@hostwebhook/platform-node 0.4.1 → 0.6.0

package/dist/presets-de-oauth/shopify-oauth-presets.d.ts

@@ -98,7 +98,7 @@ export declare const SHOPIFY_CREDENTIAL_TYPE = "shopify_oauth2";
  * `read_draft_orders`. (The eight above predate that being written down here
  * and keep both spellings; they are harmless, just redundant.)
  */
-export declare const SHOPIFY_DEFAULT_SCOPES: readonly ["read_orders", "write_orders", "read_customers", "write_customers", "read_products", "write_products", "read_inventory", "write_inventory", "write_draft_orders", "write_merchant_managed_fulfillment_orders", "write_third_party_fulfillment_orders"];
+export declare const SHOPIFY_DEFAULT_SCOPES: readonly ["read_orders", "write_orders", "read_customers", "write_customers", "read_products", "write_products", "read_inventory", "write_inventory", "write_draft_orders", "write_merchant_managed_fulfillment_orders", "write_third_party_fulfillment_orders", "read_locations"];
 /**
  * Shopify's own pattern for a store domain, anchored at both ends.
  *

package/dist/presets-de-oauth/shopify-oauth-presets.js

@@ -119,6 +119,12 @@ exports.SHOPIFY_DEFAULT_SCOPES = [
     'write_draft_orders',
     'write_merchant_managed_fulfillment_orders',
     'write_third_party_fulfillment_orders',
+    /* 2026-09-28: «List locations» (y con ella el id de sede que pide «Adjust
+       inventory»). Sin él Shopify contesta ACCESS_DENIED al campo `name` de
+       una sede — medido en la tienda de pruebas. Ariel lo declaró y publicó en
+       el Dev Dashboard ANTES de este cambio: al revés, el authorize de toda
+       tienda habría fallado. */
+    'read_locations',
 ];
 /**
  * Shopify's own pattern for a store domain, anchored at both ends.

package/dist/rate-limiter.d.ts

@@ -19,7 +19,7 @@ import { type RateLimitResult } from './un-hueco-se-toma-de-una-vez';
 export type { RateLimitResult };
 export declare function checkRateLimit(redis: Redis, webhookId: string, limitPerMinute: number): Promise<RateLimitResult>;
 export declare function checkChatRateLimit(redis: Redis, chatTriggerId: string, scopeKey: string, limitPerMinute: number): Promise<RateLimitResult>;
-export declare function checkOAuthRateLimit(redis: Redis, userId: string, provider: 'google' | 'mcp' | 'atlassian' | 'slack' | 'twitter' | 'mastodon' | 'linkedin' | 'mailchimp' | 'shopify' | 'notion' | 'github' | 'threads' | 'instagram' | 'facebook' | 'discord', limitPerHour: number): Promise<RateLimitResult>;
+export declare function checkOAuthRateLimit(redis: Redis, userId: string, provider: 'google' | 'mcp' | 'atlassian' | 'slack' | 'twitter' | 'mastodon' | 'linkedin' | 'mailchimp' | 'shopify' | 'notion' | 'github' | 'calendly' | 'airtable' | 'threads' | 'instagram' | 'facebook' | 'discord', limitPerHour: number): Promise<RateLimitResult>;
 export declare function checkFlowLinkRateLimit(redis: Redis, organizationId: string, limitPerMinute: number): Promise<RateLimitResult>;
 /** Rate-limit incoming webhook requests at the ingress level. */
 export declare function checkIngressRateLimit(redis: Redis, webhookId: string, limitPerMinute: number): Promise<RateLimitResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/platform-node",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Lo que los servicios de HostWebhook comparten del lado de NODE: cifrado y utilidades que no pueden estar escritas dos veces",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",