@orvello/sdk 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.cjs CHANGED
@@ -4,7 +4,7 @@
4
4
  var CONTRACT_SHA256 = "4efd4e4b669168c9cab5419fa04dd4e26a2029de2d4b10a59918e366189e1072";
5
5
 
6
6
  // src/diagnose.ts
7
- var SDK_VERSION = "0.1.0" ;
7
+ var SDK_VERSION = "0.2.0" ;
8
8
  function normalizeBaseUrl(raw) {
9
9
  const trimmed = raw.trim();
10
10
  if (!trimmed) throw new Error("Base URL cannot be empty");
@@ -183,6 +183,775 @@ function mapPaymentAccountToBankDetails(account) {
183
183
  };
184
184
  }
185
185
 
186
+ // src/route-index.generated.ts
187
+ var ROUTE_INDEX = {
188
+ "DELETE__api_amp_proxy_key": ["DELETE", "/api/amp-proxy/:key", "n", "public", 0],
189
+ "GET__api_amp_proxy__discover": ["GET", "/api/amp-proxy/_discover", "n", "public", 0],
190
+ "GET__api_amp_proxy_key": ["GET", "/api/amp-proxy/:key", "n", "public", 0],
191
+ "POST__api_amp_proxy_key": ["POST", "/api/amp-proxy/:key", "n", "public", 0],
192
+ "admin_vat_create_system_settings": ["POST", "/admin/vat/system-settings", "b", "frontend_permission_http", 4],
193
+ "admin_vat_get_company_settings_history": ["GET", "/admin/vat/company/:companyId/settings-history", "b", "frontend_permission_http", 1],
194
+ "admin_vat_get_system_settings": ["GET", "/admin/vat/system-settings", "b", "frontend_permission_http", 0],
195
+ "admin_vat_get_system_settings_history": ["GET", "/admin/vat/system-settings/history", "b", "frontend_permission_http", 2],
196
+ "admin_vat_update_company_settings": ["PUT", "/admin/vat/company/:companyId/settings", "b", "frontend_permission_http", 5],
197
+ "admin_vat_update_system_settings": ["PUT", "/admin/vat/system-settings/:id", "b", "frontend_permission_http", 5],
198
+ "app_info_get": ["GET", "/app-info", "b", "frontend_bearer_http", 2],
199
+ "app_info_health": ["GET", "/app-info/health", "n", "public", 0],
200
+ "app_info_manifest": ["GET", "/app-info/manifest", "n", "public", 0],
201
+ "app_info_own_permissions_get": ["GET", "/app-info/ownPermissions", "b", "frontend_bearer_http", 2],
202
+ "bookkeeping_assets_add_cost_component": ["POST", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 5],
203
+ "bookkeeping_assets_apply_sonderafa": ["POST", "/bookkeeping/assets/:assetId/sonderafa", "b", "frontend_permission_http", 5],
204
+ "bookkeeping_assets_create": ["POST", "/bookkeeping/assets", "b", "frontend_permission_http", 4],
205
+ "bookkeeping_assets_delete": ["DELETE", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
206
+ "bookkeeping_assets_delete_cost_component": ["DELETE", "/bookkeeping/assets/:assetId/cost-components/:componentId", "b", "frontend_permission_http", 1],
207
+ "bookkeeping_assets_dispose": ["POST", "/bookkeeping/assets/:assetId/dispose", "b", "frontend_permission_http", 5],
208
+ "bookkeeping_assets_finalize_depreciation": ["POST", "/bookkeeping/assets/depreciation/finalize", "b", "frontend_permission_http", 4],
209
+ "bookkeeping_assets_generate_depreciation": ["POST", "/bookkeeping/assets/depreciation/generate", "b", "frontend_permission_http", 4],
210
+ "bookkeeping_assets_get_by_id": ["GET", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
211
+ "bookkeeping_assets_get_depreciation_records": ["GET", "/bookkeeping/assets/depreciation/records", "b", "frontend_permission_http", 2],
212
+ "bookkeeping_assets_get_sammelposten_pool": ["GET", "/bookkeeping/assets/sammelposten-pools/:poolId", "b", "frontend_permission_http", 1],
213
+ "bookkeeping_assets_iab_create": ["POST", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 4],
214
+ "bookkeeping_assets_iab_delete": ["DELETE", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
215
+ "bookkeeping_assets_iab_dissolve": ["POST", "/bookkeeping/assets/iab/:iabId/dissolve", "b", "frontend_permission_http", 5],
216
+ "bookkeeping_assets_iab_get": ["GET", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
217
+ "bookkeeping_assets_iab_list": ["GET", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 0],
218
+ "bookkeeping_assets_iab_reverse": ["POST", "/bookkeeping/assets/iab/:iabId/reverse", "b", "frontend_permission_http", 5],
219
+ "bookkeeping_assets_list_cost_components": ["GET", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 1],
220
+ "bookkeeping_assets_list_sammelposten_pools": ["GET", "/bookkeeping/assets/sammelposten-pools", "b", "frontend_permission_http", 0],
221
+ "bookkeeping_assets_search": ["GET", "/bookkeeping/assets", "b", "frontend_permission_http", 2],
222
+ "bookkeeping_assets_switch_to_linear": ["POST", "/bookkeeping/assets/:assetId/switch-to-linear", "b", "frontend_permission_http", 5],
223
+ "bookkeeping_assets_update": ["PUT", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 5],
224
+ "bookkeeping_audit_logs": ["GET", "/bookkeeping/audit/logs", "b", "frontend_permission_http", 2],
225
+ "bookkeeping_capital_movements_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/cash-confirm", "b", "frontend_permission_http", 5],
226
+ "bookkeeping_capital_movements_confirm": ["POST", "/bookkeeping/capital-movements/:id/confirm", "b", "frontend_permission_http", 1],
227
+ "bookkeeping_capital_movements_create": ["POST", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 4],
228
+ "bookkeeping_capital_movements_delete": ["DELETE", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
229
+ "bookkeeping_capital_movements_get_by_id": ["GET", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
230
+ "bookkeeping_capital_movements_kapitalkonto": ["GET", "/bookkeeping/capital-movements/kapitalkonto", "b", "frontend_permission_http", 2],
231
+ "bookkeeping_capital_movements_reverse": ["POST", "/bookkeeping/capital-movements/:id/reverse", "b", "frontend_permission_http", 5],
232
+ "bookkeeping_capital_movements_revoke_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
233
+ "bookkeeping_capital_movements_search": ["GET", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 2],
234
+ "bookkeeping_capital_movements_update": ["PATCH", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 5],
235
+ "bookkeeping_expenses_analyze_receipt": ["POST", "/bookkeeping/expenses/analyze-receipt", "b", "frontend_permission_http", 0],
236
+ "bookkeeping_expenses_bulk_confirm": ["POST", "/bookkeeping/expenses/bulk-confirm", "b", "frontend_permission_http", 4],
237
+ "bookkeeping_expenses_confirm": ["POST", "/bookkeeping/expenses/:id/confirm", "b", "frontend_permission_http", 1],
238
+ "bookkeeping_expenses_confirm_cash": ["POST", "/bookkeeping/expenses/:id/confirm-cash", "b", "frontend_permission_http", 5],
239
+ "bookkeeping_expenses_create": ["POST", "/bookkeeping/expenses", "b", "frontend_permission_http", 4],
240
+ "bookkeeping_expenses_create_external": ["POST", "/bookkeeping/expenses/external", "b", "unified_bearer", 4, ["expenses:write"]],
241
+ "bookkeeping_expenses_delete": ["DELETE", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
242
+ "bookkeeping_expenses_get_by_id": ["GET", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
243
+ "bookkeeping_expenses_mark_as_asset": ["POST", "/bookkeeping/expenses/:id/mark-as-asset", "b", "frontend_permission_http", 5],
244
+ "bookkeeping_expenses_revoke_cash_confirm": ["POST", "/bookkeeping/expenses/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
245
+ "bookkeeping_expenses_search": ["GET", "/bookkeeping/expenses", "b", "frontend_permission_http", 2],
246
+ "bookkeeping_expenses_update": ["PUT", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 5],
247
+ "bookkeeping_expenses_upload_receipt": ["POST", "/bookkeeping/expenses/:id/upload-receipt", "b", "frontend_permission_http", 1],
248
+ "bookkeeping_iap_payouts_import": ["POST", "/bookkeeping/iap-payouts/import", "b", "frontend_permission_http", 4],
249
+ "bookkeeping_iap_payouts_list": ["GET", "/bookkeeping/iap-payouts", "b", "frontend_permission_http", 2],
250
+ "bookkeeping_income_tax_create_employment": ["POST", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 4],
251
+ "bookkeeping_income_tax_create_sonderausgaben": ["POST", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 4],
252
+ "bookkeeping_income_tax_create_steuerminderungen": ["POST", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 4],
253
+ "bookkeeping_income_tax_create_vorsorge": ["POST", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 4],
254
+ "bookkeeping_income_tax_create_werbungskosten": ["POST", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 4],
255
+ "bookkeeping_income_tax_delete_employment": ["DELETE", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
256
+ "bookkeeping_income_tax_delete_sonderausgaben": ["DELETE", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 1],
257
+ "bookkeeping_income_tax_delete_steuerminderungen": ["DELETE", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 1],
258
+ "bookkeeping_income_tax_delete_vorsorge": ["DELETE", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 1],
259
+ "bookkeeping_income_tax_delete_werbungskosten": ["DELETE", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 1],
260
+ "bookkeeping_income_tax_get_employment": ["GET", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
261
+ "bookkeeping_income_tax_get_estimate": ["GET", "/bookkeeping/income-tax/estimate", "b", "frontend_permission_http", 2],
262
+ "bookkeeping_income_tax_get_settings": ["GET", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 0],
263
+ "bookkeeping_income_tax_get_summary": ["GET", "/bookkeeping/income-tax/summary", "b", "frontend_permission_http", 2],
264
+ "bookkeeping_income_tax_get_vorauszahlungen": ["GET", "/bookkeeping/income-tax/vorauszahlungen", "b", "frontend_permission_http", 2],
265
+ "bookkeeping_income_tax_list_employment": ["GET", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 2],
266
+ "bookkeeping_income_tax_list_sonderausgaben": ["GET", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 2],
267
+ "bookkeeping_income_tax_list_steuerminderungen": ["GET", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 2],
268
+ "bookkeeping_income_tax_list_vorsorge": ["GET", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 2],
269
+ "bookkeeping_income_tax_list_werbungskosten": ["GET", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 2],
270
+ "bookkeeping_income_tax_update_employment": ["PUT", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 5],
271
+ "bookkeeping_income_tax_update_sonderausgaben": ["PUT", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 5],
272
+ "bookkeeping_income_tax_update_steuerminderungen": ["PUT", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 5],
273
+ "bookkeeping_income_tax_update_vorsorge": ["PUT", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 5],
274
+ "bookkeeping_income_tax_update_werbungskosten": ["PUT", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 5],
275
+ "bookkeeping_income_tax_upsert_settings": ["POST", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 4],
276
+ "bookkeeping_locks_get_state": ["GET", "/bookkeeping/locks/state", "b", "frontend_permission_http", 0],
277
+ "bookkeeping_locks_overview": ["GET", "/bookkeeping/locks/overview", "b", "frontend_permission_http", 2],
278
+ "bookkeeping_locks_recommendation": ["GET", "/bookkeeping/locks/recommendation", "b", "frontend_permission_http", 2],
279
+ "bookkeeping_locks_set": ["POST", "/bookkeeping/locks/set", "b", "frontend_permission_http", 4],
280
+ "bookkeeping_payments_create_manual_external": ["POST", "/bookkeeping/payments/external/manual", "b", "unified_bearer", 4, ["payments:write"]],
281
+ "bookkeeping_payments_list_accounts_external": ["GET", "/bookkeeping/payments/external/accounts", "b", "unified_bearer", 2, ["payments:read"]],
282
+ "bookkeeping_payments_settle_invoice_external": ["POST", "/bookkeeping/payments/external/settle-invoice", "b", "unified_bearer", 4, ["payments:write", "invoices:write"]],
283
+ "bookkeeping_reports_asset_register": ["GET", "/bookkeeping/reports/assets", "b", "frontend_permission_http", 2],
284
+ "bookkeeping_reports_category_breakdown": ["GET", "/bookkeeping/reports/category-breakdown", "b", "frontend_permission_http", 2],
285
+ "bookkeeping_reports_euer": ["GET", "/bookkeeping/reports/euer", "b", "frontend_permission_http", 2],
286
+ "bookkeeping_reports_monthly_trend": ["GET", "/bookkeeping/reports/monthly-trend", "b", "frontend_permission_http", 2],
287
+ "bookkeeping_reports_summary": ["GET", "/bookkeeping/reports/summary", "b", "frontend_permission_http", 2],
288
+ "bookkeeping_reports_vat_periods": ["GET", "/bookkeeping/reports/vat/periods", "b", "frontend_permission_http", 0],
289
+ "bookkeeping_reports_vat_status": ["GET", "/bookkeeping/reports/vat/status", "b", "frontend_permission_http", 0],
290
+ "bookkeeping_reports_vat_ustva": ["GET", "/bookkeeping/reports/vat/ustva", "b", "frontend_permission_http", 2],
291
+ "bookkeeping_reports_vendor_breakdown": ["GET", "/bookkeeping/reports/vendor-breakdown", "b", "frontend_permission_http", 2],
292
+ "bookkeeping_revenues_analyze_receipt": ["POST", "/bookkeeping/revenues/analyze-receipt", "b", "frontend_permission_http", 0],
293
+ "bookkeeping_revenues_bulk_confirm": ["POST", "/bookkeeping/revenues/bulk-confirm", "b", "frontend_permission_http", 4],
294
+ "bookkeeping_revenues_confirm": ["POST", "/bookkeeping/revenues/:id/confirm", "b", "frontend_permission_http", 1],
295
+ "bookkeeping_revenues_confirm_cash": ["POST", "/bookkeeping/revenues/:id/confirm-cash", "b", "frontend_permission_http", 5],
296
+ "bookkeeping_revenues_create": ["POST", "/bookkeeping/revenues", "b", "frontend_permission_http", 4],
297
+ "bookkeeping_revenues_create_external": ["POST", "/bookkeeping/revenues/external", "b", "unified_bearer", 4, ["revenues:write"]],
298
+ "bookkeeping_revenues_delete": ["DELETE", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
299
+ "bookkeeping_revenues_get_by_id": ["GET", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
300
+ "bookkeeping_revenues_invoice_adjustment_external": ["POST", "/bookkeeping/revenues/external/invoice-adjustment", "b", "unified_bearer", 4, ["revenues:write"]],
301
+ "bookkeeping_revenues_revoke_cash_confirm": ["POST", "/bookkeeping/revenues/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
302
+ "bookkeeping_revenues_search": ["GET", "/bookkeeping/revenues", "b", "frontend_permission_http", 2],
303
+ "bookkeeping_revenues_update": ["PUT", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 5],
304
+ "bookkeeping_revenues_upload_receipt": ["POST", "/bookkeeping/revenues/:id/upload-receipt", "b", "frontend_permission_http", 1],
305
+ "bookkeeping_tax_params_create": ["POST", "/bookkeeping/tax-params", "b", "frontend_permission_http", 4],
306
+ "bookkeeping_tax_params_health": ["GET", "/bookkeeping/tax-params/health", "b", "frontend_permission_http", 0],
307
+ "bookkeeping_tax_params_history": ["GET", "/bookkeeping/tax-params/:key/history", "b", "frontend_permission_http", 1],
308
+ "bookkeeping_tax_params_list": ["GET", "/bookkeeping/tax-params", "b", "frontend_permission_http", 2],
309
+ "bookkeeping_tax_params_sync": ["POST", "/bookkeeping/tax-params/sync", "b", "frontend_permission_http", 0],
310
+ "bookkeeping_tax_params_update": ["PATCH", "/bookkeeping/tax-params/:id", "b", "frontend_permission_http", 5],
311
+ "currency_rates_get": ["GET", "/currency-rates/:fromCurrency/:toCurrency", "k", "x_api_key_http", 3],
312
+ "customer_companies_create": ["POST", "/customer-companies/create", "b", "frontend_permission_http", 4],
313
+ "customer_companies_create_external": ["POST", "/customer-companies/external", "b", "unified_bearer", 4, ["companies:write"]],
314
+ "customer_companies_delete": ["DELETE", "/customer-companies/delete/:companyId", "b", "frontend_permission_http", 1],
315
+ "customer_companies_delete_external": ["DELETE", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:delete"]],
316
+ "customer_companies_employee_assignments_by_company_id": ["GET", "/customer-companies/employee-assignments/byCompanyId/:companyId", "b", "frontend_permission_http", 3],
317
+ "customer_companies_employee_assignments_by_employee_id": ["GET", "/customer-companies/employee-assignments/byEmployeeId/:employeeId", "b", "frontend_permission_http", 3],
318
+ "customer_companies_employee_assignments_create": ["POST", "/customer-companies/employee-assignments/create", "b", "frontend_permission_http", 4],
319
+ "customer_companies_employee_assignments_update": ["PUT", "/customer-companies/employee-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
320
+ "customer_companies_employees_create": ["POST", "/customer-companies/employees/create", "b", "frontend_permission_http", 4],
321
+ "customer_companies_employees_delete": ["DELETE", "/customer-companies/employees/delete/:employeeId", "b", "frontend_permission_http", 1],
322
+ "customer_companies_employees_get_by_id": ["GET", "/customer-companies/employees/byId/:employeeId", "b", "frontend_permission_http", 1],
323
+ "customer_companies_employees_search": ["GET", "/customer-companies/employees/search", "b", "frontend_permission_http", 2],
324
+ "customer_companies_employees_update": ["PUT", "/customer-companies/employees/update/:employeeId", "b", "frontend_permission_http", 5],
325
+ "customer_companies_get_by_id": ["GET", "/customer-companies/byId/:companyId", "b", "frontend_permission_http", 1],
326
+ "customer_companies_get_by_id_external": ["GET", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:read"]],
327
+ "customer_companies_get_full_by_id": ["GET", "/customer-companies/byId/:companyId/full", "b", "frontend_permission_http", 3],
328
+ "customer_companies_search": ["GET", "/customer-companies/search", "b", "frontend_permission_http", 2],
329
+ "customer_companies_search_external": ["GET", "/customer-companies/external", "b", "unified_bearer", 2, ["companies:read"]],
330
+ "customer_companies_update": ["PUT", "/customer-companies/update/:companyId", "b", "frontend_permission_http", 5],
331
+ "customer_companies_update_external": ["PUT", "/customer-companies/external/:companyId", "b", "unified_bearer", 5, ["companies:write"]],
332
+ "documents_assign": ["POST", "/documents/admin/assign", "b", "frontend_permission_http", 4],
333
+ "documents_create": ["POST", "/documents/admin/create", "b", "frontend_permission_http", 4],
334
+ "documents_delete": ["DELETE", "/documents/admin/delete/:documentId", "b", "frontend_permission_http", 3],
335
+ "documents_delete_assignment": ["DELETE", "/documents/admin/assignments/:assignmentId", "b", "frontend_permission_http", 1],
336
+ "documents_download_url": ["GET", "/documents/admin/byId/:documentId/download-url", "b", "frontend_permission_http", 3],
337
+ "documents_get_by_id": ["GET", "/documents/admin/byId/:documentId", "b", "frontend_permission_http", 1],
338
+ "documents_get_full_by_id": ["GET", "/documents/admin/byId/:documentId/full", "b", "frontend_permission_http", 1],
339
+ "documents_search": ["GET", "/documents/admin/search", "b", "frontend_permission_http", 2],
340
+ "documents_set_lock": ["PUT", "/documents/admin/lock/:documentId", "b", "frontend_permission_http", 5],
341
+ "documents_stream": ["GET", "/documents/admin/stream/:documentId", "b", "frontend_permission_http", 3],
342
+ "dunning_get_settings_external": ["GET", "/invoices/external/dunning/settings", "b", "unified_bearer", 2, ["invoices:read"]],
343
+ "dunning_issue_external": ["POST", "/invoices/external/dunning/:invoiceId/issue", "b", "unified_bearer", 5, ["invoices:write"]],
344
+ "dunning_notice_download_external": ["GET", "/invoices/external/dunning/notices/:noticeId/download", "b", "unified_bearer", 1, ["invoices:read"]],
345
+ "dunning_notice_pdf_external": ["GET", "/invoices/external/dunning/notices/:noticeId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
346
+ "dunning_preview_external": ["POST", "/invoices/external/dunning/:invoiceId/preview", "b", "unified_bearer", 5, ["invoices:read"]],
347
+ "dunning_suggestions_external": ["GET", "/invoices/external/dunning/suggestions", "b", "unified_bearer", 2, ["invoices:read"]],
348
+ "dunning_update_settings_external": ["PUT", "/invoices/external/dunning/settings", "b", "unified_bearer", 4, ["invoices:write"]],
349
+ "enterprise_onboarding_complete_step": ["POST", "/apps/enterprise/onboarding/complete-step", "b", "frontend_permission_http", 4],
350
+ "enterprise_onboarding_skip_step": ["POST", "/apps/enterprise/onboarding/skip-step", "b", "frontend_permission_http", 4],
351
+ "enterprise_onboarding_state_get": ["GET", "/apps/enterprise/onboarding/state", "b", "frontend_permission_http", 2],
352
+ "entitlements_assign": ["POST", "/entitlements", "b", "unified_bearer", 4, ["entitlements:write"]],
353
+ "entitlements_context_get_by_shop_assignment": ["GET", "/entitlements/context/by-shop-assignment/:shopAssignmentId", "b", "unified_bearer", 1, ["entitlements:read"]],
354
+ "entitlements_getAll": ["GET", "/entitlements/getAll", "b", "unified_bearer", 2, ["entitlements:read"]],
355
+ "entitlements_getAssigned": ["GET", "/entitlements/assigned", "b", "unified_bearer", 2, ["entitlements:read"]],
356
+ "entitlements_getById": ["GET", "/entitlements/:id", "b", "unified_bearer", 1, ["entitlements:read"]],
357
+ "entitlements_getUserEntitlements": ["GET", "/entitlements/user/:userId", "b", "unified_bearer", 1, ["entitlements:read"]],
358
+ "entitlements_get_state": ["GET", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:read"]],
359
+ "entitlements_list": ["GET", "/entitlements", "b", "unified_bearer", 2, ["entitlements:read"]],
360
+ "entitlements_revoke": ["DELETE", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:write"]],
361
+ "entitlements_update_state": ["PUT", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 5, ["entitlements:read", "entitlements:write"]],
362
+ "entitlements_usage_overages_pull": ["GET", "/entitlements/usage-overages", "b", "unified_bearer", 2, ["entitlements:read"]],
363
+ "exports_datev_buchungsstapel": ["GET", "/exports/bookkeeping/datev/buchungsstapel", "b", "frontend_permission_http", 0],
364
+ "exports_datev_metadata": ["GET", "/exports/bookkeeping/datev/metadata", "b", "frontend_permission_http", 0],
365
+ "invoice_dunning_delete_notice": ["DELETE", "/invoices/dunning/:invoiceId/notices/:noticeId", "b", "frontend_permission_http", 1],
366
+ "invoice_dunning_get_settings": ["GET", "/invoices/dunning/settings", "b", "frontend_permission_http", 2],
367
+ "invoice_dunning_issue": ["POST", "/invoices/dunning/:invoiceId/issue", "b", "frontend_permission_http", 5],
368
+ "invoice_dunning_list_notices": ["GET", "/invoices/dunning/:invoiceId/notices", "b", "frontend_permission_http", 1],
369
+ "invoice_dunning_notice_download": ["GET", "/invoices/dunning/notices/:noticeId/download", "b", "frontend_permission_http", 1],
370
+ "invoice_dunning_notice_pdf": ["GET", "/invoices/dunning/notices/:noticeId/pdf", "b", "frontend_permission_http", 1],
371
+ "invoice_dunning_preview": ["POST", "/invoices/dunning/:invoiceId/preview", "b", "frontend_permission_http", 5],
372
+ "invoice_dunning_suggestions": ["GET", "/invoices/dunning/suggestions", "b", "frontend_permission_http", 2],
373
+ "invoice_dunning_update_settings": ["PUT", "/invoices/dunning/settings", "b", "frontend_permission_http", 4],
374
+ "invoices_analysis": ["GET", "/invoices/:invoiceId/analysis", "b", "frontend_permission_http", 1],
375
+ "invoices_create_external": ["POST", "/invoices/external", "b", "unified_bearer", 4, ["invoices:write"]],
376
+ "invoices_create_manual": ["POST", "/invoices/manual", "b", "frontend_bearer_http", 4],
377
+ "invoices_credit_note_issue": ["POST", "/invoices/:invoiceId/credit-note/issue", "b", "frontend_permission_http", 5],
378
+ "invoices_credit_note_issue_external": ["POST", "/invoices/external/:invoiceId/credit-note/issue", "b", "unified_bearer", 5, ["invoices:publish"]],
379
+ "invoices_credit_note_preview": ["POST", "/invoices/:invoiceId/credit-note/preview", "b", "frontend_permission_http", 5],
380
+ "invoices_credit_note_preview_external": ["POST", "/invoices/external/:invoiceId/credit-note/preview", "b", "unified_bearer", 5, ["invoices:write"]],
381
+ "invoices_delete": ["DELETE", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
382
+ "invoices_delete_external": ["DELETE", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:delete"]],
383
+ "invoices_download_pdf": ["GET", "/invoices/:invoiceId/download", "n", "public", 3],
384
+ "invoices_download_pdf_external": ["GET", "/invoices/external/:invoiceId/download", "b", "unified_bearer", 1, ["invoices:read"]],
385
+ "invoices_get_by_id": ["GET", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
386
+ "invoices_get_by_id_external": ["GET", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:read"]],
387
+ "invoices_list_overdue": ["GET", "/invoices/overdue", "b", "frontend_permission_http", 2],
388
+ "invoices_list_pending": ["GET", "/invoices/pending", "b", "frontend_permission_http", 2],
389
+ "invoices_overdue_external": ["GET", "/invoices/external/overdue", "b", "unified_bearer", 2, ["invoices:read"]],
390
+ "invoices_payment_reconciliation": ["GET", "/invoices/:invoiceId/payment-reconciliation", "b", "frontend_permission_http", 1],
391
+ "invoices_pending_external": ["GET", "/invoices/external/pending", "b", "unified_bearer", 2, ["invoices:read"]],
392
+ "invoices_repair_pdf": ["POST", "/invoices/:invoiceId/repair-pdf", "b", "frontend_bearer_http", 1],
393
+ "invoices_search": ["GET", "/invoices", "b", "frontend_bearer_http", 2],
394
+ "invoices_search_external": ["GET", "/invoices/external", "b", "unified_bearer", 2, ["invoices:read"]],
395
+ "invoices_send_email_external": ["POST", "/invoices/external/:invoiceId/send-email", "b", "unified_bearer", 5, ["invoices:write"]],
396
+ "invoices_status_policy": ["GET", "/invoices/:invoiceId/status-policy", "b", "frontend_bearer_http", 1],
397
+ "invoices_status_policy_external": ["GET", "/invoices/external/:invoiceId/status-policy", "b", "unified_bearer", 1, ["invoices:read"]],
398
+ "invoices_update_status": ["PUT", "/invoices/:invoiceId/status", "b", "frontend_bearer_http", 5],
399
+ "invoices_update_status_external": ["PUT", "/invoices/external/:invoiceId/status", "b", "unified_bearer", 5, ["invoices:write"]],
400
+ "invoices_view_pdf": ["GET", "/invoices/:invoiceId/pdf", "n", "public", 3],
401
+ "invoices_view_pdf_external": ["GET", "/invoices/external/:invoiceId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
402
+ "logs_delete": ["DELETE", "/app-logs/delete/:logId", "b", "frontend_permission_http", 1],
403
+ "logs_delete_bulk": ["DELETE", "/app-logs/delete/mass/:logIds", "b", "frontend_permission_http", 1],
404
+ "logs_search": ["GET", "/app-logs/search", "b", "frontend_permission_http", 2],
405
+ "managing_companies_api_keys_by_id": ["GET", "/managing-companies/api-keys/byId/:apiKeyId", "b", "frontend_permission_http", 1],
406
+ "managing_companies_api_keys_create": ["POST", "/managing-companies/api-keys/create", "b", "frontend_permission_http", 4],
407
+ "managing_companies_api_keys_delete": ["DELETE", "/managing-companies/api-keys/delete/:apiKeyId", "b", "frontend_permission_http", 1],
408
+ "managing_companies_api_keys_list": ["GET", "/managing-companies/api-keys/list", "b", "frontend_permission_http", 2],
409
+ "managing_companies_api_keys_revoke": ["POST", "/managing-companies/api-keys/revoke/:apiKeyId", "b", "frontend_permission_http", 1],
410
+ "managing_companies_api_keys_update": ["PUT", "/managing-companies/api-keys/update/:apiKeyId", "b", "frontend_permission_http", 5],
411
+ "managing_companies_cost_centers_by_id": ["GET", "/managing-companies/cost-centers/byId/:id", "b", "frontend_permission_http", 1],
412
+ "managing_companies_cost_centers_by_ids": ["GET", "/managing-companies/cost-centers/by-ids", "b", "frontend_permission_http", 2],
413
+ "managing_companies_cost_centers_create": ["POST", "/managing-companies/cost-centers/create", "b", "frontend_permission_http", 4],
414
+ "managing_companies_cost_centers_delete": ["DELETE", "/managing-companies/cost-centers/delete/:id", "b", "frontend_permission_http", 1],
415
+ "managing_companies_cost_centers_list": ["GET", "/managing-companies/cost-centers/list/:managingCompanyId", "b", "frontend_permission_http", 3],
416
+ "managing_companies_cost_centers_logos_delete": ["DELETE", "/managing-companies/cost-centers/logos/delete/:id/:mode", "b", "frontend_permission_http", 1],
417
+ "managing_companies_cost_centers_logos_settings": ["GET", "/managing-companies/cost-centers/logos/settings/:id", "b", "frontend_permission_http", 1],
418
+ "managing_companies_cost_centers_logos_upload": ["POST", "/managing-companies/cost-centers/logos/upload/:id/:mode", "b", "frontend_permission_http", 1],
419
+ "managing_companies_cost_centers_logos_urls": ["GET", "/managing-companies/cost-centers/logos/urls/:id", "b", "frontend_permission_http", 1],
420
+ "managing_companies_cost_centers_my": ["GET", "/managing-companies/cost-centers/my/:managingCompanyId", "b", "frontend_permission_http", 1],
421
+ "managing_companies_cost_centers_update": ["PUT", "/managing-companies/cost-centers/update/:id", "b", "frontend_permission_http", 5],
422
+ "managing_companies_create": ["POST", "/managing-companies", "b", "frontend_permission_http", 4],
423
+ "managing_companies_current_external": ["GET", "/managing-companies/external/current", "b", "unified_bearer", 2, ["companies:read"]],
424
+ "managing_companies_delete": ["DELETE", "/managing-companies/:id", "b", "frontend_permission_http", 1],
425
+ "managing_companies_get_by_id": ["GET", "/managing-companies/:id", "b", "frontend_permission_http", 1],
426
+ "managing_companies_invites_accept": ["POST", "/managing-companies/invites/accept/:token", "b", "frontend_bearer_http", 1],
427
+ "managing_companies_invites_cancel": ["DELETE", "/managing-companies/invites/cancel/:inviteId", "b", "frontend_bearer_http", 5],
428
+ "managing_companies_invites_pending_company": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId", "b", "frontend_permission_http", 3],
429
+ "managing_companies_invites_pending_company_preview": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId/preview", "b", "frontend_bearer_http", 3],
430
+ "managing_companies_invites_pending_user": ["GET", "/managing-companies/invites/pending/user", "b", "frontend_permission_http", 2],
431
+ "managing_companies_invites_reject": ["POST", "/managing-companies/invites/reject/:token", "b", "frontend_bearer_http", 1],
432
+ "managing_companies_invoice_layouts_catalog": ["GET", "/managing-companies/invoice-layouts/catalog", "b", "frontend_bearer_http", 2],
433
+ "managing_companies_invoice_layouts_effective": ["GET", "/managing-companies/invoice-layouts/effective", "b", "frontend_bearer_http", 2],
434
+ "managing_companies_invoice_layouts_preview": ["GET", "/managing-companies/invoice-layouts/preview", "b", "frontend_bearer_http", 2],
435
+ "managing_companies_invoice_layouts_previews": ["GET", "/managing-companies/invoice-layouts/previews", "b", "frontend_bearer_http", 2],
436
+ "managing_companies_invoice_templates_archive": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/archive", "b", "frontend_bearer_http", 1],
437
+ "managing_companies_invoice_templates_create": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/create", "b", "frontend_bearer_http", 5],
438
+ "managing_companies_invoice_templates_duplicate": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/duplicate", "b", "frontend_bearer_http", 5],
439
+ "managing_companies_invoice_templates_from_invoice": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/from-invoice", "b", "frontend_bearer_http", 5],
440
+ "managing_companies_invoice_templates_get": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 1],
441
+ "managing_companies_invoice_templates_list": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/list", "b", "frontend_bearer_http", 3],
442
+ "managing_companies_invoice_templates_update": ["PUT", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 5],
443
+ "managing_companies_invoice_transparency_context": ["GET", "/managing-companies/invoice-transparency/:managingCompanyId/context", "b", "frontend_bearer_http", 1],
444
+ "managing_companies_invoice_transparency_quote": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/quote", "b", "frontend_bearer_http", 5],
445
+ "managing_companies_item_type_configs_archive": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value/archive", "b", "frontend_bearer_http", 1],
446
+ "managing_companies_item_type_configs_create": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs", "b", "frontend_bearer_http", 5],
447
+ "managing_companies_item_type_configs_update": ["PUT", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value", "b", "frontend_bearer_http", 5],
448
+ "managing_companies_list": ["GET", "/managing-companies", "b", "frontend_permission_http", 2],
449
+ "managing_companies_logos_delete": ["DELETE", "/managing-companies/logos/delete/:mode", "b", "frontend_bearer_http", 1],
450
+ "managing_companies_logos_set_mode": ["PUT", "/managing-companies/logos/mode", "b", "frontend_bearer_http", 4],
451
+ "managing_companies_logos_settings": ["GET", "/managing-companies/logos/settings", "b", "frontend_bearer_http", 2],
452
+ "managing_companies_logos_upload": ["POST", "/managing-companies/logos/upload/:mode", "b", "frontend_bearer_http", 1],
453
+ "managing_companies_logos_urls": ["GET", "/managing-companies/logos/urls", "b", "frontend_bearer_http", 2],
454
+ "managing_companies_selected_current": ["GET", "/managing-companies/selected/current", "b", "frontend_bearer_http", 2],
455
+ "managing_companies_selected_set": ["POST", "/managing-companies/selected/set/:companyId", "b", "frontend_bearer_http", 1],
456
+ "managing_companies_update": ["PUT", "/managing-companies/:id", "b", "frontend_permission_http", 5],
457
+ "managing_companies_user_assignments_assign": ["POST", "/managing-companies/user-assignments/assign", "b", "frontend_permission_http", 4],
458
+ "managing_companies_user_assignments_cost_centers_add": ["POST", "/managing-companies/user-assignments/cost-centers/add", "b", "frontend_permission_http", 4],
459
+ "managing_companies_user_assignments_cost_centers_remove": ["POST", "/managing-companies/user-assignments/cost-centers/remove", "b", "frontend_permission_http", 4],
460
+ "managing_companies_user_assignments_list": ["GET", "/managing-companies/user-assignments/list/:companyId", "b", "frontend_permission_http", 3],
461
+ "managing_companies_user_assignments_revoke": ["POST", "/managing-companies/user-assignments/revoke", "b", "frontend_permission_http", 4],
462
+ "managing_companies_user_assignments_update": ["PUT", "/managing-companies/user-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
463
+ "managing_companies_vat_settings_decision_upsert": ["PUT", "/managing-companies/vat-settings/:companyId/decisions/:decisionKey", "b", "frontend_bearer_http", 5],
464
+ "managing_companies_vat_settings_get": ["GET", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 1],
465
+ "managing_companies_vat_settings_tax_alerts": ["GET", "/managing-companies/vat-settings/:companyId/tax-alerts", "b", "frontend_bearer_http", 1],
466
+ "managing_companies_vat_settings_upsert": ["POST", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 5],
467
+ "oauth2_clients_audit": ["GET", "/oauth/clients/audit/:id", "b", "frontend_bearer_http", 3],
468
+ "oauth2_clients_create": ["POST", "/oauth/clients/create", "b", "frontend_bearer_http", 4],
469
+ "oauth2_clients_list": ["GET", "/oauth/clients/list", "b", "frontend_bearer_http", 2],
470
+ "oauth2_clients_revoke": ["DELETE", "/oauth/clients/revoke/:id", "b", "frontend_bearer_http", 1],
471
+ "oauth2_clients_update": ["PUT", "/oauth/clients/update/:id", "b", "frontend_bearer_http", 5],
472
+ "oauth2_external_clients_create": ["POST", "/oauth/clients/external", "k", "x_api_key_https", 4],
473
+ "oauth2_external_clients_delete": ["DELETE", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
474
+ "oauth2_external_clients_get": ["GET", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
475
+ "oauth2_external_clients_list": ["GET", "/oauth/clients/external/list", "k", "x_api_key_https", 2],
476
+ "oauth2_external_clients_retire": ["POST", "/oauth/clients/external/:idOrClientId/retire", "k", "x_api_key_https", 1],
477
+ "oauth2_external_clients_revoke": ["POST", "/oauth/clients/external/:idOrClientId/revoke", "k", "x_api_key_https", 1],
478
+ "oauth2_external_clients_rollback": ["POST", "/oauth/clients/external/:idOrClientId/rollback", "k", "x_api_key_https", 1],
479
+ "oauth2_external_clients_rotate": ["POST", "/oauth/clients/external/:idOrClientId/rotate", "k", "x_api_key_https", 1],
480
+ "oauth2_external_clients_update": ["PUT", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 5],
481
+ "oauth2_revoke": ["POST", "/oauth/revoke", "n", "public", 0],
482
+ "oauth2_scopes_list": ["GET", "/oauth/scopes", "b", "frontend_bearer_http", 2],
483
+ "oauth2_token": ["POST", "/oauth/token", "n", "public", 0],
484
+ "payments_allocate": ["POST", "/bookkeeping/payments/allocate/:paymentId", "b", "frontend_permission_http", 5],
485
+ "payments_allocation_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reversal-preview", "b", "frontend_permission_http", 1],
486
+ "payments_allocation_reverse": ["POST", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reverse", "b", "frontend_permission_http", 1],
487
+ "payments_apply_discount": ["POST", "/bookkeeping/payments/:paymentId/discount", "b", "frontend_permission_http", 5],
488
+ "payments_archive_account": ["POST", "/bookkeeping/payments/accounts/:accountId/archive", "b", "frontend_permission_http", 1],
489
+ "payments_book": ["POST", "/bookkeeping/payments/:paymentId/book", "b", "frontend_permission_http", 5],
490
+ "payments_booking_payment_suggestions": ["GET", "/bookkeeping/payments/booking-match/:targetType/:targetId/payment-suggestions", "b", "frontend_permission_http", 3],
491
+ "payments_cashbook": ["GET", "/bookkeeping/payments/cashbook", "b", "frontend_permission_http", 2],
492
+ "payments_confirm_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/confirm", "b", "frontend_permission_http", 4],
493
+ "payments_create_account": ["POST", "/bookkeeping/payments/accounts/create", "b", "frontend_permission_http", 4],
494
+ "payments_create_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 4],
495
+ "payments_create_import_profile": ["POST", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 4],
496
+ "payments_create_manual": ["POST", "/bookkeeping/payments/manual", "b", "frontend_permission_http", 4],
497
+ "payments_delete": ["DELETE", "/bookkeeping/payments/:paymentId", "b", "frontend_permission_http", 1],
498
+ "payments_delete_account": ["DELETE", "/bookkeeping/payments/accounts/:accountId", "b", "frontend_permission_http", 1],
499
+ "payments_download_csv_template": ["GET", "/bookkeeping/payments/import/csv/template/:profileKey", "b", "frontend_permission_http", 1],
500
+ "payments_get_account_by_id": ["GET", "/bookkeeping/payments/accounts/bdId/:accountId", "b", "frontend_permission_http", 1],
501
+ "payments_import_csv": ["POST", "/bookkeeping/payments/import/csv", "b", "frontend_permission_http", 4],
502
+ "payments_import_csv_preview": ["POST", "/bookkeeping/payments/import/csv/preview", "b", "frontend_permission_http", 4],
503
+ "payments_list_accounts": ["GET", "/bookkeeping/payments/accounts", "b", "frontend_permission_http", 2],
504
+ "payments_list_balance_snapshots": ["GET", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 2],
505
+ "payments_list_csv_profiles": ["GET", "/bookkeeping/payments/import/csv/profiles", "b", "frontend_permission_http", 0],
506
+ "payments_list_fee_proposals": ["GET", "/bookkeeping/payments/fee-proposals", "b", "frontend_permission_http", 2],
507
+ "payments_list_import_profiles": ["GET", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 2],
508
+ "payments_match_suggestions": ["GET", "/bookkeeping/payments/match/:paymentId/suggestions", "b", "frontend_permission_http", 3],
509
+ "payments_paypal_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/sync", "b", "frontend_permission_http", 3],
510
+ "payments_paypal_webhook_deregister": ["DELETE", "/bookkeeping/payments/accounts/:accountId/paypal/webhook", "b", "frontend_permission_http", 1],
511
+ "payments_paypal_webhook_receive": ["POST", "/bookkeeping/payments/public/paypal/webhook", "n", "public", 0],
512
+ "payments_paypal_webhook_register": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/webhook/register", "b", "frontend_permission_http", 5],
513
+ "payments_record_fee": ["POST", "/bookkeeping/payments/:paymentId/fee", "b", "frontend_permission_http", 5],
514
+ "payments_reject_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/reject", "b", "frontend_permission_http", 4],
515
+ "payments_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/reversal-preview", "b", "frontend_permission_http", 1],
516
+ "payments_reverse": ["POST", "/bookkeeping/payments/:paymentId/reverse", "b", "frontend_permission_http", 5],
517
+ "payments_search": ["GET", "/bookkeeping/payments/search", "b", "frontend_permission_http", 2],
518
+ "payments_sumup_oauth_callback": ["GET", "/bookkeeping/payments/public/sumup/oauth/callback", "n", "public", 2],
519
+ "payments_sumup_oauth_disconnect": ["DELETE", "/bookkeeping/payments/accounts/:accountId/sumup/oauth", "b", "frontend_permission_http", 1],
520
+ "payments_sumup_oauth_start": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/oauth/start", "b", "frontend_permission_http", 5],
521
+ "payments_sumup_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/sync", "b", "frontend_permission_http", 3],
522
+ "payments_transfer_link": ["POST", "/bookkeeping/payments/transfer/link", "b", "frontend_permission_http", 4],
523
+ "payments_transfer_linkable": ["GET", "/bookkeeping/payments/:paymentId/transfer/linkable", "b", "frontend_permission_http", 3],
524
+ "payments_transfer_unlink": ["POST", "/bookkeeping/payments/:paymentId/transfer/unlink", "b", "frontend_permission_http", 5],
525
+ "payments_unallocate": ["DELETE", "/bookkeeping/payments/allocations/:paymentId/:allocationId", "b", "frontend_permission_http", 1],
526
+ "payments_update": ["PUT", "/bookkeeping/payments/update/:paymentId", "b", "frontend_permission_http", 5],
527
+ "payments_update_account": ["PUT", "/bookkeeping/payments/accounts/update/:accountId", "b", "frontend_permission_http", 5],
528
+ "payments_update_fee_vat_treatment": ["PUT", "/bookkeeping/payments/accounts/:accountId/fee-vat-treatment", "b", "frontend_permission_http", 5],
529
+ "payments_update_import_profile": ["PUT", "/bookkeeping/payments/import/profiles/:id", "b", "frontend_permission_http", 5],
530
+ "payments_void_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots/:snapshotId/void", "b", "frontend_permission_http", 5],
531
+ "payments_writeoff": ["POST", "/bookkeeping/payments/:paymentId/writeoff", "b", "frontend_permission_http", 5],
532
+ "permissions_assign_to_role": ["POST", "/permissions/assign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
533
+ "permissions_assignments_list": ["GET", "/permissions/getAssignments", "b", "composite_and", 2],
534
+ "permissions_create": ["POST", "/permissions/create", "b", "frontend_permission_http", 4],
535
+ "permissions_list": ["GET", "/permissions/getAll", "b", "frontend_permission_http", 2],
536
+ "permissions_sync": ["POST", "/permissions/sync", "b", "frontend_permission_http", 2],
537
+ "permissions_unassign_from_role": ["DELETE", "/permissions/unassign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
538
+ "reconciliation_auto_match_confirm": ["POST", "/bookkeeping/reconciliation/auto-match/confirm", "b", "frontend_permission_http", 4],
539
+ "reconciliation_auto_match_preview": ["GET", "/bookkeeping/reconciliation/auto-match/preview", "b", "frontend_permission_http", 2],
540
+ "reconciliation_batch_suggestions": ["POST", "/bookkeeping/reconciliation/batch-suggestions", "b", "frontend_permission_http", 4],
541
+ "reconciliation_confirm_provider_payout": ["POST", "/bookkeeping/reconciliation/confirm-provider-payout", "b", "frontend_permission_http", 4],
542
+ "reconciliation_dashboard": ["GET", "/bookkeeping/reconciliation/dashboard", "b", "frontend_permission_http", 2],
543
+ "reconciliation_groups": ["GET", "/bookkeeping/reconciliation/groups", "b", "frontend_permission_http", 2],
544
+ "reconciliation_queue": ["GET", "/bookkeeping/reconciliation/queue", "b", "frontend_permission_http", 2],
545
+ "role_assignments_create": ["POST", "/role-assignments/create/:userId/:roleId", "b", "frontend_permission_http", 5],
546
+ "role_assignments_get_user_assignments": ["GET", "/role-assignments/getUserAssignments/:userId", "b", "frontend_permission_http", 1],
547
+ "role_assignments_list": ["GET", "/role-assignments/getAll", "b", "frontend_permission_http", 2],
548
+ "role_assignments_revoke": ["DELETE", "/role-assignments/delete/:userId/:roleId", "b", "frontend_permission_http", 1],
549
+ "roles_create": ["POST", "/roles/create", "b", "frontend_permission_http", 4],
550
+ "roles_delete": ["DELETE", "/roles/delete/:roleId", "b", "frontend_permission_http", 1],
551
+ "roles_get_by_id": ["GET", "/roles/getById/:roleId", "b", "frontend_permission_http", 1],
552
+ "roles_list": ["GET", "/roles/getAll", "b", "frontend_permission_http", 2],
553
+ "roles_update": ["PUT", "/roles/update/:roleId", "b", "frontend_permission_http", 5],
554
+ "settings_list": ["GET", "/settings/getAll", "b", "frontend_bearer_http", 2],
555
+ "settings_update": ["PUT", "/settings/update/:settingId/:key", "b", "frontend_permission_http", 5],
556
+ "user_activity_overview_get": ["POST", "/user-activity/user/:userId", "b", "frontend_permission_http", 5],
557
+ "user_activity_users_stats_list": ["GET", "/user-activity/users", "b", "frontend_permission_http", 2],
558
+ "users_create": ["POST", "/users/create", "b", "frontend_bearer_http", 4],
559
+ "users_delete": ["DELETE", "/users/delete/:userId", "b", "frontend_permission_http", 1],
560
+ "users_delete_external": ["DELETE", "/users/delete/external/:frontendUserId", "b", "frontend_bearer_http", 1],
561
+ "users_get_by_email": ["GET", "/users/getByEmail/:email", "b", "frontend_permission_http", 1],
562
+ "users_get_by_external_user_id": ["GET", "/users/getByExternalUserId/:externalUserId", "b", "frontend_bearer_http", 1],
563
+ "users_get_by_id": ["GET", "/users/getById/:userId", "b", "frontend_bearer_http", 3],
564
+ "users_list": ["GET", "/users/getAll", "b", "frontend_permission_http", 2],
565
+ "users_search": ["GET", "/users/search", "b", "frontend_permission_http", 2],
566
+ "users_update_external": ["PUT", "/users/update/external/:frontendUserId", "b", "frontend_bearer_http", 5],
567
+ "webhooks_delete": ["DELETE", "/webhooks/delete/:webhookId", "b", "frontend_permission_http", 1],
568
+ "webhooks_delete_bulk": ["DELETE", "/webhooks/delete/mass/:webhookIds", "b", "frontend_permission_http", 1],
569
+ "webhooks_list": ["GET", "/webhooks/getAll", "b", "frontend_permission_http", 2],
570
+ "work_tracking_approve": ["POST", "/apps/admin/work-tracking/approve/:workEntryId", "b", "frontend_permission_http", 5],
571
+ "work_tracking_assignment_create": ["POST", "/apps/admin/work-tracking/assignments/create", "b", "frontend_permission_http", 4],
572
+ "work_tracking_assignment_delete": ["DELETE", "/apps/admin/work-tracking/assignments/delete/:workEntryAssignmentId", "b", "frontend_permission_http", 1],
573
+ "work_tracking_assignment_update": ["PUT", "/apps/admin/work-tracking/assignments/update/:workEntryAssignmentId", "b", "frontend_permission_http", 5],
574
+ "work_tracking_bill": ["POST", "/apps/admin/work-tracking/bill", "b", "frontend_permission_http", 4],
575
+ "work_tracking_bill_preview": ["POST", "/apps/admin/work-tracking/bill/preview", "b", "frontend_permission_http", 4],
576
+ "work_tracking_create": ["POST", "/apps/admin/work-tracking/create", "b", "frontend_permission_http", 4],
577
+ "work_tracking_delete": ["DELETE", "/apps/admin/work-tracking/delete/:workEntryId", "b", "frontend_permission_http", 1],
578
+ "work_tracking_get_by_id": ["GET", "/apps/admin/work-tracking/byId/:workEntryId", "b", "frontend_permission_http", 1],
579
+ "work_tracking_get_my_role": ["GET", "/apps/admin/work-tracking/my-role", "b", "frontend_permission_http", 2],
580
+ "work_tracking_list": ["GET", "/apps/admin/work-tracking/list", "b", "frontend_permission_http", 2],
581
+ "work_tracking_reject": ["POST", "/apps/admin/work-tracking/reject/:workEntryId", "b", "frontend_permission_http", 5],
582
+ "work_tracking_update": ["PUT", "/apps/admin/work-tracking/update/:workEntryId", "b", "frontend_permission_http", 5]
583
+ };
584
+
585
+ // src/operations.ts
586
+ var API_KEY_AUTH_TYPES = /* @__PURE__ */ new Set(["x_api_key_http", "x_api_key_https"]);
587
+ var PUBLIC_AUTH_TYPES = /* @__PURE__ */ new Set(["public"]);
588
+ var VALIDATES_PARAMS = 1;
589
+ var VALIDATES_QUERY = 2;
590
+ var VALIDATES_BODY = 4;
591
+ var CHANNEL_BY_CODE = {
592
+ b: "bearer",
593
+ k: "api_key",
594
+ n: "none"
595
+ };
596
+ function authChannelForContractType(authType) {
597
+ if (!authType) return "bearer";
598
+ if (API_KEY_AUTH_TYPES.has(authType)) return "api_key";
599
+ if (PUBLIC_AUTH_TYPES.has(authType)) return "none";
600
+ return "bearer";
601
+ }
602
+ function toOperation(operationId, entry) {
603
+ const [method, path, channelCode, authType, validated, scopes] = entry;
604
+ return {
605
+ operationId,
606
+ method,
607
+ path,
608
+ authType,
609
+ // Der Code in der Tabelle ist bereits das Ergebnis von
610
+ // `authChannelForContractType` zur Erzeugungszeit; faellt er unbekannt aus,
611
+ // gilt dieselbe Regel noch einmal statt einer stillen Voreinstellung.
612
+ channel: CHANNEL_BY_CODE[channelCode] ?? authChannelForContractType(authType),
613
+ validated: {
614
+ params: (validated & VALIDATES_PARAMS) !== 0,
615
+ query: (validated & VALIDATES_QUERY) !== 0,
616
+ body: (validated & VALIDATES_BODY) !== 0
617
+ },
618
+ scopes: scopes ? [...scopes] : []
619
+ };
620
+ }
621
+ var cachedOperations = null;
622
+ function listOperations() {
623
+ if (!cachedOperations) {
624
+ cachedOperations = Object.entries(ROUTE_INDEX).map(
625
+ ([operationId, entry]) => toOperation(operationId, entry)
626
+ );
627
+ }
628
+ return cachedOperations;
629
+ }
630
+ function describeOperation(operationId) {
631
+ const entry = ROUTE_INDEX[operationId];
632
+ return entry ? toOperation(operationId, entry) : null;
633
+ }
634
+ var cachedPathIndex = null;
635
+ function pathIndex() {
636
+ if (cachedPathIndex) return cachedPathIndex;
637
+ const index = /* @__PURE__ */ new Map();
638
+ for (const operation of listOperations()) {
639
+ const segments = splitPath(operation.path);
640
+ const key = `${operation.method} ${segments.length}`;
641
+ const bucket = index.get(key);
642
+ if (bucket) bucket.push({ segments, operation });
643
+ else index.set(key, [{ segments, operation }]);
644
+ }
645
+ cachedPathIndex = index;
646
+ return index;
647
+ }
648
+ function splitPath(path) {
649
+ return path.split("/").filter((segment) => segment.length > 0);
650
+ }
651
+ function resolveOperation(method, path) {
652
+ const wanted = splitPath(path.split("?")[0] ?? path);
653
+ const bucket = pathIndex().get(`${method.toUpperCase()} ${wanted.length}`);
654
+ if (!bucket) return null;
655
+ let best = null;
656
+ for (const entry of bucket) {
657
+ let score = 0;
658
+ let matches = true;
659
+ for (let i = 0; i < wanted.length; i++) {
660
+ const template = entry.segments[i];
661
+ if (template.startsWith(":")) continue;
662
+ if (template === decodeSegment(wanted[i])) score++;
663
+ else {
664
+ matches = false;
665
+ break;
666
+ }
667
+ }
668
+ if (!matches) continue;
669
+ if (!best || score > best.score) best = { score, operation: entry.operation };
670
+ }
671
+ return best?.operation ?? null;
672
+ }
673
+ function decodeSegment(segment) {
674
+ try {
675
+ return decodeURIComponent(segment);
676
+ } catch {
677
+ return segment;
678
+ }
679
+ }
680
+ var OrvelloOperationError = class extends Error {
681
+ constructor(message, operationId) {
682
+ super(message);
683
+ this.operationId = operationId;
684
+ this.name = "OrvelloOperationError";
685
+ }
686
+ operationId;
687
+ };
688
+ function buildPath(operationId, params) {
689
+ const operation = describeOperation(operationId);
690
+ if (!operation) {
691
+ throw new OrvelloOperationError(
692
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against.`,
693
+ operationId
694
+ );
695
+ }
696
+ return "/" + splitPath(operation.path).map((segment) => {
697
+ if (!segment.startsWith(":")) return segment;
698
+ const name = segment.slice(1);
699
+ const value = params?.[name];
700
+ if (value === void 0 || value === null || value === "") {
701
+ throw new OrvelloOperationError(
702
+ `orvello operation "${operationId}" needs the path parameter "${name}" (${operation.method} ${operation.path}).`,
703
+ operationId
704
+ );
705
+ }
706
+ return encodeURIComponent(String(value));
707
+ }).join("/");
708
+ }
709
+
710
+ // src/capabilities.ts
711
+ var SDK_VERSION2 = "0.2.0" ;
712
+ var CLIENT_MANAGEMENT_OPS = [
713
+ "oauth2_external_clients_list",
714
+ "oauth2_external_clients_get",
715
+ "oauth2_external_clients_create",
716
+ "oauth2_external_clients_update",
717
+ "oauth2_external_clients_delete"
718
+ ];
719
+ var CLIENT_ROTATION_OPS = ["oauth2_external_clients_rotate"];
720
+ var GRACE_PERIOD_OPS = ["oauth2_external_clients_retire", "oauth2_external_clients_rollback"];
721
+ var REVOCATION_OPS = ["oauth2_external_clients_revoke"];
722
+ function capabilityFrom(operationIds, reasonWhenMissing) {
723
+ const present = operationIds.filter((id) => describeOperation(id) !== null);
724
+ if (present.length === operationIds.length) {
725
+ return { supported: true, operations: present };
726
+ }
727
+ const missing = operationIds.filter((id) => !present.includes(id));
728
+ return {
729
+ supported: false,
730
+ operations: present,
731
+ reason: `${reasonWhenMissing} Fehlend im Vertrag: ${missing.join(", ")}.`
732
+ };
733
+ }
734
+ function capabilityFromPrefix(prefix, reasonWhenMissing) {
735
+ const present = listOperations().filter((operation) => operation.operationId.startsWith(prefix)).map((operation) => operation.operationId);
736
+ return present.length > 0 ? { supported: true, operations: present } : { supported: false, operations: [], reason: reasonWhenMissing };
737
+ }
738
+ function orvelloCapabilities() {
739
+ const operations = listOperations();
740
+ const authChannels = { bearer: 0, api_key: 0, none: 0 };
741
+ for (const operation of operations) authChannels[operation.channel]++;
742
+ return {
743
+ service: "orvello",
744
+ sdkVersion: SDK_VERSION2,
745
+ contractSha256: CONTRACT_SHA256,
746
+ operationCount: operations.length,
747
+ authChannels,
748
+ capabilities: {
749
+ // `/health/contract` ist bewusst KEINE Vertrags-Route: der Endpunkt
750
+ // beschreibt den Vertrag und kann deshalb nicht in ihm stehen. Er gehoert
751
+ // zur Zusage dieses SDK und wird von `diagnoseOrvello` live geprueft.
752
+ contractFingerprint: {
753
+ supported: true,
754
+ operations: []
755
+ },
756
+ healthCheck: capabilityFrom(
757
+ ["app_info_health"],
758
+ "Ohne Erreichbarkeits-Endpunkt bleibt nur der Umweg ueber eine echte Anfrage."
759
+ ),
760
+ clientManagement: capabilityFrom(
761
+ CLIENT_MANAGEMENT_OPS,
762
+ "Ohne diese Routen kann ein Verwalter keine Zugaenge fuer andere Apps ausstellen."
763
+ ),
764
+ clientRotation: capabilityFrom(
765
+ CLIENT_ROTATION_OPS,
766
+ "Ohne Erneuerung ist ein einmal ausgegebenes Geheimnis dauerhaft."
767
+ ),
768
+ rotationGracePeriod: capabilityFrom(
769
+ GRACE_PERIOD_OPS,
770
+ "Ohne Rueckzug und Ruecknahme ist jede Erneuerung ein harter Schnitt."
771
+ ),
772
+ clientRevocation: capabilityFrom(
773
+ REVOCATION_OPS,
774
+ "Ohne Widerruf bleibt ein kompromittierter Zugang bis zum Ablauf gueltig."
775
+ ),
776
+ entitlements: capabilityFromPrefix(
777
+ "entitlements_",
778
+ "Dieser Vertrag kennt keine Berechtigungs-Routen."
779
+ ),
780
+ invoicing: capabilityFromPrefix(
781
+ "invoices_",
782
+ "Dieser Vertrag kennt keine Rechnungs-Routen."
783
+ ),
784
+ serverSideDryRun: {
785
+ supported: false,
786
+ operations: [],
787
+ reason: "orvello bietet keinen serverseitigen Probelauf fuer die Client-Verwaltung an (`dryRun` gibt es nur in der Buchhaltung). Nebenwirkungsfrei pruefbar ist der Weg trotzdem: `preflightOrvello` beweist Erreichbarkeit, Vertrag und Credential, ohne zu schreiben \u2014 es beweist damit die Berechtigung, nicht das Ergebnis."
788
+ }
789
+ }
790
+ };
791
+ }
792
+
793
+ // src/preflight.ts
794
+ function step(name, ok, detail, skipped = false) {
795
+ return { name, ok, skipped, detail };
796
+ }
797
+ async function preflightOrvello(host, operationId, options = {}) {
798
+ const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
799
+ const steps = [];
800
+ const problems = [];
801
+ const report = (extra) => ({
802
+ ok: problems.length === 0,
803
+ operationId,
804
+ method: null,
805
+ path: null,
806
+ baseUrl: null,
807
+ authChannel: null,
808
+ sideEffects: "none",
809
+ serverSideDryRun: false,
810
+ steps,
811
+ problems,
812
+ checkedAt,
813
+ ...extra
814
+ });
815
+ const operation = describeOperation(operationId);
816
+ if (!operation) {
817
+ steps.push(
818
+ step(
819
+ "operation",
820
+ false,
821
+ `Der Vertrag, gegen den dieses SDK gebaut wurde, kennt "${operationId}" nicht. Entweder ist der Name falsch, oder das SDK ist aelter als der Dienst.`
822
+ )
823
+ );
824
+ problems.push(`Unbekannte Operation "${operationId}".`);
825
+ return report({});
826
+ }
827
+ steps.push(
828
+ step(
829
+ "operation",
830
+ true,
831
+ `${operation.method} ${operation.path} (Auth laut Vertrag: ${operation.authType || "keine Angabe"} \u2192 Bahn "${operation.channel}").`
832
+ )
833
+ );
834
+ let path = null;
835
+ try {
836
+ path = buildPath(operationId, options.params);
837
+ steps.push(step("path-parameters", true, `Gerufen wuerde: ${operation.method} ${path}`));
838
+ } catch (error) {
839
+ const detail = error instanceof OrvelloOperationError ? error.message : String(error);
840
+ steps.push(step("path-parameters", false, detail));
841
+ problems.push(detail);
842
+ return report({ method: operation.method, authChannel: operation.channel });
843
+ }
844
+ const shapeProblems = [];
845
+ if (operation.validated.body && options.body === void 0) {
846
+ shapeProblems.push("Der Dienst validiert einen Body, es wurde aber keiner uebergeben.");
847
+ }
848
+ if (!operation.validated.body && options.body !== void 0) {
849
+ shapeProblems.push("Es wurde ein Body uebergeben, den diese Route nicht auswertet.");
850
+ }
851
+ if (operation.validated.query && options.query === void 0) {
852
+ shapeProblems.push(
853
+ "Die Route validiert Query-Parameter; ohne uebergebene Werte gelten allein die Voreinstellungen des Dienstes."
854
+ );
855
+ }
856
+ if (shapeProblems.length === 0) {
857
+ steps.push(step("request-shape", true, "Body- und Query-Erwartung des Vertrags sind erfuellt."));
858
+ } else {
859
+ const hard = operation.validated.body && options.body === void 0;
860
+ steps.push(step("request-shape", !hard, shapeProblems.join(" ")));
861
+ if (hard) problems.push(shapeProblems[0]);
862
+ }
863
+ const baseUrl = await host.resolveBaseUrl().catch(() => null);
864
+ if (!baseUrl) {
865
+ steps.push(step("reachable", false, "Die Basis-URL des Dienstes konnte nicht aufgeloest werden."));
866
+ problems.push("Basis-URL nicht aufloesbar.");
867
+ return report({ method: operation.method, path, authChannel: operation.channel });
868
+ }
869
+ const timeoutMs = options.timeoutMs ?? 8e3;
870
+ const reachable = await probeReachable(host, baseUrl, timeoutMs, options.signal);
871
+ steps.push(step("reachable", reachable.ok, reachable.detail));
872
+ if (!reachable.ok) {
873
+ problems.push(reachable.detail);
874
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
875
+ }
876
+ const diagnosis = await diagnoseOrvello({
877
+ baseUrl,
878
+ fetch: host.fetchImpl(),
879
+ timeoutMs,
880
+ signal: options.signal
881
+ });
882
+ if (diagnosis.contract.status === "match") {
883
+ steps.push(step("contract", true, `Vertrag stimmt ueberein (${diagnosis.contract.sdk.slice(0, 12)}).`));
884
+ } else if (diagnosis.contract.status === "drift") {
885
+ const detail = diagnosis.problems[0] ?? "Vertrags-Abweichung zwischen SDK und Dienst.";
886
+ steps.push(step("contract", false, detail));
887
+ problems.push(detail);
888
+ } else {
889
+ steps.push(
890
+ step(
891
+ "contract",
892
+ false,
893
+ diagnosis.problems[0] ?? "Der Vertrag der Gegenstelle konnte nicht ermittelt werden.",
894
+ true
895
+ )
896
+ );
897
+ }
898
+ if (operation.channel === "none") {
899
+ steps.push(step("credential-configured", true, "Die Route ist oeffentlich und braucht kein Credential.", true));
900
+ steps.push(step("credential-accepted", true, "Entfaellt: oeffentliche Route.", true));
901
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
902
+ }
903
+ const configured = await host.hasCredentialFor(operation.channel);
904
+ const channelName = operation.channel === "api_key" ? "der Verwaltungs-Schluessel (Header `x-api-key`)" : "das Bearer-Credential (OAuth2-Client oder Token)";
905
+ steps.push(
906
+ step(
907
+ "credential-configured",
908
+ configured,
909
+ configured ? `${channelName} ist hinterlegt.` : `${channelName} fehlt. Diese Route ist ohne ihn nicht aufrufbar.`
910
+ )
911
+ );
912
+ if (!configured) {
913
+ problems.push(`Kein Credential fuer die Bahn "${operation.channel}" hinterlegt.`);
914
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
915
+ }
916
+ if (options.skipCredentialProbe) {
917
+ steps.push(
918
+ step("credential-accepted", false, "Auf Wunsch uebersprungen \u2014 hinterlegt ist nicht angenommen.", true)
919
+ );
920
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
921
+ }
922
+ const accepted = await host.probeCredential(operation.channel, options.signal);
923
+ steps.push(step("credential-accepted", accepted.ok, accepted.detail));
924
+ if (!accepted.ok) problems.push(accepted.detail);
925
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
926
+ }
927
+ async function probeReachable(host, baseUrl, timeoutMs, signal) {
928
+ const doFetch = host.fetchImpl();
929
+ const controller = new AbortController();
930
+ const onAbort = () => controller.abort(signal?.reason);
931
+ signal?.addEventListener("abort", onAbort, { once: true });
932
+ if (signal?.aborted) controller.abort(signal.reason);
933
+ const timer = setTimeout(() => controller.abort(new Error(`Reachability probe timed out after ${timeoutMs}ms`)), timeoutMs);
934
+ const started = Date.now();
935
+ try {
936
+ const response = await doFetch(`${baseUrl}/health`, {
937
+ method: "GET",
938
+ headers: { accept: "application/json" },
939
+ signal: controller.signal
940
+ });
941
+ const took = Date.now() - started;
942
+ return {
943
+ ok: response.status < 500,
944
+ detail: response.status < 500 ? `${baseUrl} antwortet (${response.status}, ${took} ms).` : `${baseUrl} antwortet mit ${response.status} \u2014 der Dienst laeuft, aber nicht gesund.`
945
+ };
946
+ } catch (error) {
947
+ const detail = error instanceof Error ? error.message : String(error);
948
+ return { ok: false, detail: `${baseUrl} ist nicht erreichbar: ${detail}` };
949
+ } finally {
950
+ clearTimeout(timer);
951
+ signal?.removeEventListener("abort", onAbort);
952
+ }
953
+ }
954
+
186
955
  // src/client.ts
187
956
  var OrvelloApiError = class extends Error {
188
957
  constructor(status, statusText, endpoint, body, message) {
@@ -206,14 +975,20 @@ var OrvelloApiError = class extends Error {
206
975
  return this.body;
207
976
  }
208
977
  };
209
- var OrvelloClient = class {
978
+ var OrvelloClient = class _OrvelloClient {
210
979
  baseUrl;
211
980
  auth;
981
+ managementApiKey;
982
+ extraHeaders;
212
983
  doFetch;
213
984
  timeoutMs;
214
985
  maxRetries;
215
986
  retryBaseDelayMs;
216
987
  cachedOAuthToken = null;
988
+ breakerThreshold;
989
+ breakerCooldownMs;
990
+ breakerFailures = 0;
991
+ breakerLastFailureAt = null;
217
992
  // Cached default bank account (5 minutes TTL)
218
993
  _bankAccountCache = null;
219
994
  _bankAccountCacheTime = 0;
@@ -230,10 +1005,19 @@ var OrvelloClient = class {
230
1005
  } else {
231
1006
  this.auth = this.envAuth();
232
1007
  }
1008
+ this.managementApiKey = config.managementApiKey ?? this.envManagementApiKey();
1009
+ this.extraHeaders = config.headers;
233
1010
  this.doFetch = config.fetch || globalThis.fetch;
234
1011
  this.timeoutMs = config.timeoutMs ?? 15e3;
235
1012
  this.maxRetries = config.maxRetries ?? 3;
236
1013
  this.retryBaseDelayMs = config.retryBaseDelayMs ?? 500;
1014
+ if (config.circuitBreaker === false) {
1015
+ this.breakerThreshold = Number.POSITIVE_INFINITY;
1016
+ this.breakerCooldownMs = 0;
1017
+ } else {
1018
+ this.breakerThreshold = config.circuitBreaker?.threshold ?? 5;
1019
+ this.breakerCooldownMs = config.circuitBreaker?.cooldownMs ?? 6e4;
1020
+ }
237
1021
  }
238
1022
  envBaseUrl() {
239
1023
  if (typeof process === "undefined" || !process?.env) return void 0;
@@ -252,10 +1036,31 @@ var OrvelloClient = class {
252
1036
  if (apiKey) return { apiKey };
253
1037
  return void 0;
254
1038
  }
1039
+ envManagementApiKey() {
1040
+ if (typeof process === "undefined" || !process?.env) return void 0;
1041
+ const key = process.env.ORVELLO_MANAGEMENT_API_KEY;
1042
+ return key && key !== "todo" ? key : void 0;
1043
+ }
255
1044
  async resolveBaseUrl() {
256
1045
  const val = typeof this.baseUrl === "function" ? await this.baseUrl() : this.baseUrl;
257
1046
  return val.replace(/\/+$/, "");
258
1047
  }
1048
+ static async resolveValue(provider) {
1049
+ if (provider === void 0) return void 0;
1050
+ return typeof provider === "function" ? await provider() : provider;
1051
+ }
1052
+ /**
1053
+ * Der Verwaltungs-Schluessel, sofern hinterlegt.
1054
+ *
1055
+ * Ein leerer String zaehlt als "nicht hinterlegt". Sonst waere die haeufigste
1056
+ * Fehlkonfiguration — eine gesetzte, aber leere Umgebungsvariable — von einem
1057
+ * echten Wert nicht zu unterscheiden, und der Fehler kaeme erst als `403` vom
1058
+ * Dienst zurueck.
1059
+ */
1060
+ async resolveManagementApiKey() {
1061
+ const key = (await _OrvelloClient.resolveValue(this.managementApiKey))?.trim();
1062
+ return key ? key : void 0;
1063
+ }
259
1064
  async getAuthHeader() {
260
1065
  if (!this.auth) return null;
261
1066
  if (typeof this.auth === "string") {
@@ -334,6 +1139,9 @@ var OrvelloClient = class {
334
1139
  const baseUrl = await this.resolveBaseUrl();
335
1140
  const cleanPath = path.startsWith("/") ? path : `/${path}`;
336
1141
  const url = new URL(`${baseUrl}${cleanPath}`);
1142
+ const method = (options.method ?? "GET").toUpperCase();
1143
+ const authChannel = options.authChannel ?? resolveOperation(method, cleanPath)?.channel ?? "bearer";
1144
+ this.assertCircuitClosed(cleanPath);
337
1145
  if (options.query) {
338
1146
  for (const [k, v] of Object.entries(options.query)) {
339
1147
  if (v !== void 0 && v !== null) {
@@ -352,13 +1160,30 @@ var OrvelloClient = class {
352
1160
  timeoutMs
353
1161
  );
354
1162
  try {
355
- const authHeader = await this.getAuthHeader();
356
1163
  const headers = new Headers(options.headers);
357
- if (!headers.has("Accept")) {
358
- headers.set("Accept", options.rawResponse ? "*/*" : "application/json");
1164
+ const configured = await _OrvelloClient.resolveValue(this.extraHeaders);
1165
+ if (configured) {
1166
+ for (const [name, value] of Object.entries(configured)) {
1167
+ if (!headers.has(name)) headers.set(name, value);
1168
+ }
359
1169
  }
360
- if (authHeader && !headers.has("Authorization")) {
361
- headers.set("Authorization", authHeader);
1170
+ if (authChannel === "bearer") {
1171
+ const authHeader = await this.getAuthHeader();
1172
+ if (authHeader && !headers.has("Authorization")) {
1173
+ headers.set("Authorization", authHeader);
1174
+ }
1175
+ } else if (authChannel === "api_key") {
1176
+ const key = await this.resolveManagementApiKey();
1177
+ if (!key) {
1178
+ throw new OrvelloApiError(
1179
+ 0,
1180
+ "missing management credential",
1181
+ cleanPath,
1182
+ null,
1183
+ `${method} ${cleanPath} is a management route and needs the \`x-api-key\` credential. Pass \`managementApiKey\` to createOrvelloClient() or set ORVELLO_MANAGEMENT_API_KEY. It is a different value from the OAuth2 client used for the business routes.`
1184
+ );
1185
+ }
1186
+ if (!headers.has("x-api-key")) headers.set("x-api-key", key);
362
1187
  }
363
1188
  if (options.idempotencyKey && !headers.has("Idempotency-Key")) {
364
1189
  headers.set("Idempotency-Key", options.idempotencyKey);
@@ -372,7 +1197,7 @@ var OrvelloClient = class {
372
1197
  signal: controller.signal
373
1198
  });
374
1199
  if (!resp.ok) {
375
- if (resp.status === 401) {
1200
+ if (resp.status === 401 && authChannel === "bearer") {
376
1201
  const hadCachedToken = Boolean(this.cachedOAuthToken);
377
1202
  this.cachedOAuthToken = null;
378
1203
  if (hadCachedToken && attempt === 0 && attempt < maxRetries) {
@@ -387,11 +1212,14 @@ var OrvelloClient = class {
387
1212
  }
388
1213
  const apiMessage = errBody && typeof errBody === "object" && "message" in errBody && typeof errBody.message === "string" ? errBody.message : void 0;
389
1214
  const error = new OrvelloApiError(resp.status, resp.statusText, cleanPath, errBody, apiMessage);
1215
+ if (resp.status >= 500) this.recordFailure();
1216
+ else this.recordSuccess();
390
1217
  if (!this.isRetriable(resp.status, error) || attempt >= maxRetries) {
391
1218
  throw error;
392
1219
  }
393
1220
  lastError = error;
394
1221
  } else {
1222
+ this.recordSuccess();
395
1223
  const contentType = resp.headers.get("content-type") || "";
396
1224
  if (options.rawResponse || contentType.includes("application/pdf")) {
397
1225
  return await resp.blob();
@@ -414,6 +1242,7 @@ var OrvelloClient = class {
414
1242
  if (err instanceof OrvelloApiError && !this.isRetriable(err.status, err)) {
415
1243
  throw err;
416
1244
  }
1245
+ if (!(err instanceof OrvelloApiError)) this.recordFailure();
417
1246
  if (!this.isRetriable(null, err) || attempt >= maxRetries) {
418
1247
  throw err;
419
1248
  }
@@ -427,6 +1256,231 @@ var OrvelloClient = class {
427
1256
  }
428
1257
  throw lastError;
429
1258
  }
1259
+ // ── Sicherungsautomat ────────────────────────────────────────────────────
1260
+ recordSuccess() {
1261
+ this.breakerFailures = 0;
1262
+ this.breakerLastFailureAt = null;
1263
+ }
1264
+ recordFailure() {
1265
+ this.breakerFailures++;
1266
+ this.breakerLastFailureAt = Date.now();
1267
+ }
1268
+ /**
1269
+ * Ist der Dienst nach aktuellem Wissen ansprechbar?
1270
+ *
1271
+ * Antwortet ohne Netzzugriff aus dem Zustand des Automaten. Nach Ablauf der
1272
+ * Abkuehlzeit gilt er wieder als ansprechbar — der naechste echte Aufruf
1273
+ * entscheidet dann, ob das stimmt.
1274
+ */
1275
+ isAvailable() {
1276
+ if (this.breakerFailures < this.breakerThreshold) return true;
1277
+ if (this.breakerLastFailureAt === null) return true;
1278
+ return Date.now() - this.breakerLastFailureAt > this.breakerCooldownMs;
1279
+ }
1280
+ /** Der Zustand des Automaten, unverfaelscht — fuer Diagnose-Oberflaechen. */
1281
+ circuitState() {
1282
+ return {
1283
+ open: !this.isAvailable(),
1284
+ consecutiveFailures: this.breakerFailures,
1285
+ lastFailureAt: this.breakerLastFailureAt,
1286
+ threshold: this.breakerThreshold,
1287
+ cooldownMs: this.breakerCooldownMs
1288
+ };
1289
+ }
1290
+ /** Den Automaten von Hand schliessen, etwa nach einer behobenen Stoerung. */
1291
+ resetCircuit() {
1292
+ this.recordSuccess();
1293
+ }
1294
+ assertCircuitClosed(path) {
1295
+ if (this.isAvailable()) return;
1296
+ const waited = this.breakerLastFailureAt ? Date.now() - this.breakerLastFailureAt : 0;
1297
+ const remaining = Math.max(0, this.breakerCooldownMs - waited);
1298
+ throw new OrvelloApiError(
1299
+ 0,
1300
+ "circuit open",
1301
+ path,
1302
+ null,
1303
+ `orvello is not answering: ${this.breakerFailures} consecutive transport failures. Not retrying for another ${Math.ceil(remaining / 1e3)}s.`
1304
+ );
1305
+ }
1306
+ // ── Vertragsgetriebener Aufruf ───────────────────────────────────────────
1307
+ /**
1308
+ * Eine Operation des Vertrags ueber ihre `operationId` aufrufen.
1309
+ *
1310
+ * Methode, Pfad und Credential-Bahn kommen aus dem Vertrag; der Aufrufer gibt
1311
+ * nur die Werte. Das ist der Weg fuer alles, wofuer es keine getippte Methode
1312
+ * gibt — und der Weg, der bei einer neuen Route sofort mitwaechst, statt auf
1313
+ * eine Handarbeit in diesem Client zu warten.
1314
+ *
1315
+ * Der Rueckgabetyp ist bewusst offen: die genauen Typen je Operation stehen im
1316
+ * Unterpfad `@orvello/sdk/contract` und werden hier als Typ-Argument gesetzt.
1317
+ * Ein `operationId`, den der Vertrag nicht kennt, wirft sofort — nicht erst,
1318
+ * wenn der Dienst mit 404 antwortet.
1319
+ */
1320
+ async call(operationId, options = {}) {
1321
+ const operation = describeOperation(operationId);
1322
+ if (!operation) {
1323
+ throw new OrvelloOperationError(
1324
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against (@orvello/sdk speaks ${orvelloCapabilities().operationCount} operations).`,
1325
+ operationId
1326
+ );
1327
+ }
1328
+ const { params, body, ...rest } = options;
1329
+ const path = buildPath(operationId, params);
1330
+ return this.request(path, {
1331
+ ...rest,
1332
+ method: operation.method,
1333
+ authChannel: rest.authChannel ?? operation.channel,
1334
+ ...body === void 0 ? {} : { body: JSON.stringify(body) }
1335
+ });
1336
+ }
1337
+ // ── Zustand und Faehigkeiten ─────────────────────────────────────────────
1338
+ /**
1339
+ * Steht der Dienst, und wird unser Credential angenommen?
1340
+ *
1341
+ * ⭐ `available` und `authenticated` sind zwei Fragen, und der Bericht haelt sie
1342
+ * auseinander. Ein Dienst, der laeuft, aber unser Credential ablehnt, ist nicht
1343
+ * "verfuegbar" im Sinne dessen, der ihn benutzen will — und ein `authenticated:
1344
+ * null` heisst "nicht gefragt", nie "in Ordnung".
1345
+ */
1346
+ async checkHealth(options = {}) {
1347
+ const started = Date.now();
1348
+ const timeoutMs = options.timeoutMs ?? 8e3;
1349
+ let baseUrl;
1350
+ try {
1351
+ baseUrl = await this.resolveBaseUrl();
1352
+ } catch (error) {
1353
+ return {
1354
+ available: false,
1355
+ responseTimeMs: Date.now() - started,
1356
+ authenticated: null,
1357
+ error: error instanceof Error ? error.message : String(error)
1358
+ };
1359
+ }
1360
+ const controller = new AbortController();
1361
+ const onAbort = () => controller.abort(options.signal?.reason);
1362
+ options.signal?.addEventListener("abort", onAbort, { once: true });
1363
+ if (options.signal?.aborted) controller.abort(options.signal.reason);
1364
+ const timer = setTimeout(() => controller.abort(new Error(`Health check timed out after ${timeoutMs}ms`)), timeoutMs);
1365
+ try {
1366
+ const response = await this.doFetch(`${baseUrl}/health`, {
1367
+ method: "GET",
1368
+ headers: { accept: "application/json" },
1369
+ signal: controller.signal
1370
+ });
1371
+ if (response.status >= 500) {
1372
+ this.recordFailure();
1373
+ return {
1374
+ available: false,
1375
+ responseTimeMs: Date.now() - started,
1376
+ authenticated: null,
1377
+ error: `orvello answered ${response.status} on /health`
1378
+ };
1379
+ }
1380
+ this.recordSuccess();
1381
+ } catch (error) {
1382
+ this.recordFailure();
1383
+ return {
1384
+ available: false,
1385
+ responseTimeMs: Date.now() - started,
1386
+ authenticated: null,
1387
+ error: error instanceof Error ? error.message : String(error)
1388
+ };
1389
+ } finally {
1390
+ clearTimeout(timer);
1391
+ options.signal?.removeEventListener("abort", onAbort);
1392
+ }
1393
+ if (!this.auth) {
1394
+ return { available: true, responseTimeMs: Date.now() - started, authenticated: null };
1395
+ }
1396
+ try {
1397
+ const header = await this.getAuthHeader();
1398
+ return {
1399
+ available: true,
1400
+ responseTimeMs: Date.now() - started,
1401
+ authenticated: Boolean(header)
1402
+ };
1403
+ } catch (error) {
1404
+ return {
1405
+ available: true,
1406
+ responseTimeMs: Date.now() - started,
1407
+ authenticated: false,
1408
+ error: error instanceof Error ? error.message : String(error)
1409
+ };
1410
+ }
1411
+ }
1412
+ /** Was der Vertrag hergibt — ohne Netz, ohne Credential. */
1413
+ capabilities() {
1414
+ return orvelloCapabilities();
1415
+ }
1416
+ /** Spricht die laufende Gegenstelle denselben Vertrag wie dieses SDK? */
1417
+ async diagnose(options = {}) {
1418
+ return diagnoseOrvello({
1419
+ baseUrl: this.baseUrl,
1420
+ fetch: this.doFetch,
1421
+ ...options
1422
+ });
1423
+ }
1424
+ /**
1425
+ * Wuerde dieser Aufruf heute klappen? Prueft den ganzen Weg — Erreichbarkeit,
1426
+ * Vertrag, Credential — und schreibt dabei nichts.
1427
+ *
1428
+ * Gedacht fuer Verbindungs-Verwalter: eine Kante laesst sich damit turnusmaessig
1429
+ * nachpruefen, ohne sie anzufassen, und vor einem freigegebenen Schreibschritt
1430
+ * laesst sich zeigen, was er tun wuerde.
1431
+ */
1432
+ async preflight(operationId, options = {}) {
1433
+ const host = {
1434
+ resolveBaseUrl: () => this.resolveBaseUrl(),
1435
+ fetchImpl: () => this.doFetch,
1436
+ hasCredentialFor: async (channel) => {
1437
+ if (channel === "none") return true;
1438
+ if (channel === "api_key") return Boolean(await this.resolveManagementApiKey());
1439
+ return Boolean(this.auth);
1440
+ },
1441
+ probeCredential: (channel, signal) => this.probeCredential(channel, signal)
1442
+ };
1443
+ const report = await preflightOrvello(host, operationId, options);
1444
+ return {
1445
+ ...report,
1446
+ serverSideDryRun: this.capabilities().capabilities.serverSideDryRun.supported
1447
+ };
1448
+ }
1449
+ /**
1450
+ * Ein ausschliesslich lesender Aufruf auf einer Credential-Bahn.
1451
+ *
1452
+ * Je Bahn die guenstigste Frage, die ohne Nebenwirkung beantwortet, ob das
1453
+ * Credential angenommen wird:
1454
+ * - `api_key` → die Auflistung der Zugaenge mit `pageSize=1`
1455
+ * - `bearer` → das Holen des Tokens (der Dienst prueft dabei Kennung und Geheimnis)
1456
+ */
1457
+ async probeCredential(channel, signal) {
1458
+ if (channel === "none") return { ok: true, detail: "Oeffentliche Route, kein Credential noetig." };
1459
+ if (channel === "api_key") {
1460
+ try {
1461
+ await this.call("oauth2_external_clients_list", {
1462
+ query: { pageSize: 1 },
1463
+ maxRetries: 0,
1464
+ signal
1465
+ });
1466
+ return { ok: true, detail: "Der Verwaltungs-Schluessel wird angenommen (Leseprobe auf die Zugangsliste)." };
1467
+ } catch (error) {
1468
+ if (error instanceof OrvelloApiError) {
1469
+ return {
1470
+ ok: false,
1471
+ detail: error.status === 403 || error.status === 401 ? `Der Verwaltungs-Schluessel wird abgelehnt (${error.status}). Der Wert ist gesetzt, aber nicht der, den der Dienst erwartet.` : `Leseprobe fehlgeschlagen (${error.status}): ${error.message}`
1472
+ };
1473
+ }
1474
+ return { ok: false, detail: `Leseprobe fehlgeschlagen: ${error.message}` };
1475
+ }
1476
+ }
1477
+ try {
1478
+ const header = await this.getAuthHeader();
1479
+ return header ? { ok: true, detail: "Das Bearer-Credential wird angenommen (Token wurde ausgestellt)." } : { ok: false, detail: "Es konnte kein Bearer-Credential ermittelt werden." };
1480
+ } catch (error) {
1481
+ return { ok: false, detail: `Token konnte nicht geholt werden: ${error.message}` };
1482
+ }
1483
+ }
430
1484
  // ── Invoices ─────────────────────────────────────────────────────────────
431
1485
  invoices = {
432
1486
  search: (query, options) => this.request("/invoices/external", {
@@ -737,12 +1791,20 @@ function createOrvelloClient(config) {
737
1791
  exports.CONTRACT_SHA256 = CONTRACT_SHA256;
738
1792
  exports.OrvelloApiError = OrvelloApiError;
739
1793
  exports.OrvelloClient = OrvelloClient;
1794
+ exports.OrvelloOperationError = OrvelloOperationError;
1795
+ exports.authChannelForContractType = authChannelForContractType;
740
1796
  exports.buildBase64Receipt = buildBase64Receipt;
1797
+ exports.buildPath = buildPath;
741
1798
  exports.calculateVat = calculateVat;
742
1799
  exports.createOrvelloClient = createOrvelloClient;
1800
+ exports.describeOperation = describeOperation;
743
1801
  exports.diagnoseOrvello = diagnoseOrvello;
744
1802
  exports.formatAmount = formatAmount;
745
1803
  exports.isKleinunternehmer = isKleinunternehmer;
1804
+ exports.listOperations = listOperations;
746
1805
  exports.mapPaymentAccountToBankDetails = mapPaymentAccountToBankDetails;
1806
+ exports.orvelloCapabilities = orvelloCapabilities;
1807
+ exports.preflightOrvello = preflightOrvello;
1808
+ exports.resolveOperation = resolveOperation;
747
1809
  //# sourceMappingURL=index.cjs.map
748
1810
  //# sourceMappingURL=index.cjs.map