@hostwebhook/node-types 1.74.0 → 1.75.0

package/dist/index.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DRIVE_OPERATION_SPECS = exports.DRIVE_OPERATIONS = exports.GOOGLE_CALENDAR_TOOLKIT_BY_TOOL_NAME = exports.GOOGLE_CALENDAR_TOOLKIT_SPECS = exports.isGoogleCalendarOperation = exports.GOOGLE_CALENDAR_OPERATION_SPECS = exports.GOOGLE_CALENDAR_OPERATIONS = exports.isGmailOperation = exports.resolveGmailSendFields = exports.GMAIL_SEND_LEGACY_FIELDS = exports.NATIVE_EMAIL_TOOLKIT_BY_TOOL_NAME = exports.GMAIL_TOOLKIT_BY_TOOL_NAME = exports.NATIVE_EMAIL_TOOLKIT_SPECS = exports.GMAIL_SEND_AND_WAIT_TOOL_SPEC = exports.GMAIL_ALL_TOOLKIT_SPECS = exports.GMAIL_TOOLKIT_SPECS = exports.GMAIL_TOOLKIT_OPERATIONS = exports.GMAIL_DROPDOWN_OPERATIONS = exports.GMAIL_OPERATION_GROUPS = exports.GMAIL_OPERATION_SPECS = exports.GMAIL_OPERATIONS = exports.versionCatalogErrors = exports.fieldsLost = exports.fieldsLostBetween = exports.currentVersion = exports.versionSpec = exports.versionsOf = exports.isVersioned = exports.NODE_TYPE_TO_PREFIX = exports.PREFIX_TO_NODE_TYPE = exports.NODE_STATE_KEYS = exports.NODE_COLORS = exports.NODE_DETAIL_PATHS = exports.getNodeRegistryEntry = exports.NODE_REGISTRY = exports.getNodeDispatchConfig = exports.getAllNodeCollections = exports.NODE_DISPATCH = exports.resolveNodeId = exports.PREFIX_TO_TYPE = exports.NODE_UI = exports.ALL_NODE_TYPES = exports.isNodeType = exports.isTerminal = exports.canSendToNodes = exports.canReceiveFromNodes = exports.canReceiveFrom = exports.NODE_CONNECTIONS = exports.iterableMeta = exports.singleMeta = void 0;
-exports.operacionesDeSlackPara = exports.SLACK_CAPACIDADES_POR_CREDENCIAL = exports.SLACK_OPERATION_SPECS = exports.SLACK_OPERATIONS = exports.isBucketOperation = exports.BUCKET_ITERABLE_OPERATIONS = exports.BUCKET_OPERATION_SPECS = exports.BUCKET_OPERATIONS = exports.isJiraOperation = exports.JIRA_ITERABLE_OPERATIONS = exports.JIRA_DROPDOWN_OPERATIONS = exports.JIRA_OPERATION_SPECS = exports.JIRA_OPERATIONS = exports.isGithubOperation = exports.GITHUB_ITERABLE_OPERATIONS = exports.GITHUB_DROPDOWN_OPERATIONS = exports.GITHUB_OPERATION_SPECS = exports.GITHUB_OPERATIONS = exports.isShopifyOperation = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_OPERATIONS = exports.isMailchimpOperation = exports.MAILCHIMP_CONTACT_STATUSES = exports.MAILCHIMP_OPERATION_SPECS = exports.MAILCHIMP_OPERATIONS = exports.herramientasDeDiscordPara = exports.DISCORD_TOOLKIT_BY_TOOL_NAME = exports.DISCORD_TOOLKIT_SPECS = exports.isDiscordOperation = exports.camposDeDiscordNoDisponibles = exports.discordPuedeEjecutar = exports.operacionesDeDiscordPara = exports.DISCORD_CAPACIDADES_POR_CREDENCIAL = exports.DISCORD_OPERATION_SPECS = exports.DISCORD_OPERATIONS = exports.camposNoDisponiblesPara = exports.puedeEjecutar = exports.operacionesPara = exports.isWhatsAppOperation = exports.WHATSAPP_OPERATIONS = exports.TELEGRAM_TOOLKIT_BY_TOOL_NAME = exports.TELEGRAM_TOOLKIT_SPECS = exports.isTelegramOperation = exports.TELEGRAM_OPERATION_SPECS = exports.TELEGRAM_OPERATIONS = exports.DRIVE_TOOLKIT_BY_TOOL_NAME = exports.DRIVE_TOOLKIT_SPECS = exports.isDriveOperation = void 0;
-exports.CREDENTIAL_TYPES = exports.ventanaDeContextoDeOpenRouter = exports.opcionesDeModelosDeOpenRouter = exports.URL_DE_MODELOS_DE_OPENROUTER = exports.getModelLabel = exports.getDefaultModel = exports.getModelsFor = exports.MODEL_CONTEXT_WINDOWS = exports.LLM_MODELS = exports.LLM_PROVIDERS = exports.DOCS_TOOLKIT_DEFAULTABLE = exports.DOCS_TOOLKIT_BY_TOOL_NAME = exports.DOCS_TOOLKIT_SPECS = exports.isDocsOperation = exports.DOCS_OPERATION_SPECS = exports.DOCS_OPERATIONS = exports.isMongoOperation = exports.MONGO_OPERATION_SPECS = exports.MONGO_OPERATIONS = exports.isPostgresOperation = exports.POSTGRES_OPERATION_SPECS = exports.POSTGRES_MODES = exports.POSTGRES_OPERATIONS = exports.isNotionOperation = exports.NOTION_DROPDOWN_OPERATIONS = exports.NOTION_OPERATION_SPECS = exports.NOTION_OPERATIONS = exports.isGoogleAnalyticsOperation = exports.GOOGLE_ANALYTICS_DROPDOWN_OPERATIONS = exports.GOOGLE_ANALYTICS_OPERATION_SPECS = exports.GOOGLE_ANALYTICS_OPERATIONS = exports.isGoogleContactsOperation = exports.GOOGLE_CONTACTS_DEFAULT_PERSON_FIELDS = exports.GOOGLE_CONTACTS_OPERATION_GROUPS = exports.GOOGLE_CONTACTS_OPERATION_SPECS = exports.GOOGLE_CONTACTS_OPERATIONS_V2 = exports.GOOGLE_CONTACTS_OPERATIONS_V1 = exports.GOOGLE_CONTACTS_OPERATIONS = exports.SHEETS_TOOLKIT_DEFAULTABLE = exports.SHEETS_TOOLKIT_BY_TOOL_NAME = exports.SHEETS_TOOLKIT_SPECS = exports.isSheetsOperation = exports.SHEETS_OPERATION_SPECS = exports.SHEETS_OPERATIONS = exports.herramientasDeSlackPara = exports.SLACK_TOOLKIT_BY_TOOL_NAME = exports.SLACK_TOOLKIT_SPECS = exports.isSlackOperation = exports.camposDeSlackNoDisponibles = exports.slackPuedeEjecutar = void 0;
-exports.isCredentialType = exports.getCredentialType = exports.credentialTypeValues = exports.CREDENTIAL_TYPE_VALUES = void 0;
+exports.isBucketOperation = exports.BUCKET_ITERABLE_OPERATIONS = exports.BUCKET_OPERATION_SPECS = exports.BUCKET_OPERATIONS = exports.isJiraOperation = exports.JIRA_ITERABLE_OPERATIONS = exports.JIRA_DROPDOWN_OPERATIONS = exports.JIRA_OPERATION_SPECS = exports.JIRA_OPERATIONS = exports.isGithubOperation = exports.GITHUB_ITERABLE_OPERATIONS = exports.GITHUB_DROPDOWN_OPERATIONS = exports.GITHUB_OPERATION_SPECS = exports.GITHUB_OPERATIONS = exports.scopesQueFaltanEnShopify = exports.isShopifyOperation = exports.SHOPIFY_PRODUCT_STATUSES = exports.SHOPIFY_CANCEL_REASONS = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATION_SCOPES = exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_OPERATIONS = exports.isMailchimpOperation = exports.MAILCHIMP_CONTACT_STATUSES = exports.MAILCHIMP_OPERATION_SPECS = exports.MAILCHIMP_OPERATIONS = exports.herramientasDeDiscordPara = exports.DISCORD_TOOLKIT_BY_TOOL_NAME = exports.DISCORD_TOOLKIT_SPECS = exports.isDiscordOperation = exports.camposDeDiscordNoDisponibles = exports.discordPuedeEjecutar = exports.operacionesDeDiscordPara = exports.DISCORD_CAPACIDADES_POR_CREDENCIAL = exports.DISCORD_OPERATION_SPECS = exports.DISCORD_OPERATIONS = exports.camposNoDisponiblesPara = exports.puedeEjecutar = exports.operacionesPara = exports.isWhatsAppOperation = exports.WHATSAPP_OPERATIONS = exports.TELEGRAM_TOOLKIT_BY_TOOL_NAME = exports.TELEGRAM_TOOLKIT_SPECS = exports.isTelegramOperation = exports.TELEGRAM_OPERATION_SPECS = exports.TELEGRAM_OPERATIONS = exports.DRIVE_TOOLKIT_BY_TOOL_NAME = exports.DRIVE_TOOLKIT_SPECS = exports.isDriveOperation = void 0;
+exports.getModelLabel = exports.getDefaultModel = exports.getModelsFor = exports.MODEL_CONTEXT_WINDOWS = exports.LLM_MODELS = exports.LLM_PROVIDERS = exports.DOCS_TOOLKIT_DEFAULTABLE = exports.DOCS_TOOLKIT_BY_TOOL_NAME = exports.DOCS_TOOLKIT_SPECS = exports.isDocsOperation = exports.DOCS_OPERATION_SPECS = exports.DOCS_OPERATIONS = exports.isMongoOperation = exports.MONGO_OPERATION_SPECS = exports.MONGO_OPERATIONS = exports.isPostgresOperation = exports.POSTGRES_OPERATION_SPECS = exports.POSTGRES_MODES = exports.POSTGRES_OPERATIONS = exports.isNotionOperation = exports.NOTION_DROPDOWN_OPERATIONS = exports.NOTION_OPERATION_SPECS = exports.NOTION_OPERATIONS = exports.isGoogleAnalyticsOperation = exports.GOOGLE_ANALYTICS_DROPDOWN_OPERATIONS = exports.GOOGLE_ANALYTICS_OPERATION_SPECS = exports.GOOGLE_ANALYTICS_OPERATIONS = exports.isGoogleContactsOperation = exports.GOOGLE_CONTACTS_DEFAULT_PERSON_FIELDS = exports.GOOGLE_CONTACTS_OPERATION_GROUPS = exports.GOOGLE_CONTACTS_OPERATION_SPECS = exports.GOOGLE_CONTACTS_OPERATIONS_V2 = exports.GOOGLE_CONTACTS_OPERATIONS_V1 = exports.GOOGLE_CONTACTS_OPERATIONS = exports.SHEETS_TOOLKIT_DEFAULTABLE = exports.SHEETS_TOOLKIT_BY_TOOL_NAME = exports.SHEETS_TOOLKIT_SPECS = exports.isSheetsOperation = exports.SHEETS_OPERATION_SPECS = exports.SHEETS_OPERATIONS = exports.herramientasDeSlackPara = exports.SLACK_TOOLKIT_BY_TOOL_NAME = exports.SLACK_TOOLKIT_SPECS = exports.isSlackOperation = exports.camposDeSlackNoDisponibles = exports.slackPuedeEjecutar = exports.operacionesDeSlackPara = exports.SLACK_CAPACIDADES_POR_CREDENCIAL = exports.SLACK_OPERATION_SPECS = exports.SLACK_OPERATIONS = void 0;
+exports.isCredentialType = exports.getCredentialType = exports.credentialTypeValues = exports.CREDENTIAL_TYPE_VALUES = exports.CREDENTIAL_TYPES = exports.ventanaDeContextoDeOpenRouter = exports.opcionesDeModelosDeOpenRouter = exports.URL_DE_MODELOS_DE_OPENROUTER = void 0;
 var types_js_1 = require("./types.js");
 Object.defineProperty(exports, "singleMeta", { enumerable: true, get: function () { return types_js_1.singleMeta; } });
 Object.defineProperty(exports, "iterableMeta", { enumerable: true, get: function () { return types_js_1.iterableMeta; } });
@@ -115,9 +115,13 @@ Object.defineProperty(exports, "isMailchimpOperation", { enumerable: true, get:
 var shopify_operations_js_1 = require("./shopify-operations.js");
 Object.defineProperty(exports, "SHOPIFY_OPERATIONS", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_OPERATIONS; } });
 Object.defineProperty(exports, "SHOPIFY_OPERATION_SPECS", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_OPERATION_SPECS; } });
+Object.defineProperty(exports, "SHOPIFY_OPERATION_SCOPES", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_OPERATION_SCOPES; } });
 Object.defineProperty(exports, "SHOPIFY_TAGGABLE_RESOURCES", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_TAGGABLE_RESOURCES; } });
 Object.defineProperty(exports, "SHOPIFY_SEARCHABLE_RESOURCES", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_SEARCHABLE_RESOURCES; } });
+Object.defineProperty(exports, "SHOPIFY_CANCEL_REASONS", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_CANCEL_REASONS; } });
+Object.defineProperty(exports, "SHOPIFY_PRODUCT_STATUSES", { enumerable: true, get: function () { return shopify_operations_js_1.SHOPIFY_PRODUCT_STATUSES; } });
 Object.defineProperty(exports, "isShopifyOperation", { enumerable: true, get: function () { return shopify_operations_js_1.isShopifyOperation; } });
+Object.defineProperty(exports, "scopesQueFaltanEnShopify", { enumerable: true, get: function () { return shopify_operations_js_1.scopesQueFaltanEnShopify; } });
 var github_operations_js_1 = require("./github-operations.js");
 Object.defineProperty(exports, "GITHUB_OPERATIONS", { enumerable: true, get: function () { return github_operations_js_1.GITHUB_OPERATIONS; } });
 Object.defineProperty(exports, "GITHUB_OPERATION_SPECS", { enumerable: true, get: function () { return github_operations_js_1.GITHUB_OPERATION_SPECS; } });

package/dist/shopify-operations.d.ts

@@ -2,18 +2,24 @@
  * Shopify Admin API operations — single source of truth across the api, the
  * dashboard and downstream consumers (MCP server).
  *
- * ## Four, out of several hundred
+ * ## Ten, out of several hundred
  *
- * The Admin API has hundreds of mutations. This node exposes four, and the
+ * The Admin API has hundreds of mutations. This node exposes ten, and the
  * choice is argued in `api/docs/ADR-0007-shopify.md`: a menu of everything is
- * how a node becomes unusable, and these four cover what people actually
- * automate — put a customer in the store, tag something, sync stock, and read
- * back what the store already knows.
+ * how a node becomes unusable.
  *
- * Product creation and order fulfilment were considered and left out of v1.
- * A product means variants, media and prices; a fulfilment means a location, a
- * fulfilment service and a state machine. Each is a configuration surface of
- * its own, not a field.
+ * The first four cover what people automate on day one — put a customer in the
+ * store, tag something, sync stock, and read back what the store already
+ * knows. The six added on 2026-09-08 cover what they ask for on day two: the
+ * order lifecycle (draft → complete → fulfil → cancel), custom data
+ * (metafields) and putting a product in the catalogue.
+ *
+ * ⚠️ **Every entry below carries the OAuth scope it needs**, in
+ * `SHOPIFY_OPERATION_SCOPES`. That is not documentation: a scope missing from
+ * the credential answers HTTP 403 on a call that looks perfectly formed, and
+ * on Shopify a scope is granted at INSTALL time — adding one to the app means
+ * every existing credential has to be reconnected before it can use the new
+ * operation.
  *
  * ## GraphQL only, and the version is not ours to drift on
  *
@@ -54,8 +60,35 @@
  * `inventoryAdjustQuantities` must be sent with the `@idempotent` directive
  * and an idempotency key. A stock adjustment is the one operation here where a
  * silent retry is a real inventory error, so this is not boilerplate.
+ *
+ * ## What was verified for the six added on 2026-09-08
+ *
+ * Read off the Admin GraphQL reference for the current version, not recalled.
+ * The pages, and the one fact from each that a from-memory version gets wrong:
+ *
+ * - `draftOrderCreate(input: DraftOrderInput!)` — `lineItems` is the only
+ *   required field of the input, and each item is `{ variantId, quantity }`
+ *   OR `{ title, originalUnitPrice, quantity }` for a custom line.
+ * - `draftOrderComplete(id: ID!, …)` — the id is a **sibling argument**, not
+ *   inside an input. `paymentPending` is deprecated and is not offered here.
+ * - `fulfillmentCreate(fulfillment: FulfillmentInput!)` — takes
+ *   `lineItemsByFulfillmentOrder`, NOT an order id. There is no mutation that
+ *   fulfils "an order": fulfilment hangs off FulfillmentOrder, so the
+ *   executor has to look them up first. That indirection is the whole reason
+ *   ADR-0007 left this out of v1.
+ * - `orderCancel(orderId:, reason:, restock:, …)` — `reason` and `restock` are
+ *   **required arguments**, and the payload's errors arrive in
+ *   `orderCancelUserErrors`; plain `userErrors` is deprecated there.
+ * - `metafieldsSet(metafields: [MetafieldsSetInput!]!)` — takes a LIST, and
+ *   each entry needs all of `ownerId`, `namespace`, `key`, `type`, `value`.
+ *   `type` is not guessable from the value: `single_line_text_field` and
+ *   `number_integer` are different metafields.
+ * - `productCreate(product: ProductCreateInput!)` — the argument is `product`,
+ *   not `input`; `input: ProductInput` is the deprecated spelling. It creates
+ *   ONE default variant; more variants are `productVariantsBulkCreate`, which
+ *   is a surface of its own and is not offered here.
  */
-export declare const SHOPIFY_OPERATIONS: readonly ["upsertCustomer", "setTags", "adjustInventory", "findRecords"];
+export declare const SHOPIFY_OPERATIONS: readonly ["upsertCustomer", "setTags", "adjustInventory", "findRecords", "createDraftOrder", "completeDraftOrder", "fulfillOrder", "cancelOrder", "setMetafield", "createProduct"];
 export type ShopifyOperation = (typeof SHOPIFY_OPERATIONS)[number];
 /** Type guard — for DTOs and AI tool calls, where the input is untrusted. */
 export declare function isShopifyOperation(value: unknown): value is ShopifyOperation;
@@ -72,6 +105,22 @@ export type ShopifyTaggableResource = (typeof SHOPIFY_TAGGABLE_RESOURCES)[number
 /** What `findRecords` can read back. */
 export declare const SHOPIFY_SEARCHABLE_RESOURCES: readonly ["orders", "customers", "products"];
 export type ShopifySearchableResource = (typeof SHOPIFY_SEARCHABLE_RESOURCES)[number];
+/**
+ * `OrderCancelReason`, the whole enum, in Shopify's own spelling.
+ *
+ * A dropdown and not free text — and that is the opposite of the call made for
+ * `adjustInventory`'s `reason`, on purpose. The difference is not taste: the
+ * inventory vocabulary was NOT verifiable from the reference (see the note
+ * above), so a dropdown there would have been a list of invented values. This
+ * one IS the enumeration, read off `enums/OrderCancelReason`, and an argument
+ * of type `OrderCancelReason!` rejects anything outside it — so free text here
+ * would only mean the user finds out by failing.
+ */
+export declare const SHOPIFY_CANCEL_REASONS: readonly ["CUSTOMER", "DECLINED", "FRAUD", "INVENTORY", "OTHER", "STAFF"];
+export type ShopifyCancelReason = (typeof SHOPIFY_CANCEL_REASONS)[number];
+/** `ProductStatus`, the whole enum. Same reasoning as the cancel reasons. */
+export declare const SHOPIFY_PRODUCT_STATUSES: readonly ["ACTIVE", "DRAFT", "ARCHIVED"];
+export type ShopifyProductStatus = (typeof SHOPIFY_PRODUCT_STATUSES)[number];
 export interface ShopifyParamSpec {
     /** Field key — also the property name on operationConfig. */
     name: string;
@@ -80,7 +129,7 @@ export interface ShopifyParamSpec {
      *  picker backed by a live lookup of the store's locations; `gid` is a
      *  Shopify global id, which is almost always templated from the payload
      *  rather than typed. */
-    type: 'gid' | 'location' | 'email' | 'string' | 'number' | 'tags' | 'taggableResource' | 'searchableResource' | 'json' | 'boolean';
+    type: 'gid' | 'location' | 'email' | 'string' | 'number' | 'tags' | 'taggableResource' | 'searchableResource' | 'cancelReason' | 'productStatus' | 'json' | 'boolean';
     required?: boolean;
     description: string;
     placeholder?: string;
@@ -93,3 +142,55 @@ export interface ShopifyOperationSpec {
     params: ShopifyParamSpec[];
 }
 export declare const SHOPIFY_OPERATION_SPECS: Record<ShopifyOperation, ShopifyOperationSpec>;
+/**
+ * The OAuth scope each operation needs, so a missing one is named BEFORE the
+ * call instead of arriving as an HTTP 403 on a request that looks fine.
+ *
+ * ## The list is "any one of", not "all of"
+ *
+ * That is `fulfillOrder`'s doing and it is not a generalisation for its own
+ * sake: which fulfilment-order scope applies depends on where the order is
+ * fulfilled from — the merchant's own locations, a third-party service, or the
+ * app itself acting as one. Shopify accepts the mutation if the token carries
+ * ANY of the three. Requiring all three would refuse a store that is correctly
+ * set up.
+ *
+ * ## An empty list means "not checkable from the operation alone"
+ *
+ * `setTags` tags an order, a customer or a product through the same mutation,
+ * and `setMetafield` writes onto whichever resource the owner id points at —
+ * so the scope depends on a FIELD, not on the operation. Guessing would be
+ * worse than not checking: a wrong guess blocks a call Shopify would have
+ * accepted, and a pre-flight check that produces false refusals gets deleted.
+ * Those fall through to Shopify's own 403, which `describeShopifyError`
+ * already explains.
+ *
+ * ⚠️ Read against `shopify.dev/docs/api/usage/access-scopes` and each
+ * mutation's own "Access requirements". Two things follow from that page and
+ * are relied on by `scopesQueFaltanEnShopify`:
+ *
+ *   - **A write scope includes read.** `write_orders` grants `read_orders`, so
+ *     a required `read_x` is satisfied by a granted `write_x`.
+ *   - **Scopes are granted at install.** Adding one to the app does not give
+ *     it to credentials that already exist; those have to be reconnected.
+ */
+export declare const SHOPIFY_OPERATION_SCOPES: Record<ShopifyOperation, readonly string[]>;
+/**
+ * Which of an operation's scopes the credential does NOT have.
+ *
+ * Empty means "nothing to say" — and it says that in three different
+ * situations, all of which have to fail OPEN:
+ *
+ *   1. The operation declares no scope (the resource-dependent ones).
+ *   2. The credential has a scope string and it covers one of the alternatives.
+ *   3. **The credential has no scope string at all.** Shopify returns the
+ *      granted scopes on the token exchange, but a credential stored before
+ *      that was read, or one whose metadata was pruned, has an empty string —
+ *      and refusing to run a node because we cannot see its permissions would
+ *      break working flows to prevent a maybe. Shopify is the authority here;
+ *      this check only saves the round trip when it can prove the answer.
+ *
+ * @param concedidos what Shopify granted, as it sends it: a comma-separated
+ *   string, or the already-split list.
+ */
+export declare function scopesQueFaltanEnShopify(concedidos: string | readonly string[] | null | undefined, requeridos: readonly string[]): string[];

package/dist/shopify-operations.js

@@ -3,18 +3,24 @@
  * Shopify Admin API operations — single source of truth across the api, the
  * dashboard and downstream consumers (MCP server).
  *
- * ## Four, out of several hundred
+ * ## Ten, out of several hundred
  *
- * The Admin API has hundreds of mutations. This node exposes four, and the
+ * The Admin API has hundreds of mutations. This node exposes ten, and the
  * choice is argued in `api/docs/ADR-0007-shopify.md`: a menu of everything is
- * how a node becomes unusable, and these four cover what people actually
- * automate — put a customer in the store, tag something, sync stock, and read
- * back what the store already knows.
+ * how a node becomes unusable.
  *
- * Product creation and order fulfilment were considered and left out of v1.
- * A product means variants, media and prices; a fulfilment means a location, a
- * fulfilment service and a state machine. Each is a configuration surface of
- * its own, not a field.
+ * The first four cover what people automate on day one — put a customer in the
+ * store, tag something, sync stock, and read back what the store already
+ * knows. The six added on 2026-09-08 cover what they ask for on day two: the
+ * order lifecycle (draft → complete → fulfil → cancel), custom data
+ * (metafields) and putting a product in the catalogue.
+ *
+ * ⚠️ **Every entry below carries the OAuth scope it needs**, in
+ * `SHOPIFY_OPERATION_SCOPES`. That is not documentation: a scope missing from
+ * the credential answers HTTP 403 on a call that looks perfectly formed, and
+ * on Shopify a scope is granted at INSTALL time — adding one to the app means
+ * every existing credential has to be reconnected before it can use the new
+ * operation.
  *
  * ## GraphQL only, and the version is not ours to drift on
  *
@@ -55,15 +61,49 @@
  * `inventoryAdjustQuantities` must be sent with the `@idempotent` directive
  * and an idempotency key. A stock adjustment is the one operation here where a
  * silent retry is a real inventory error, so this is not boilerplate.
+ *
+ * ## What was verified for the six added on 2026-09-08
+ *
+ * Read off the Admin GraphQL reference for the current version, not recalled.
+ * The pages, and the one fact from each that a from-memory version gets wrong:
+ *
+ * - `draftOrderCreate(input: DraftOrderInput!)` — `lineItems` is the only
+ *   required field of the input, and each item is `{ variantId, quantity }`
+ *   OR `{ title, originalUnitPrice, quantity }` for a custom line.
+ * - `draftOrderComplete(id: ID!, …)` — the id is a **sibling argument**, not
+ *   inside an input. `paymentPending` is deprecated and is not offered here.
+ * - `fulfillmentCreate(fulfillment: FulfillmentInput!)` — takes
+ *   `lineItemsByFulfillmentOrder`, NOT an order id. There is no mutation that
+ *   fulfils "an order": fulfilment hangs off FulfillmentOrder, so the
+ *   executor has to look them up first. That indirection is the whole reason
+ *   ADR-0007 left this out of v1.
+ * - `orderCancel(orderId:, reason:, restock:, …)` — `reason` and `restock` are
+ *   **required arguments**, and the payload's errors arrive in
+ *   `orderCancelUserErrors`; plain `userErrors` is deprecated there.
+ * - `metafieldsSet(metafields: [MetafieldsSetInput!]!)` — takes a LIST, and
+ *   each entry needs all of `ownerId`, `namespace`, `key`, `type`, `value`.
+ *   `type` is not guessable from the value: `single_line_text_field` and
+ *   `number_integer` are different metafields.
+ * - `productCreate(product: ProductCreateInput!)` — the argument is `product`,
+ *   not `input`; `input: ProductInput` is the deprecated spelling. It creates
+ *   ONE default variant; more variants are `productVariantsBulkCreate`, which
+ *   is a surface of its own and is not offered here.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATIONS = void 0;
+exports.SHOPIFY_OPERATION_SCOPES = exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_PRODUCT_STATUSES = exports.SHOPIFY_CANCEL_REASONS = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATIONS = void 0;
 exports.isShopifyOperation = isShopifyOperation;
+exports.scopesQueFaltanEnShopify = scopesQueFaltanEnShopify;
 exports.SHOPIFY_OPERATIONS = [
     'upsertCustomer',
     'setTags',
     'adjustInventory',
     'findRecords',
+    'createDraftOrder',
+    'completeDraftOrder',
+    'fulfillOrder',
+    'cancelOrder',
+    'setMetafield',
+    'createProduct',
 ];
 /** Type guard — for DTOs and AI tool calls, where the input is untrusted. */
 function isShopifyOperation(value) {
@@ -90,6 +130,27 @@ exports.SHOPIFY_SEARCHABLE_RESOURCES = [
     'customers',
     'products',
 ];
+/**
+ * `OrderCancelReason`, the whole enum, in Shopify's own spelling.
+ *
+ * A dropdown and not free text — and that is the opposite of the call made for
+ * `adjustInventory`'s `reason`, on purpose. The difference is not taste: the
+ * inventory vocabulary was NOT verifiable from the reference (see the note
+ * above), so a dropdown there would have been a list of invented values. This
+ * one IS the enumeration, read off `enums/OrderCancelReason`, and an argument
+ * of type `OrderCancelReason!` rejects anything outside it — so free text here
+ * would only mean the user finds out by failing.
+ */
+exports.SHOPIFY_CANCEL_REASONS = [
+    'CUSTOMER',
+    'DECLINED',
+    'FRAUD',
+    'INVENTORY',
+    'OTHER',
+    'STAFF',
+];
+/** `ProductStatus`, the whole enum. Same reasoning as the cancel reasons. */
+exports.SHOPIFY_PRODUCT_STATUSES = ['ACTIVE', 'DRAFT', 'ARCHIVED'];
 exports.SHOPIFY_OPERATION_SPECS = {
     upsertCustomer: {
         label: 'Add or update customer',
@@ -260,4 +321,348 @@ exports.SHOPIFY_OPERATION_SPECS = {
             },
         ],
     },
+    createDraftOrder: {
+        label: 'Create draft order',
+        description: 'Build an order the merchant can review, invoice or complete. This is the supported way to put an order into a store from outside — it does not charge anybody by itself.',
+        apiRoute: 'mutation draftOrderCreate',
+        params: [
+            {
+                name: 'lineItems',
+                label: 'Line items',
+                type: 'json',
+                required: true,
+                description: 'A JSON array. Each entry is either {"variantId":"gid://shopify/ProductVariant/…","quantity":1} for something in the catalogue, or {"title":"…","originalUnitPrice":"10.00","quantity":1} for a custom line. An empty array is refused by Shopify, not by us.',
+                placeholder: '[{"variantId":"gid://shopify/ProductVariant/1234","quantity":1}]',
+            },
+            {
+                name: 'email',
+                label: 'Customer email',
+                type: 'email',
+                description: 'Who the draft is for, when you do not already have their Shopify id. Ignored if you set a customer id.',
+                placeholder: '{{payload.email}}',
+            },
+            {
+                name: 'customerId',
+                label: 'Customer id',
+                type: 'gid',
+                description: 'gid://shopify/Customer/1234. Wins over the email — with both set, Shopify attaches the draft to this customer.',
+                placeholder: '{{payload.customerId}}',
+            },
+            {
+                name: 'note',
+                label: 'Note',
+                type: 'string',
+                description: 'Internal note, visible to staff in the Shopify admin.',
+            },
+            {
+                name: 'tags',
+                label: 'Tags',
+                type: 'tags',
+                description: 'Tags to put on the draft order.',
+            },
+            {
+                name: 'shippingAddress',
+                label: 'Shipping address',
+                type: 'json',
+                description: 'A JSON object: {"address1":"…","city":"…","province":"…","country":"…","zip":"…"}. Leave empty to let the merchant fill it in.',
+            },
+        ],
+    },
+    completeDraftOrder: {
+        label: 'Complete draft order',
+        description: 'Turn a draft order into a real order. This is the step that reserves stock and can charge — it is not undone by running it again.',
+        apiRoute: 'mutation draftOrderComplete',
+        params: [
+            {
+                name: 'draftOrderId',
+                label: 'Draft order id',
+                type: 'gid',
+                required: true,
+                description: 'gid://shopify/DraftOrder/1234. The create-draft operation puts one in its output, so the usual shape is one node feeding the next.',
+                placeholder: '{{payload.id}}',
+            },
+            {
+                name: 'paymentGatewayId',
+                label: 'Payment gateway id',
+                type: 'gid',
+                description: 'Which gateway processes it. Leave empty to complete the order as pending payment, which is what most automations want.',
+            },
+            {
+                name: 'sourceName',
+                label: 'Source name',
+                type: 'string',
+                description: 'A sales-channel handle, for attribution in the store\'s reports.',
+            },
+        ],
+    },
+    fulfillOrder: {
+        label: 'Fulfil order',
+        description: "Mark an order shipped, optionally with tracking. Fulfils every one of the order's open fulfilment orders.",
+        apiRoute: 'query order.fulfillmentOrders, then mutation fulfillmentCreate (one call per order, all its fulfilment orders in one)',
+        params: [
+            {
+                name: 'orderId',
+                label: 'Order id',
+                type: 'gid',
+                required: true,
+                description: 'gid://shopify/Order/1234. NOT a fulfilment order id — those are looked up from this one, because Shopify has no "fulfil this order" mutation.',
+                placeholder: '{{payload.admin_graphql_api_id}}',
+            },
+            {
+                name: 'trackingNumber',
+                label: 'Tracking number',
+                type: 'string',
+                description: 'Optional. With a number and no carrier, Shopify tries to guess the carrier from the number.',
+                placeholder: '{{payload.tracking_number}}',
+            },
+            {
+                name: 'trackingCompany',
+                label: 'Carrier',
+                type: 'string',
+                description: 'Optional. Shopify builds the tracking link itself for carriers it knows by name.',
+                placeholder: 'DHL Express',
+            },
+            {
+                name: 'trackingUrl',
+                label: 'Tracking URL',
+                type: 'string',
+                description: 'Optional. Only needed for a carrier Shopify does not know — otherwise the number is enough.',
+            },
+            {
+                name: 'notifyCustomer',
+                label: 'Email the customer',
+                type: 'boolean',
+                description: 'Off by default. On sends the shipping confirmation, which is a real email to a real person — the one field here with a consequence outside the store.',
+            },
+        ],
+    },
+    cancelOrder: {
+        label: 'Cancel order',
+        description: 'Cancel an order, optionally restocking it and refunding. Shopify runs this as a background job, so success means "accepted", not "already done".',
+        apiRoute: 'mutation orderCancel',
+        params: [
+            {
+                name: 'orderId',
+                label: 'Order id',
+                type: 'gid',
+                required: true,
+                description: 'gid://shopify/Order/1234.',
+                placeholder: '{{payload.admin_graphql_api_id}}',
+            },
+            {
+                name: 'reason',
+                label: 'Reason',
+                type: 'cancelReason',
+                required: true,
+                description: "Required by Shopify, not by us, and it lands on the order where the merchant reads it. OTHER is the honest answer when none of the others fit.",
+            },
+            {
+                name: 'restock',
+                label: 'Put the stock back',
+                type: 'boolean',
+                description: 'Off by default, which is the safe side: restocking something that never left is how a shelf count goes wrong. Turn it on when the goods really are still there.',
+            },
+            {
+                name: 'notifyCustomer',
+                label: 'Email the customer',
+                type: 'boolean',
+                description: 'Off by default. On sends the cancellation email.',
+            },
+            {
+                name: 'staffNote',
+                label: 'Staff note',
+                type: 'string',
+                description: 'Internal note on the cancellation, for whoever reads it later.',
+            },
+        ],
+    },
+    setMetafield: {
+        label: 'Set a metafield',
+        description: 'Write one piece of custom data onto an order, a customer, a product or a variant — the general way to keep a foreign id or a computed value on a Shopify record.',
+        apiRoute: 'mutation metafieldsSet',
+        params: [
+            {
+                name: 'ownerId',
+                label: 'Owner id',
+                type: 'gid',
+                required: true,
+                description: 'What the metafield hangs off, as a global id — an order, a customer, a product, a variant. A Shopify trigger gives you one in the payload.',
+                placeholder: '{{payload.admin_graphql_api_id}}',
+            },
+            {
+                name: 'namespace',
+                label: 'Namespace',
+                type: 'string',
+                required: true,
+                description: '"custom" is the namespace the Shopify admin shows merchants; anything else is only visible through the API unless a definition exists for it.',
+                placeholder: 'custom',
+            },
+            {
+                name: 'key',
+                label: 'Key',
+                type: 'string',
+                required: true,
+                description: 'The field name inside the namespace.',
+                placeholder: 'external_id',
+            },
+            {
+                name: 'type',
+                label: 'Type',
+                type: 'string',
+                required: true,
+                description: 'The metafield type, e.g. single_line_text_field, number_integer, boolean, json, date. It is NOT inferred from the value — the wrong type is rejected, which is better than silently storing a number as text.',
+                placeholder: 'single_line_text_field',
+            },
+            {
+                name: 'value',
+                label: 'Value',
+                type: 'string',
+                required: true,
+                description: 'Always sent as a string, whatever the type says: Shopify parses it against the type on its side. Setting it again REPLACES what was there.',
+                placeholder: '{{payload.id}}',
+            },
+        ],
+    },
+    createProduct: {
+        label: 'Create product',
+        description: 'Put a product in the catalogue. Creates the product and its one default variant; several variants, prices and media are separate mutations and are not offered here.',
+        apiRoute: 'mutation productCreate',
+        params: [
+            {
+                name: 'title',
+                label: 'Title',
+                type: 'string',
+                required: true,
+                description: 'The only field Shopify insists on.',
+                placeholder: '{{payload.title}}',
+            },
+            {
+                name: 'descriptionHtml',
+                label: 'Description',
+                type: 'string',
+                description: 'HTML, not plain text — line breaks typed here do not survive as line breaks in the storefront.',
+            },
+            {
+                name: 'vendor',
+                label: 'Vendor',
+                type: 'string',
+                description: 'Free text; Shopify does not check it against anything.',
+            },
+            {
+                name: 'productType',
+                label: 'Product type',
+                type: 'string',
+                description: 'Free text, and separate from the store\'s collections.',
+            },
+            {
+                name: 'tags',
+                label: 'Tags',
+                type: 'tags',
+                description: 'Tags to put on the product.',
+            },
+            {
+                name: 'status',
+                label: 'Status',
+                type: 'productStatus',
+                description: 'Left empty, Shopify makes it ACTIVE — visible to shoppers the moment it is created. Pick DRAFT when a person should look at it first.',
+            },
+            {
+                name: 'handle',
+                label: 'Handle',
+                type: 'string',
+                description: 'The URL slug. Left empty, Shopify builds one from the title; set it and a collision fails the whole mutation.',
+            },
+        ],
+    },
 };
+/**
+ * The OAuth scope each operation needs, so a missing one is named BEFORE the
+ * call instead of arriving as an HTTP 403 on a request that looks fine.
+ *
+ * ## The list is "any one of", not "all of"
+ *
+ * That is `fulfillOrder`'s doing and it is not a generalisation for its own
+ * sake: which fulfilment-order scope applies depends on where the order is
+ * fulfilled from — the merchant's own locations, a third-party service, or the
+ * app itself acting as one. Shopify accepts the mutation if the token carries
+ * ANY of the three. Requiring all three would refuse a store that is correctly
+ * set up.
+ *
+ * ## An empty list means "not checkable from the operation alone"
+ *
+ * `setTags` tags an order, a customer or a product through the same mutation,
+ * and `setMetafield` writes onto whichever resource the owner id points at —
+ * so the scope depends on a FIELD, not on the operation. Guessing would be
+ * worse than not checking: a wrong guess blocks a call Shopify would have
+ * accepted, and a pre-flight check that produces false refusals gets deleted.
+ * Those fall through to Shopify's own 403, which `describeShopifyError`
+ * already explains.
+ *
+ * ⚠️ Read against `shopify.dev/docs/api/usage/access-scopes` and each
+ * mutation's own "Access requirements". Two things follow from that page and
+ * are relied on by `scopesQueFaltanEnShopify`:
+ *
+ *   - **A write scope includes read.** `write_orders` grants `read_orders`, so
+ *     a required `read_x` is satisfied by a granted `write_x`.
+ *   - **Scopes are granted at install.** Adding one to the app does not give
+ *     it to credentials that already exist; those have to be reconnected.
+ */
+exports.SHOPIFY_OPERATION_SCOPES = {
+    upsertCustomer: ['write_customers'],
+    /* Depende del recurso elegido, no de la operación. Ver la cabecera. */
+    setTags: [],
+    adjustInventory: ['write_inventory'],
+    /* `findRecords` lee tres colecciones distintas según el recurso. Igual. */
+    findRecords: [],
+    createDraftOrder: ['write_draft_orders'],
+    completeDraftOrder: ['write_draft_orders'],
+    fulfillOrder: [
+        'write_merchant_managed_fulfillment_orders',
+        'write_third_party_fulfillment_orders',
+        'write_assigned_fulfillment_orders',
+    ],
+    cancelOrder: ['write_orders'],
+    /* Depende del dueño al que apunte `ownerId`. Ver la cabecera. */
+    setMetafield: [],
+    createProduct: ['write_products'],
+};
+/**
+ * Which of an operation's scopes the credential does NOT have.
+ *
+ * Empty means "nothing to say" — and it says that in three different
+ * situations, all of which have to fail OPEN:
+ *
+ *   1. The operation declares no scope (the resource-dependent ones).
+ *   2. The credential has a scope string and it covers one of the alternatives.
+ *   3. **The credential has no scope string at all.** Shopify returns the
+ *      granted scopes on the token exchange, but a credential stored before
+ *      that was read, or one whose metadata was pruned, has an empty string —
+ *      and refusing to run a node because we cannot see its permissions would
+ *      break working flows to prevent a maybe. Shopify is the authority here;
+ *      this check only saves the round trip when it can prove the answer.
+ *
+ * @param concedidos what Shopify granted, as it sends it: a comma-separated
+ *   string, or the already-split list.
+ */
+function scopesQueFaltanEnShopify(concedidos, requeridos) {
+    if (requeridos.length === 0)
+        return [];
+    const lista = (typeof concedidos === 'string'
+        ? concedidos.split(',')
+        : Array.isArray(concedidos)
+            ? concedidos
+            : [])
+        .map((s) => String(s).trim())
+        .filter(Boolean);
+    // Fail open: sin scopes a la vista no se puede probar que falte ninguno.
+    if (lista.length === 0)
+        return [];
+    const tiene = new Set(lista);
+    const cubierto = (scope) => tiene.has(scope) ||
+        // `write_x` incluye `read_x`, y ésa es la única implicación que existe.
+        (scope.startsWith('read_') && tiene.has(`write_${scope.slice(5)}`));
+    // «Cualquiera de» — con una basta, y entonces no falta nada.
+    if (requeridos.some(cubierto))
+        return [];
+    return [...requeridos];
+}