlement paths we have stored, because registration is an upsert: a caller that only wants to hand us new credentials must send these back unchanged, or it silently repoints where we fetch entitlements from."
     },
     types: null
   },
@@ -5734,10 +5734,10 @@ function createShopClient(options = {}) {
 }
 
 // src/contract-hash.ts
-var CONTRACT_SHA256 = "05f34929e71fb2fcb3a4c04707facca22ee46f8960a4cc47ce0a3f1a6df36056";
+var CONTRACT_SHA256 = "32f132210ee188c28a330c9db5c6db6eaf5b7c3a65ecc041e029aca6e1335a60";
 
 // src/client/diagnose.ts
-var SDK_VERSION = "0.2.2" ;
+var SDK_VERSION = "0.3.0" ;
 async function resolveBaseUrl(options) {
   const provider = options.client?.baseUrl ?? options.baseUrl ?? SHOP_API_URL;
   const value = typeof provider === "function" ? await provider() : provider;
@@ -5829,6 +5829,104 @@ async function diagnoseShop(options = {}) {
   };
 }
 
+// src/capabilities.ts
+var SDK_VERSION2 = "0.3.0" ;
+var ROUTES = apiRoutes;
+var CLIENT_MANAGEMENT_OPS = [
+  "external_apps_service_register",
+  "external_apps_service_update",
+  "external_apps_service_delete"
+];
+var CLIENT_ROTATION_OPS = ["external_apps_service_rotate_key"];
+var PEER_STATUS_OPS = ["external_apps_service_status"];
+function has(operationId) {
+  return Object.prototype.hasOwnProperty.call(ROUTES, operationId);
+}
+function capabilityFrom(operationIds, reasonWhenMissing) {
+  const present = operationIds.filter(has);
+  if (present.length === operationIds.length) {
+    return { supported: true, operations: present };
+  }
+  const missing = operationIds.filter((id) => !present.includes(id));
+  return {
+    supported: false,
+    operations: present,
+    reason: `${reasonWhenMissing} Fehlend im Vertrag: ${missing.join(", ")}.`
+  };
+}
+function capabilityFromPrefix(prefix, reasonWhenMissing) {
+  const present = Object.keys(ROUTES).filter((id) => id.startsWith(prefix));
+  return present.length > 0 ? { supported: true, operations: present } : { supported: false, operations: [], reason: reasonWhenMissing };
+}
+function shopCapabilities() {
+  const operationIds = Object.keys(ROUTES);
+  const authChannels = {};
+  for (const id of operationIds) {
+    const channel = ROUTES[id]?.auth?.type ?? "none";
+    authChannels[channel] = (authChannels[channel] ?? 0) + 1;
+  }
+  return {
+    service: "node-shop",
+    sdkVersion: SDK_VERSION2,
+    contractSha256: CONTRACT_SHA256,
+    operationCount: operationIds.length,
+    authChannels,
+    capabilities: {
+      // Der Endpunkt beschreibt den Vertrag und kann deshalb nicht in ihm stehen. Er
+      // gehoert zur Zusage dieses SDK und wird von `diagnoseShop` live geprueft.
+      contractFingerprint: { supported: true, operations: [] },
+      healthCheck: capabilityFrom(
+        ["app_info_health"],
+        "Ohne Erreichbarkeits-Endpunkt bleibt nur der Umweg ueber eine echte Anfrage."
+      ),
+      clientManagement: capabilityFrom(
+        CLIENT_MANAGEMENT_OPS,
+        "Ohne diese Routen kann ein Verwalter keine Anbindung fuer andere Apps einrichten."
+      ),
+      clientRotation: capabilityFrom(
+        CLIENT_ROTATION_OPS,
+        "Ohne Erneuerung ist ein einmal ausgegebener Schluessel dauerhaft."
+      ),
+      // Anders als bei orvello haengt die Gnadenfrist nicht an eigenen Routen, sondern am
+      // Feld `gracePeriodHours` derselben Rotation: der alte Schluessel bleibt so lange
+      // gueltig und laeuft dann von selbst ab. Das ist eine Zusage des Vertrags, aber
+      // keine, die sich anhand einer Operation belegen laesst — deshalb steht als Beleg
+      // die Rotation selbst und nicht eine erfundene zweite Operation.
+      rotationGracePeriod: has("external_apps_service_rotate_key") ? { supported: true, operations: CLIENT_ROTATION_OPS } : {
+        supported: false,
+        operations: [],
+        reason: "Ohne Rotation gibt es auch keine Gnadenfrist."
+      },
+      clientRevocation: {
+        supported: false,
+        operations: [],
+        reason: "node-shop kennt keinen eigenen Widerruf. Ein Zugang wird entzogen, indem die App auf `isActive: false` gesetzt (external_apps_service_update) oder geloescht wird (external_apps_service_delete) \u2014 das erste ist reversibel, das zweite endgueltig. Ein Verwalter, der nur den Schluessel ungueltig machen will, ohne die Anbindung anzufassen, hat dafuer heute keine Operation."
+      },
+      peerStatus: capabilityFrom(
+        PEER_STATUS_OPS,
+        "Ohne Statusroute kann ein Verwalter nur raten, was der Shop ueber die App fuehrt."
+      ),
+      entitlements: capabilityFromPrefix(
+        "entitlements_",
+        "Dieser Vertrag kennt keine Berechtigungs-Routen."
+      ),
+      commerce: capabilityFromPrefix(
+        "b2b_",
+        "Dieser Vertrag kennt keine B2B-Routen \u2014 fremde Apps koennen darueber nichts verkaufen."
+      ),
+      usageMetering: capabilityFromPrefix(
+        "usage_reports_",
+        "Dieser Vertrag kennt keine Verbrauchs-Routen."
+      ),
+      serverSideDryRun: {
+        supported: false,
+        operations: [],
+        reason: "node-shop bietet keinen serverseitigen Probelauf an. Nebenwirkungsfrei pruefbar ist der Weg trotzdem: `diagnoseShop` beweist Erreichbarkeit und Vertrag ohne zu schreiben, und `external_apps_service_status` beweist, was der Shop ueber die App fuehrt \u2014 beides beweist die Voraussetzung, nicht das Ergebnis."
+      }
+    }
+  };
+}
+
 exports.CONTRACT_SHA256 = CONTRACT_SHA256;
 exports.SHOP_API_URL = SHOP_API_URL;
 exports.ShopApiError = ShopApiError;
@@ -5885,5 +5983,6 @@ exports.apiRoutes_variant_entitlements = apiRoutes_variant_entitlements;
 exports.apiRoutes_webhooks = apiRoutes_webhooks;
 exports.createShopClient = createShopClient;
 exports.diagnoseShop = diagnoseShop;
+exports.shopCapabilities = shopCapabilities;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map