@hostwebhook/platform-node 0.4.0 → 0.5.0

package/dist/presets-de-oauth/shopify-oauth-presets.d.ts

@@ -66,8 +66,39 @@ export declare const SHOPIFY_CREDENTIAL_TYPE = "shopify_oauth2";
  *
  * `read_all_orders` is deliberately absent: it needs a separate approval from
  * Shopify and only widens the window past 60 days, which nothing in v1 uses.
+ *
+ * ## 🔑 [2026-09-08] Three added, and they cost a reconnect
+ *
+ * The action node grew six operations, and three of them need permissions the
+ * app never asked for. Two things follow, and both are the kind that are
+ * discovered at the worst moment if they are not written down:
+ *
+ * 1. **Declaring them here is half the edit.** The other half is releasing a
+ *    new version of the app in the Dev Dashboard with the same list. Until
+ *    that is done Shopify refuses the AUTHORIZE step — so the symptom is not a
+ *    failing node, it is a connection flow that will not start.
+ *
+ * 2. **Scopes are granted at install time.** Every credential connected before
+ *    this list changed keeps the eight it was granted. It goes on working for
+ *    the operations it already covered, and answers HTTP 403 on the three new
+ *    ones until somebody presses Reconnect on it. That is why
+ *    `SHOPIFY_OPERATION_SCOPES` exists in node-types: so the node can say
+ *    which scope is missing instead of relaying a 403.
+ *
+ * `write_assigned_fulfillment_orders` is deliberately absent, and it is the
+ * one an over-eager list would include. It is for apps that ARE a fulfilment
+ * service — Shopify assigns them the fulfilment orders. HostWebhook is an
+ * order-management app: it fulfils what the merchant's own locations
+ * (`merchant_managed`) or their 3PL (`third_party`) hold. Asking for a
+ * permission the app has no use for is what makes a merchant read the install
+ * screen twice.
+ *
+ * Read scopes for the same resources are not listed either: on Shopify a write
+ * scope includes read, so `write_draft_orders` already grants
+ * `read_draft_orders`. (The eight above predate that being written down here
+ * and keep both spellings; they are harmless, just redundant.)
  */
-export declare const SHOPIFY_DEFAULT_SCOPES: readonly ["read_orders", "write_orders", "read_customers", "write_customers", "read_products", "write_products", "read_inventory", "write_inventory"];
+export declare const SHOPIFY_DEFAULT_SCOPES: readonly ["read_orders", "write_orders", "read_customers", "write_customers", "read_products", "write_products", "read_inventory", "write_inventory", "write_draft_orders", "write_merchant_managed_fulfillment_orders", "write_third_party_fulfillment_orders"];
 /**
  * Shopify's own pattern for a store domain, anchored at both ends.
  *

package/dist/presets-de-oauth/shopify-oauth-presets.js

@@ -75,6 +75,37 @@ exports.SHOPIFY_CREDENTIAL_TYPE = 'shopify_oauth2';
  *
  * `read_all_orders` is deliberately absent: it needs a separate approval from
  * Shopify and only widens the window past 60 days, which nothing in v1 uses.
+ *
+ * ## 🔑 [2026-09-08] Three added, and they cost a reconnect
+ *
+ * The action node grew six operations, and three of them need permissions the
+ * app never asked for. Two things follow, and both are the kind that are
+ * discovered at the worst moment if they are not written down:
+ *
+ * 1. **Declaring them here is half the edit.** The other half is releasing a
+ *    new version of the app in the Dev Dashboard with the same list. Until
+ *    that is done Shopify refuses the AUTHORIZE step — so the symptom is not a
+ *    failing node, it is a connection flow that will not start.
+ *
+ * 2. **Scopes are granted at install time.** Every credential connected before
+ *    this list changed keeps the eight it was granted. It goes on working for
+ *    the operations it already covered, and answers HTTP 403 on the three new
+ *    ones until somebody presses Reconnect on it. That is why
+ *    `SHOPIFY_OPERATION_SCOPES` exists in node-types: so the node can say
+ *    which scope is missing instead of relaying a 403.
+ *
+ * `write_assigned_fulfillment_orders` is deliberately absent, and it is the
+ * one an over-eager list would include. It is for apps that ARE a fulfilment
+ * service — Shopify assigns them the fulfilment orders. HostWebhook is an
+ * order-management app: it fulfils what the merchant's own locations
+ * (`merchant_managed`) or their 3PL (`third_party`) hold. Asking for a
+ * permission the app has no use for is what makes a merchant read the install
+ * screen twice.
+ *
+ * Read scopes for the same resources are not listed either: on Shopify a write
+ * scope includes read, so `write_draft_orders` already grants
+ * `read_draft_orders`. (The eight above predate that being written down here
+ * and keep both spellings; they are harmless, just redundant.)
  */
 exports.SHOPIFY_DEFAULT_SCOPES = [
     'read_orders',
@@ -85,6 +116,9 @@ exports.SHOPIFY_DEFAULT_SCOPES = [
     'write_products',
     'read_inventory',
     'write_inventory',
+    'write_draft_orders',
+    'write_merchant_managed_fulfillment_orders',
+    'write_third_party_fulfillment_orders',
 ];
 /**
  * Shopify's own pattern for a store domain, anchored at both ends.

package/dist/rate-limiter.d.ts

@@ -19,7 +19,7 @@ import { type RateLimitResult } from './un-hueco-se-toma-de-una-vez';
 export type { RateLimitResult };
 export declare function checkRateLimit(redis: Redis, webhookId: string, limitPerMinute: number): Promise<RateLimitResult>;
 export declare function checkChatRateLimit(redis: Redis, chatTriggerId: string, scopeKey: string, limitPerMinute: number): Promise<RateLimitResult>;
-export declare function checkOAuthRateLimit(redis: Redis, userId: string, provider: 'google' | 'mcp' | 'atlassian' | 'slack' | 'twitter' | 'mastodon' | 'linkedin' | 'mailchimp' | 'shopify' | 'notion' | 'github' | 'threads' | 'instagram' | 'facebook' | 'discord', limitPerHour: number): Promise<RateLimitResult>;
+export declare function checkOAuthRateLimit(redis: Redis, userId: string, provider: 'google' | 'mcp' | 'atlassian' | 'slack' | 'twitter' | 'mastodon' | 'linkedin' | 'mailchimp' | 'shopify' | 'notion' | 'github' | 'calendly' | 'airtable' | 'threads' | 'instagram' | 'facebook' | 'discord', limitPerHour: number): Promise<RateLimitResult>;
 export declare function checkFlowLinkRateLimit(redis: Redis, organizationId: string, limitPerMinute: number): Promise<RateLimitResult>;
 /** Rate-limit incoming webhook requests at the ingress level. */
 export declare function checkIngressRateLimit(redis: Redis, webhookId: string, limitPerMinute: number): Promise<RateLimitResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/platform-node",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Lo que los servicios de HostWebhook comparten del lado de NODE: cifrado y utilidades que no pueden estar escritas dos veces",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",