@orvello/sdk 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -2,7 +2,7 @@
2
2
  var CONTRACT_SHA256 = "4efd4e4b669168c9cab5419fa04dd4e26a2029de2d4b10a59918e366189e1072";
3
3
 
4
4
  // src/diagnose.ts
5
- var SDK_VERSION = "0.1.0" ;
5
+ var SDK_VERSION = "0.2.0" ;
6
6
  function normalizeBaseUrl(raw) {
7
7
  const trimmed = raw.trim();
8
8
  if (!trimmed) throw new Error("Base URL cannot be empty");
@@ -181,6 +181,775 @@ function mapPaymentAccountToBankDetails(account) {
181
181
  };
182
182
  }
183
183
 
184
+ // src/route-index.generated.ts
185
+ var ROUTE_INDEX = {
186
+ "DELETE__api_amp_proxy_key": ["DELETE", "/api/amp-proxy/:key", "n", "public", 0],
187
+ "GET__api_amp_proxy__discover": ["GET", "/api/amp-proxy/_discover", "n", "public", 0],
188
+ "GET__api_amp_proxy_key": ["GET", "/api/amp-proxy/:key", "n", "public", 0],
189
+ "POST__api_amp_proxy_key": ["POST", "/api/amp-proxy/:key", "n", "public", 0],
190
+ "admin_vat_create_system_settings": ["POST", "/admin/vat/system-settings", "b", "frontend_permission_http", 4],
191
+ "admin_vat_get_company_settings_history": ["GET", "/admin/vat/company/:companyId/settings-history", "b", "frontend_permission_http", 1],
192
+ "admin_vat_get_system_settings": ["GET", "/admin/vat/system-settings", "b", "frontend_permission_http", 0],
193
+ "admin_vat_get_system_settings_history": ["GET", "/admin/vat/system-settings/history", "b", "frontend_permission_http", 2],
194
+ "admin_vat_update_company_settings": ["PUT", "/admin/vat/company/:companyId/settings", "b", "frontend_permission_http", 5],
195
+ "admin_vat_update_system_settings": ["PUT", "/admin/vat/system-settings/:id", "b", "frontend_permission_http", 5],
196
+ "app_info_get": ["GET", "/app-info", "b", "frontend_bearer_http", 2],
197
+ "app_info_health": ["GET", "/app-info/health", "n", "public", 0],
198
+ "app_info_manifest": ["GET", "/app-info/manifest", "n", "public", 0],
199
+ "app_info_own_permissions_get": ["GET", "/app-info/ownPermissions", "b", "frontend_bearer_http", 2],
200
+ "bookkeeping_assets_add_cost_component": ["POST", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 5],
201
+ "bookkeeping_assets_apply_sonderafa": ["POST", "/bookkeeping/assets/:assetId/sonderafa", "b", "frontend_permission_http", 5],
202
+ "bookkeeping_assets_create": ["POST", "/bookkeeping/assets", "b", "frontend_permission_http", 4],
203
+ "bookkeeping_assets_delete": ["DELETE", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
204
+ "bookkeeping_assets_delete_cost_component": ["DELETE", "/bookkeeping/assets/:assetId/cost-components/:componentId", "b", "frontend_permission_http", 1],
205
+ "bookkeeping_assets_dispose": ["POST", "/bookkeeping/assets/:assetId/dispose", "b", "frontend_permission_http", 5],
206
+ "bookkeeping_assets_finalize_depreciation": ["POST", "/bookkeeping/assets/depreciation/finalize", "b", "frontend_permission_http", 4],
207
+ "bookkeeping_assets_generate_depreciation": ["POST", "/bookkeeping/assets/depreciation/generate", "b", "frontend_permission_http", 4],
208
+ "bookkeeping_assets_get_by_id": ["GET", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
209
+ "bookkeeping_assets_get_depreciation_records": ["GET", "/bookkeeping/assets/depreciation/records", "b", "frontend_permission_http", 2],
210
+ "bookkeeping_assets_get_sammelposten_pool": ["GET", "/bookkeeping/assets/sammelposten-pools/:poolId", "b", "frontend_permission_http", 1],
211
+ "bookkeeping_assets_iab_create": ["POST", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 4],
212
+ "bookkeeping_assets_iab_delete": ["DELETE", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
213
+ "bookkeeping_assets_iab_dissolve": ["POST", "/bookkeeping/assets/iab/:iabId/dissolve", "b", "frontend_permission_http", 5],
214
+ "bookkeeping_assets_iab_get": ["GET", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
215
+ "bookkeeping_assets_iab_list": ["GET", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 0],
216
+ "bookkeeping_assets_iab_reverse": ["POST", "/bookkeeping/assets/iab/:iabId/reverse", "b", "frontend_permission_http", 5],
217
+ "bookkeeping_assets_list_cost_components": ["GET", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 1],
218
+ "bookkeeping_assets_list_sammelposten_pools": ["GET", "/bookkeeping/assets/sammelposten-pools", "b", "frontend_permission_http", 0],
219
+ "bookkeeping_assets_search": ["GET", "/bookkeeping/assets", "b", "frontend_permission_http", 2],
220
+ "bookkeeping_assets_switch_to_linear": ["POST", "/bookkeeping/assets/:assetId/switch-to-linear", "b", "frontend_permission_http", 5],
221
+ "bookkeeping_assets_update": ["PUT", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 5],
222
+ "bookkeeping_audit_logs": ["GET", "/bookkeeping/audit/logs", "b", "frontend_permission_http", 2],
223
+ "bookkeeping_capital_movements_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/cash-confirm", "b", "frontend_permission_http", 5],
224
+ "bookkeeping_capital_movements_confirm": ["POST", "/bookkeeping/capital-movements/:id/confirm", "b", "frontend_permission_http", 1],
225
+ "bookkeeping_capital_movements_create": ["POST", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 4],
226
+ "bookkeeping_capital_movements_delete": ["DELETE", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
227
+ "bookkeeping_capital_movements_get_by_id": ["GET", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
228
+ "bookkeeping_capital_movements_kapitalkonto": ["GET", "/bookkeeping/capital-movements/kapitalkonto", "b", "frontend_permission_http", 2],
229
+ "bookkeeping_capital_movements_reverse": ["POST", "/bookkeeping/capital-movements/:id/reverse", "b", "frontend_permission_http", 5],
230
+ "bookkeeping_capital_movements_revoke_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
231
+ "bookkeeping_capital_movements_search": ["GET", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 2],
232
+ "bookkeeping_capital_movements_update": ["PATCH", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 5],
233
+ "bookkeeping_expenses_analyze_receipt": ["POST", "/bookkeeping/expenses/analyze-receipt", "b", "frontend_permission_http", 0],
234
+ "bookkeeping_expenses_bulk_confirm": ["POST", "/bookkeeping/expenses/bulk-confirm", "b", "frontend_permission_http", 4],
235
+ "bookkeeping_expenses_confirm": ["POST", "/bookkeeping/expenses/:id/confirm", "b", "frontend_permission_http", 1],
236
+ "bookkeeping_expenses_confirm_cash": ["POST", "/bookkeeping/expenses/:id/confirm-cash", "b", "frontend_permission_http", 5],
237
+ "bookkeeping_expenses_create": ["POST", "/bookkeeping/expenses", "b", "frontend_permission_http", 4],
238
+ "bookkeeping_expenses_create_external": ["POST", "/bookkeeping/expenses/external", "b", "unified_bearer", 4, ["expenses:write"]],
239
+ "bookkeeping_expenses_delete": ["DELETE", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
240
+ "bookkeeping_expenses_get_by_id": ["GET", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
241
+ "bookkeeping_expenses_mark_as_asset": ["POST", "/bookkeeping/expenses/:id/mark-as-asset", "b", "frontend_permission_http", 5],
242
+ "bookkeeping_expenses_revoke_cash_confirm": ["POST", "/bookkeeping/expenses/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
243
+ "bookkeeping_expenses_search": ["GET", "/bookkeeping/expenses", "b", "frontend_permission_http", 2],
244
+ "bookkeeping_expenses_update": ["PUT", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 5],
245
+ "bookkeeping_expenses_upload_receipt": ["POST", "/bookkeeping/expenses/:id/upload-receipt", "b", "frontend_permission_http", 1],
246
+ "bookkeeping_iap_payouts_import": ["POST", "/bookkeeping/iap-payouts/import", "b", "frontend_permission_http", 4],
247
+ "bookkeeping_iap_payouts_list": ["GET", "/bookkeeping/iap-payouts", "b", "frontend_permission_http", 2],
248
+ "bookkeeping_income_tax_create_employment": ["POST", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 4],
249
+ "bookkeeping_income_tax_create_sonderausgaben": ["POST", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 4],
250
+ "bookkeeping_income_tax_create_steuerminderungen": ["POST", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 4],
251
+ "bookkeeping_income_tax_create_vorsorge": ["POST", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 4],
252
+ "bookkeeping_income_tax_create_werbungskosten": ["POST", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 4],
253
+ "bookkeeping_income_tax_delete_employment": ["DELETE", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
254
+ "bookkeeping_income_tax_delete_sonderausgaben": ["DELETE", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 1],
255
+ "bookkeeping_income_tax_delete_steuerminderungen": ["DELETE", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 1],
256
+ "bookkeeping_income_tax_delete_vorsorge": ["DELETE", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 1],
257
+ "bookkeeping_income_tax_delete_werbungskosten": ["DELETE", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 1],
258
+ "bookkeeping_income_tax_get_employment": ["GET", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
259
+ "bookkeeping_income_tax_get_estimate": ["GET", "/bookkeeping/income-tax/estimate", "b", "frontend_permission_http", 2],
260
+ "bookkeeping_income_tax_get_settings": ["GET", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 0],
261
+ "bookkeeping_income_tax_get_summary": ["GET", "/bookkeeping/income-tax/summary", "b", "frontend_permission_http", 2],
262
+ "bookkeeping_income_tax_get_vorauszahlungen": ["GET", "/bookkeeping/income-tax/vorauszahlungen", "b", "frontend_permission_http", 2],
263
+ "bookkeeping_income_tax_list_employment": ["GET", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 2],
264
+ "bookkeeping_income_tax_list_sonderausgaben": ["GET", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 2],
265
+ "bookkeeping_income_tax_list_steuerminderungen": ["GET", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 2],
266
+ "bookkeeping_income_tax_list_vorsorge": ["GET", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 2],
267
+ "bookkeeping_income_tax_list_werbungskosten": ["GET", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 2],
268
+ "bookkeeping_income_tax_update_employment": ["PUT", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 5],
269
+ "bookkeeping_income_tax_update_sonderausgaben": ["PUT", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 5],
270
+ "bookkeeping_income_tax_update_steuerminderungen": ["PUT", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 5],
271
+ "bookkeeping_income_tax_update_vorsorge": ["PUT", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 5],
272
+ "bookkeeping_income_tax_update_werbungskosten": ["PUT", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 5],
273
+ "bookkeeping_income_tax_upsert_settings": ["POST", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 4],
274
+ "bookkeeping_locks_get_state": ["GET", "/bookkeeping/locks/state", "b", "frontend_permission_http", 0],
275
+ "bookkeeping_locks_overview": ["GET", "/bookkeeping/locks/overview", "b", "frontend_permission_http", 2],
276
+ "bookkeeping_locks_recommendation": ["GET", "/bookkeeping/locks/recommendation", "b", "frontend_permission_http", 2],
277
+ "bookkeeping_locks_set": ["POST", "/bookkeeping/locks/set", "b", "frontend_permission_http", 4],
278
+ "bookkeeping_payments_create_manual_external": ["POST", "/bookkeeping/payments/external/manual", "b", "unified_bearer", 4, ["payments:write"]],
279
+ "bookkeeping_payments_list_accounts_external": ["GET", "/bookkeeping/payments/external/accounts", "b", "unified_bearer", 2, ["payments:read"]],
280
+ "bookkeeping_payments_settle_invoice_external": ["POST", "/bookkeeping/payments/external/settle-invoice", "b", "unified_bearer", 4, ["payments:write", "invoices:write"]],
281
+ "bookkeeping_reports_asset_register": ["GET", "/bookkeeping/reports/assets", "b", "frontend_permission_http", 2],
282
+ "bookkeeping_reports_category_breakdown": ["GET", "/bookkeeping/reports/category-breakdown", "b", "frontend_permission_http", 2],
283
+ "bookkeeping_reports_euer": ["GET", "/bookkeeping/reports/euer", "b", "frontend_permission_http", 2],
284
+ "bookkeeping_reports_monthly_trend": ["GET", "/bookkeeping/reports/monthly-trend", "b", "frontend_permission_http", 2],
285
+ "bookkeeping_reports_summary": ["GET", "/bookkeeping/reports/summary", "b", "frontend_permission_http", 2],
286
+ "bookkeeping_reports_vat_periods": ["GET", "/bookkeeping/reports/vat/periods", "b", "frontend_permission_http", 0],
287
+ "bookkeeping_reports_vat_status": ["GET", "/bookkeeping/reports/vat/status", "b", "frontend_permission_http", 0],
288
+ "bookkeeping_reports_vat_ustva": ["GET", "/bookkeeping/reports/vat/ustva", "b", "frontend_permission_http", 2],
289
+ "bookkeeping_reports_vendor_breakdown": ["GET", "/bookkeeping/reports/vendor-breakdown", "b", "frontend_permission_http", 2],
290
+ "bookkeeping_revenues_analyze_receipt": ["POST", "/bookkeeping/revenues/analyze-receipt", "b", "frontend_permission_http", 0],
291
+ "bookkeeping_revenues_bulk_confirm": ["POST", "/bookkeeping/revenues/bulk-confirm", "b", "frontend_permission_http", 4],
292
+ "bookkeeping_revenues_confirm": ["POST", "/bookkeeping/revenues/:id/confirm", "b", "frontend_permission_http", 1],
293
+ "bookkeeping_revenues_confirm_cash": ["POST", "/bookkeeping/revenues/:id/confirm-cash", "b", "frontend_permission_http", 5],
294
+ "bookkeeping_revenues_create": ["POST", "/bookkeeping/revenues", "b", "frontend_permission_http", 4],
295
+ "bookkeeping_revenues_create_external": ["POST", "/bookkeeping/revenues/external", "b", "unified_bearer", 4, ["revenues:write"]],
296
+ "bookkeeping_revenues_delete": ["DELETE", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
297
+ "bookkeeping_revenues_get_by_id": ["GET", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
298
+ "bookkeeping_revenues_invoice_adjustment_external": ["POST", "/bookkeeping/revenues/external/invoice-adjustment", "b", "unified_bearer", 4, ["revenues:write"]],
299
+ "bookkeeping_revenues_revoke_cash_confirm": ["POST", "/bookkeeping/revenues/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
300
+ "bookkeeping_revenues_search": ["GET", "/bookkeeping/revenues", "b", "frontend_permission_http", 2],
301
+ "bookkeeping_revenues_update": ["PUT", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 5],
302
+ "bookkeeping_revenues_upload_receipt": ["POST", "/bookkeeping/revenues/:id/upload-receipt", "b", "frontend_permission_http", 1],
303
+ "bookkeeping_tax_params_create": ["POST", "/bookkeeping/tax-params", "b", "frontend_permission_http", 4],
304
+ "bookkeeping_tax_params_health": ["GET", "/bookkeeping/tax-params/health", "b", "frontend_permission_http", 0],
305
+ "bookkeeping_tax_params_history": ["GET", "/bookkeeping/tax-params/:key/history", "b", "frontend_permission_http", 1],
306
+ "bookkeeping_tax_params_list": ["GET", "/bookkeeping/tax-params", "b", "frontend_permission_http", 2],
307
+ "bookkeeping_tax_params_sync": ["POST", "/bookkeeping/tax-params/sync", "b", "frontend_permission_http", 0],
308
+ "bookkeeping_tax_params_update": ["PATCH", "/bookkeeping/tax-params/:id", "b", "frontend_permission_http", 5],
309
+ "currency_rates_get": ["GET", "/currency-rates/:fromCurrency/:toCurrency", "k", "x_api_key_http", 3],
310
+ "customer_companies_create": ["POST", "/customer-companies/create", "b", "frontend_permission_http", 4],
311
+ "customer_companies_create_external": ["POST", "/customer-companies/external", "b", "unified_bearer", 4, ["companies:write"]],
312
+ "customer_companies_delete": ["DELETE", "/customer-companies/delete/:companyId", "b", "frontend_permission_http", 1],
313
+ "customer_companies_delete_external": ["DELETE", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:delete"]],
314
+ "customer_companies_employee_assignments_by_company_id": ["GET", "/customer-companies/employee-assignments/byCompanyId/:companyId", "b", "frontend_permission_http", 3],
315
+ "customer_companies_employee_assignments_by_employee_id": ["GET", "/customer-companies/employee-assignments/byEmployeeId/:employeeId", "b", "frontend_permission_http", 3],
316
+ "customer_companies_employee_assignments_create": ["POST", "/customer-companies/employee-assignments/create", "b", "frontend_permission_http", 4],
317
+ "customer_companies_employee_assignments_update": ["PUT", "/customer-companies/employee-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
318
+ "customer_companies_employees_create": ["POST", "/customer-companies/employees/create", "b", "frontend_permission_http", 4],
319
+ "customer_companies_employees_delete": ["DELETE", "/customer-companies/employees/delete/:employeeId", "b", "frontend_permission_http", 1],
320
+ "customer_companies_employees_get_by_id": ["GET", "/customer-companies/employees/byId/:employeeId", "b", "frontend_permission_http", 1],
321
+ "customer_companies_employees_search": ["GET", "/customer-companies/employees/search", "b", "frontend_permission_http", 2],
322
+ "customer_companies_employees_update": ["PUT", "/customer-companies/employees/update/:employeeId", "b", "frontend_permission_http", 5],
323
+ "customer_companies_get_by_id": ["GET", "/customer-companies/byId/:companyId", "b", "frontend_permission_http", 1],
324
+ "customer_companies_get_by_id_external": ["GET", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:read"]],
325
+ "customer_companies_get_full_by_id": ["GET", "/customer-companies/byId/:companyId/full", "b", "frontend_permission_http", 3],
326
+ "customer_companies_search": ["GET", "/customer-companies/search", "b", "frontend_permission_http", 2],
327
+ "customer_companies_search_external": ["GET", "/customer-companies/external", "b", "unified_bearer", 2, ["companies:read"]],
328
+ "customer_companies_update": ["PUT", "/customer-companies/update/:companyId", "b", "frontend_permission_http", 5],
329
+ "customer_companies_update_external": ["PUT", "/customer-companies/external/:companyId", "b", "unified_bearer", 5, ["companies:write"]],
330
+ "documents_assign": ["POST", "/documents/admin/assign", "b", "frontend_permission_http", 4],
331
+ "documents_create": ["POST", "/documents/admin/create", "b", "frontend_permission_http", 4],
332
+ "documents_delete": ["DELETE", "/documents/admin/delete/:documentId", "b", "frontend_permission_http", 3],
333
+ "documents_delete_assignment": ["DELETE", "/documents/admin/assignments/:assignmentId", "b", "frontend_permission_http", 1],
334
+ "documents_download_url": ["GET", "/documents/admin/byId/:documentId/download-url", "b", "frontend_permission_http", 3],
335
+ "documents_get_by_id": ["GET", "/documents/admin/byId/:documentId", "b", "frontend_permission_http", 1],
336
+ "documents_get_full_by_id": ["GET", "/documents/admin/byId/:documentId/full", "b", "frontend_permission_http", 1],
337
+ "documents_search": ["GET", "/documents/admin/search", "b", "frontend_permission_http", 2],
338
+ "documents_set_lock": ["PUT", "/documents/admin/lock/:documentId", "b", "frontend_permission_http", 5],
339
+ "documents_stream": ["GET", "/documents/admin/stream/:documentId", "b", "frontend_permission_http", 3],
340
+ "dunning_get_settings_external": ["GET", "/invoices/external/dunning/settings", "b", "unified_bearer", 2, ["invoices:read"]],
341
+ "dunning_issue_external": ["POST", "/invoices/external/dunning/:invoiceId/issue", "b", "unified_bearer", 5, ["invoices:write"]],
342
+ "dunning_notice_download_external": ["GET", "/invoices/external/dunning/notices/:noticeId/download", "b", "unified_bearer", 1, ["invoices:read"]],
343
+ "dunning_notice_pdf_external": ["GET", "/invoices/external/dunning/notices/:noticeId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
344
+ "dunning_preview_external": ["POST", "/invoices/external/dunning/:invoiceId/preview", "b", "unified_bearer", 5, ["invoices:read"]],
345
+ "dunning_suggestions_external": ["GET", "/invoices/external/dunning/suggestions", "b", "unified_bearer", 2, ["invoices:read"]],
346
+ "dunning_update_settings_external": ["PUT", "/invoices/external/dunning/settings", "b", "unified_bearer", 4, ["invoices:write"]],
347
+ "enterprise_onboarding_complete_step": ["POST", "/apps/enterprise/onboarding/complete-step", "b", "frontend_permission_http", 4],
348
+ "enterprise_onboarding_skip_step": ["POST", "/apps/enterprise/onboarding/skip-step", "b", "frontend_permission_http", 4],
349
+ "enterprise_onboarding_state_get": ["GET", "/apps/enterprise/onboarding/state", "b", "frontend_permission_http", 2],
350
+ "entitlements_assign": ["POST", "/entitlements", "b", "unified_bearer", 4, ["entitlements:write"]],
351
+ "entitlements_context_get_by_shop_assignment": ["GET", "/entitlements/context/by-shop-assignment/:shopAssignmentId", "b", "unified_bearer", 1, ["entitlements:read"]],
352
+ "entitlements_getAll": ["GET", "/entitlements/getAll", "b", "unified_bearer", 2, ["entitlements:read"]],
353
+ "entitlements_getAssigned": ["GET", "/entitlements/assigned", "b", "unified_bearer", 2, ["entitlements:read"]],
354
+ "entitlements_getById": ["GET", "/entitlements/:id", "b", "unified_bearer", 1, ["entitlements:read"]],
355
+ "entitlements_getUserEntitlements": ["GET", "/entitlements/user/:userId", "b", "unified_bearer", 1, ["entitlements:read"]],
356
+ "entitlements_get_state": ["GET", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:read"]],
357
+ "entitlements_list": ["GET", "/entitlements", "b", "unified_bearer", 2, ["entitlements:read"]],
358
+ "entitlements_revoke": ["DELETE", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:write"]],
359
+ "entitlements_update_state": ["PUT", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 5, ["entitlements:read", "entitlements:write"]],
360
+ "entitlements_usage_overages_pull": ["GET", "/entitlements/usage-overages", "b", "unified_bearer", 2, ["entitlements:read"]],
361
+ "exports_datev_buchungsstapel": ["GET", "/exports/bookkeeping/datev/buchungsstapel", "b", "frontend_permission_http", 0],
362
+ "exports_datev_metadata": ["GET", "/exports/bookkeeping/datev/metadata", "b", "frontend_permission_http", 0],
363
+ "invoice_dunning_delete_notice": ["DELETE", "/invoices/dunning/:invoiceId/notices/:noticeId", "b", "frontend_permission_http", 1],
364
+ "invoice_dunning_get_settings": ["GET", "/invoices/dunning/settings", "b", "frontend_permission_http", 2],
365
+ "invoice_dunning_issue": ["POST", "/invoices/dunning/:invoiceId/issue", "b", "frontend_permission_http", 5],
366
+ "invoice_dunning_list_notices": ["GET", "/invoices/dunning/:invoiceId/notices", "b", "frontend_permission_http", 1],
367
+ "invoice_dunning_notice_download": ["GET", "/invoices/dunning/notices/:noticeId/download", "b", "frontend_permission_http", 1],
368
+ "invoice_dunning_notice_pdf": ["GET", "/invoices/dunning/notices/:noticeId/pdf", "b", "frontend_permission_http", 1],
369
+ "invoice_dunning_preview": ["POST", "/invoices/dunning/:invoiceId/preview", "b", "frontend_permission_http", 5],
370
+ "invoice_dunning_suggestions": ["GET", "/invoices/dunning/suggestions", "b", "frontend_permission_http", 2],
371
+ "invoice_dunning_update_settings": ["PUT", "/invoices/dunning/settings", "b", "frontend_permission_http", 4],
372
+ "invoices_analysis": ["GET", "/invoices/:invoiceId/analysis", "b", "frontend_permission_http", 1],
373
+ "invoices_create_external": ["POST", "/invoices/external", "b", "unified_bearer", 4, ["invoices:write"]],
374
+ "invoices_create_manual": ["POST", "/invoices/manual", "b", "frontend_bearer_http", 4],
375
+ "invoices_credit_note_issue": ["POST", "/invoices/:invoiceId/credit-note/issue", "b", "frontend_permission_http", 5],
376
+ "invoices_credit_note_issue_external": ["POST", "/invoices/external/:invoiceId/credit-note/issue", "b", "unified_bearer", 5, ["invoices:publish"]],
377
+ "invoices_credit_note_preview": ["POST", "/invoices/:invoiceId/credit-note/preview", "b", "frontend_permission_http", 5],
378
+ "invoices_credit_note_preview_external": ["POST", "/invoices/external/:invoiceId/credit-note/preview", "b", "unified_bearer", 5, ["invoices:write"]],
379
+ "invoices_delete": ["DELETE", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
380
+ "invoices_delete_external": ["DELETE", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:delete"]],
381
+ "invoices_download_pdf": ["GET", "/invoices/:invoiceId/download", "n", "public", 3],
382
+ "invoices_download_pdf_external": ["GET", "/invoices/external/:invoiceId/download", "b", "unified_bearer", 1, ["invoices:read"]],
383
+ "invoices_get_by_id": ["GET", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
384
+ "invoices_get_by_id_external": ["GET", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:read"]],
385
+ "invoices_list_overdue": ["GET", "/invoices/overdue", "b", "frontend_permission_http", 2],
386
+ "invoices_list_pending": ["GET", "/invoices/pending", "b", "frontend_permission_http", 2],
387
+ "invoices_overdue_external": ["GET", "/invoices/external/overdue", "b", "unified_bearer", 2, ["invoices:read"]],
388
+ "invoices_payment_reconciliation": ["GET", "/invoices/:invoiceId/payment-reconciliation", "b", "frontend_permission_http", 1],
389
+ "invoices_pending_external": ["GET", "/invoices/external/pending", "b", "unified_bearer", 2, ["invoices:read"]],
390
+ "invoices_repair_pdf": ["POST", "/invoices/:invoiceId/repair-pdf", "b", "frontend_bearer_http", 1],
391
+ "invoices_search": ["GET", "/invoices", "b", "frontend_bearer_http", 2],
392
+ "invoices_search_external": ["GET", "/invoices/external", "b", "unified_bearer", 2, ["invoices:read"]],
393
+ "invoices_send_email_external": ["POST", "/invoices/external/:invoiceId/send-email", "b", "unified_bearer", 5, ["invoices:write"]],
394
+ "invoices_status_policy": ["GET", "/invoices/:invoiceId/status-policy", "b", "frontend_bearer_http", 1],
395
+ "invoices_status_policy_external": ["GET", "/invoices/external/:invoiceId/status-policy", "b", "unified_bearer", 1, ["invoices:read"]],
396
+ "invoices_update_status": ["PUT", "/invoices/:invoiceId/status", "b", "frontend_bearer_http", 5],
397
+ "invoices_update_status_external": ["PUT", "/invoices/external/:invoiceId/status", "b", "unified_bearer", 5, ["invoices:write"]],
398
+ "invoices_view_pdf": ["GET", "/invoices/:invoiceId/pdf", "n", "public", 3],
399
+ "invoices_view_pdf_external": ["GET", "/invoices/external/:invoiceId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
400
+ "logs_delete": ["DELETE", "/app-logs/delete/:logId", "b", "frontend_permission_http", 1],
401
+ "logs_delete_bulk": ["DELETE", "/app-logs/delete/mass/:logIds", "b", "frontend_permission_http", 1],
402
+ "logs_search": ["GET", "/app-logs/search", "b", "frontend_permission_http", 2],
403
+ "managing_companies_api_keys_by_id": ["GET", "/managing-companies/api-keys/byId/:apiKeyId", "b", "frontend_permission_http", 1],
404
+ "managing_companies_api_keys_create": ["POST", "/managing-companies/api-keys/create", "b", "frontend_permission_http", 4],
405
+ "managing_companies_api_keys_delete": ["DELETE", "/managing-companies/api-keys/delete/:apiKeyId", "b", "frontend_permission_http", 1],
406
+ "managing_companies_api_keys_list": ["GET", "/managing-companies/api-keys/list", "b", "frontend_permission_http", 2],
407
+ "managing_companies_api_keys_revoke": ["POST", "/managing-companies/api-keys/revoke/:apiKeyId", "b", "frontend_permission_http", 1],
408
+ "managing_companies_api_keys_update": ["PUT", "/managing-companies/api-keys/update/:apiKeyId", "b", "frontend_permission_http", 5],
409
+ "managing_companies_cost_centers_by_id": ["GET", "/managing-companies/cost-centers/byId/:id", "b", "frontend_permission_http", 1],
410
+ "managing_companies_cost_centers_by_ids": ["GET", "/managing-companies/cost-centers/by-ids", "b", "frontend_permission_http", 2],
411
+ "managing_companies_cost_centers_create": ["POST", "/managing-companies/cost-centers/create", "b", "frontend_permission_http", 4],
412
+ "managing_companies_cost_centers_delete": ["DELETE", "/managing-companies/cost-centers/delete/:id", "b", "frontend_permission_http", 1],
413
+ "managing_companies_cost_centers_list": ["GET", "/managing-companies/cost-centers/list/:managingCompanyId", "b", "frontend_permission_http", 3],
414
+ "managing_companies_cost_centers_logos_delete": ["DELETE", "/managing-companies/cost-centers/logos/delete/:id/:mode", "b", "frontend_permission_http", 1],
415
+ "managing_companies_cost_centers_logos_settings": ["GET", "/managing-companies/cost-centers/logos/settings/:id", "b", "frontend_permission_http", 1],
416
+ "managing_companies_cost_centers_logos_upload": ["POST", "/managing-companies/cost-centers/logos/upload/:id/:mode", "b", "frontend_permission_http", 1],
417
+ "managing_companies_cost_centers_logos_urls": ["GET", "/managing-companies/cost-centers/logos/urls/:id", "b", "frontend_permission_http", 1],
418
+ "managing_companies_cost_centers_my": ["GET", "/managing-companies/cost-centers/my/:managingCompanyId", "b", "frontend_permission_http", 1],
419
+ "managing_companies_cost_centers_update": ["PUT", "/managing-companies/cost-centers/update/:id", "b", "frontend_permission_http", 5],
420
+ "managing_companies_create": ["POST", "/managing-companies", "b", "frontend_permission_http", 4],
421
+ "managing_companies_current_external": ["GET", "/managing-companies/external/current", "b", "unified_bearer", 2, ["companies:read"]],
422
+ "managing_companies_delete": ["DELETE", "/managing-companies/:id", "b", "frontend_permission_http", 1],
423
+ "managing_companies_get_by_id": ["GET", "/managing-companies/:id", "b", "frontend_permission_http", 1],
424
+ "managing_companies_invites_accept": ["POST", "/managing-companies/invites/accept/:token", "b", "frontend_bearer_http", 1],
425
+ "managing_companies_invites_cancel": ["DELETE", "/managing-companies/invites/cancel/:inviteId", "b", "frontend_bearer_http", 5],
426
+ "managing_companies_invites_pending_company": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId", "b", "frontend_permission_http", 3],
427
+ "managing_companies_invites_pending_company_preview": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId/preview", "b", "frontend_bearer_http", 3],
428
+ "managing_companies_invites_pending_user": ["GET", "/managing-companies/invites/pending/user", "b", "frontend_permission_http", 2],
429
+ "managing_companies_invites_reject": ["POST", "/managing-companies/invites/reject/:token", "b", "frontend_bearer_http", 1],
430
+ "managing_companies_invoice_layouts_catalog": ["GET", "/managing-companies/invoice-layouts/catalog", "b", "frontend_bearer_http", 2],
431
+ "managing_companies_invoice_layouts_effective": ["GET", "/managing-companies/invoice-layouts/effective", "b", "frontend_bearer_http", 2],
432
+ "managing_companies_invoice_layouts_preview": ["GET", "/managing-companies/invoice-layouts/preview", "b", "frontend_bearer_http", 2],
433
+ "managing_companies_invoice_layouts_previews": ["GET", "/managing-companies/invoice-layouts/previews", "b", "frontend_bearer_http", 2],
434
+ "managing_companies_invoice_templates_archive": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/archive", "b", "frontend_bearer_http", 1],
435
+ "managing_companies_invoice_templates_create": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/create", "b", "frontend_bearer_http", 5],
436
+ "managing_companies_invoice_templates_duplicate": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/duplicate", "b", "frontend_bearer_http", 5],
437
+ "managing_companies_invoice_templates_from_invoice": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/from-invoice", "b", "frontend_bearer_http", 5],
438
+ "managing_companies_invoice_templates_get": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 1],
439
+ "managing_companies_invoice_templates_list": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/list", "b", "frontend_bearer_http", 3],
440
+ "managing_companies_invoice_templates_update": ["PUT", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 5],
441
+ "managing_companies_invoice_transparency_context": ["GET", "/managing-companies/invoice-transparency/:managingCompanyId/context", "b", "frontend_bearer_http", 1],
442
+ "managing_companies_invoice_transparency_quote": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/quote", "b", "frontend_bearer_http", 5],
443
+ "managing_companies_item_type_configs_archive": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value/archive", "b", "frontend_bearer_http", 1],
444
+ "managing_companies_item_type_configs_create": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs", "b", "frontend_bearer_http", 5],
445
+ "managing_companies_item_type_configs_update": ["PUT", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value", "b", "frontend_bearer_http", 5],
446
+ "managing_companies_list": ["GET", "/managing-companies", "b", "frontend_permission_http", 2],
447
+ "managing_companies_logos_delete": ["DELETE", "/managing-companies/logos/delete/:mode", "b", "frontend_bearer_http", 1],
448
+ "managing_companies_logos_set_mode": ["PUT", "/managing-companies/logos/mode", "b", "frontend_bearer_http", 4],
449
+ "managing_companies_logos_settings": ["GET", "/managing-companies/logos/settings", "b", "frontend_bearer_http", 2],
450
+ "managing_companies_logos_upload": ["POST", "/managing-companies/logos/upload/:mode", "b", "frontend_bearer_http", 1],
451
+ "managing_companies_logos_urls": ["GET", "/managing-companies/logos/urls", "b", "frontend_bearer_http", 2],
452
+ "managing_companies_selected_current": ["GET", "/managing-companies/selected/current", "b", "frontend_bearer_http", 2],
453
+ "managing_companies_selected_set": ["POST", "/managing-companies/selected/set/:companyId", "b", "frontend_bearer_http", 1],
454
+ "managing_companies_update": ["PUT", "/managing-companies/:id", "b", "frontend_permission_http", 5],
455
+ "managing_companies_user_assignments_assign": ["POST", "/managing-companies/user-assignments/assign", "b", "frontend_permission_http", 4],
456
+ "managing_companies_user_assignments_cost_centers_add": ["POST", "/managing-companies/user-assignments/cost-centers/add", "b", "frontend_permission_http", 4],
457
+ "managing_companies_user_assignments_cost_centers_remove": ["POST", "/managing-companies/user-assignments/cost-centers/remove", "b", "frontend_permission_http", 4],
458
+ "managing_companies_user_assignments_list": ["GET", "/managing-companies/user-assignments/list/:companyId", "b", "frontend_permission_http", 3],
459
+ "managing_companies_user_assignments_revoke": ["POST", "/managing-companies/user-assignments/revoke", "b", "frontend_permission_http", 4],
460
+ "managing_companies_user_assignments_update": ["PUT", "/managing-companies/user-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
461
+ "managing_companies_vat_settings_decision_upsert": ["PUT", "/managing-companies/vat-settings/:companyId/decisions/:decisionKey", "b", "frontend_bearer_http", 5],
462
+ "managing_companies_vat_settings_get": ["GET", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 1],
463
+ "managing_companies_vat_settings_tax_alerts": ["GET", "/managing-companies/vat-settings/:companyId/tax-alerts", "b", "frontend_bearer_http", 1],
464
+ "managing_companies_vat_settings_upsert": ["POST", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 5],
465
+ "oauth2_clients_audit": ["GET", "/oauth/clients/audit/:id", "b", "frontend_bearer_http", 3],
466
+ "oauth2_clients_create": ["POST", "/oauth/clients/create", "b", "frontend_bearer_http", 4],
467
+ "oauth2_clients_list": ["GET", "/oauth/clients/list", "b", "frontend_bearer_http", 2],
468
+ "oauth2_clients_revoke": ["DELETE", "/oauth/clients/revoke/:id", "b", "frontend_bearer_http", 1],
469
+ "oauth2_clients_update": ["PUT", "/oauth/clients/update/:id", "b", "frontend_bearer_http", 5],
470
+ "oauth2_external_clients_create": ["POST", "/oauth/clients/external", "k", "x_api_key_https", 4],
471
+ "oauth2_external_clients_delete": ["DELETE", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
472
+ "oauth2_external_clients_get": ["GET", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
473
+ "oauth2_external_clients_list": ["GET", "/oauth/clients/external/list", "k", "x_api_key_https", 2],
474
+ "oauth2_external_clients_retire": ["POST", "/oauth/clients/external/:idOrClientId/retire", "k", "x_api_key_https", 1],
475
+ "oauth2_external_clients_revoke": ["POST", "/oauth/clients/external/:idOrClientId/revoke", "k", "x_api_key_https", 1],
476
+ "oauth2_external_clients_rollback": ["POST", "/oauth/clients/external/:idOrClientId/rollback", "k", "x_api_key_https", 1],
477
+ "oauth2_external_clients_rotate": ["POST", "/oauth/clients/external/:idOrClientId/rotate", "k", "x_api_key_https", 1],
478
+ "oauth2_external_clients_update": ["PUT", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 5],
479
+ "oauth2_revoke": ["POST", "/oauth/revoke", "n", "public", 0],
480
+ "oauth2_scopes_list": ["GET", "/oauth/scopes", "b", "frontend_bearer_http", 2],
481
+ "oauth2_token": ["POST", "/oauth/token", "n", "public", 0],
482
+ "payments_allocate": ["POST", "/bookkeeping/payments/allocate/:paymentId", "b", "frontend_permission_http", 5],
483
+ "payments_allocation_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reversal-preview", "b", "frontend_permission_http", 1],
484
+ "payments_allocation_reverse": ["POST", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reverse", "b", "frontend_permission_http", 1],
485
+ "payments_apply_discount": ["POST", "/bookkeeping/payments/:paymentId/discount", "b", "frontend_permission_http", 5],
486
+ "payments_archive_account": ["POST", "/bookkeeping/payments/accounts/:accountId/archive", "b", "frontend_permission_http", 1],
487
+ "payments_book": ["POST", "/bookkeeping/payments/:paymentId/book", "b", "frontend_permission_http", 5],
488
+ "payments_booking_payment_suggestions": ["GET", "/bookkeeping/payments/booking-match/:targetType/:targetId/payment-suggestions", "b", "frontend_permission_http", 3],
489
+ "payments_cashbook": ["GET", "/bookkeeping/payments/cashbook", "b", "frontend_permission_http", 2],
490
+ "payments_confirm_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/confirm", "b", "frontend_permission_http", 4],
491
+ "payments_create_account": ["POST", "/bookkeeping/payments/accounts/create", "b", "frontend_permission_http", 4],
492
+ "payments_create_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 4],
493
+ "payments_create_import_profile": ["POST", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 4],
494
+ "payments_create_manual": ["POST", "/bookkeeping/payments/manual", "b", "frontend_permission_http", 4],
495
+ "payments_delete": ["DELETE", "/bookkeeping/payments/:paymentId", "b", "frontend_permission_http", 1],
496
+ "payments_delete_account": ["DELETE", "/bookkeeping/payments/accounts/:accountId", "b", "frontend_permission_http", 1],
497
+ "payments_download_csv_template": ["GET", "/bookkeeping/payments/import/csv/template/:profileKey", "b", "frontend_permission_http", 1],
498
+ "payments_get_account_by_id": ["GET", "/bookkeeping/payments/accounts/bdId/:accountId", "b", "frontend_permission_http", 1],
499
+ "payments_import_csv": ["POST", "/bookkeeping/payments/import/csv", "b", "frontend_permission_http", 4],
500
+ "payments_import_csv_preview": ["POST", "/bookkeeping/payments/import/csv/preview", "b", "frontend_permission_http", 4],
501
+ "payments_list_accounts": ["GET", "/bookkeeping/payments/accounts", "b", "frontend_permission_http", 2],
502
+ "payments_list_balance_snapshots": ["GET", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 2],
503
+ "payments_list_csv_profiles": ["GET", "/bookkeeping/payments/import/csv/profiles", "b", "frontend_permission_http", 0],
504
+ "payments_list_fee_proposals": ["GET", "/bookkeeping/payments/fee-proposals", "b", "frontend_permission_http", 2],
505
+ "payments_list_import_profiles": ["GET", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 2],
506
+ "payments_match_suggestions": ["GET", "/bookkeeping/payments/match/:paymentId/suggestions", "b", "frontend_permission_http", 3],
507
+ "payments_paypal_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/sync", "b", "frontend_permission_http", 3],
508
+ "payments_paypal_webhook_deregister": ["DELETE", "/bookkeeping/payments/accounts/:accountId/paypal/webhook", "b", "frontend_permission_http", 1],
509
+ "payments_paypal_webhook_receive": ["POST", "/bookkeeping/payments/public/paypal/webhook", "n", "public", 0],
510
+ "payments_paypal_webhook_register": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/webhook/register", "b", "frontend_permission_http", 5],
511
+ "payments_record_fee": ["POST", "/bookkeeping/payments/:paymentId/fee", "b", "frontend_permission_http", 5],
512
+ "payments_reject_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/reject", "b", "frontend_permission_http", 4],
513
+ "payments_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/reversal-preview", "b", "frontend_permission_http", 1],
514
+ "payments_reverse": ["POST", "/bookkeeping/payments/:paymentId/reverse", "b", "frontend_permission_http", 5],
515
+ "payments_search": ["GET", "/bookkeeping/payments/search", "b", "frontend_permission_http", 2],
516
+ "payments_sumup_oauth_callback": ["GET", "/bookkeeping/payments/public/sumup/oauth/callback", "n", "public", 2],
517
+ "payments_sumup_oauth_disconnect": ["DELETE", "/bookkeeping/payments/accounts/:accountId/sumup/oauth", "b", "frontend_permission_http", 1],
518
+ "payments_sumup_oauth_start": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/oauth/start", "b", "frontend_permission_http", 5],
519
+ "payments_sumup_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/sync", "b", "frontend_permission_http", 3],
520
+ "payments_transfer_link": ["POST", "/bookkeeping/payments/transfer/link", "b", "frontend_permission_http", 4],
521
+ "payments_transfer_linkable": ["GET", "/bookkeeping/payments/:paymentId/transfer/linkable", "b", "frontend_permission_http", 3],
522
+ "payments_transfer_unlink": ["POST", "/bookkeeping/payments/:paymentId/transfer/unlink", "b", "frontend_permission_http", 5],
523
+ "payments_unallocate": ["DELETE", "/bookkeeping/payments/allocations/:paymentId/:allocationId", "b", "frontend_permission_http", 1],
524
+ "payments_update": ["PUT", "/bookkeeping/payments/update/:paymentId", "b", "frontend_permission_http", 5],
525
+ "payments_update_account": ["PUT", "/bookkeeping/payments/accounts/update/:accountId", "b", "frontend_permission_http", 5],
526
+ "payments_update_fee_vat_treatment": ["PUT", "/bookkeeping/payments/accounts/:accountId/fee-vat-treatment", "b", "frontend_permission_http", 5],
527
+ "payments_update_import_profile": ["PUT", "/bookkeeping/payments/import/profiles/:id", "b", "frontend_permission_http", 5],
528
+ "payments_void_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots/:snapshotId/void", "b", "frontend_permission_http", 5],
529
+ "payments_writeoff": ["POST", "/bookkeeping/payments/:paymentId/writeoff", "b", "frontend_permission_http", 5],
530
+ "permissions_assign_to_role": ["POST", "/permissions/assign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
531
+ "permissions_assignments_list": ["GET", "/permissions/getAssignments", "b", "composite_and", 2],
532
+ "permissions_create": ["POST", "/permissions/create", "b", "frontend_permission_http", 4],
533
+ "permissions_list": ["GET", "/permissions/getAll", "b", "frontend_permission_http", 2],
534
+ "permissions_sync": ["POST", "/permissions/sync", "b", "frontend_permission_http", 2],
535
+ "permissions_unassign_from_role": ["DELETE", "/permissions/unassign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
536
+ "reconciliation_auto_match_confirm": ["POST", "/bookkeeping/reconciliation/auto-match/confirm", "b", "frontend_permission_http", 4],
537
+ "reconciliation_auto_match_preview": ["GET", "/bookkeeping/reconciliation/auto-match/preview", "b", "frontend_permission_http", 2],
538
+ "reconciliation_batch_suggestions": ["POST", "/bookkeeping/reconciliation/batch-suggestions", "b", "frontend_permission_http", 4],
539
+ "reconciliation_confirm_provider_payout": ["POST", "/bookkeeping/reconciliation/confirm-provider-payout", "b", "frontend_permission_http", 4],
540
+ "reconciliation_dashboard": ["GET", "/bookkeeping/reconciliation/dashboard", "b", "frontend_permission_http", 2],
541
+ "reconciliation_groups": ["GET", "/bookkeeping/reconciliation/groups", "b", "frontend_permission_http", 2],
542
+ "reconciliation_queue": ["GET", "/bookkeeping/reconciliation/queue", "b", "frontend_permission_http", 2],
543
+ "role_assignments_create": ["POST", "/role-assignments/create/:userId/:roleId", "b", "frontend_permission_http", 5],
544
+ "role_assignments_get_user_assignments": ["GET", "/role-assignments/getUserAssignments/:userId", "b", "frontend_permission_http", 1],
545
+ "role_assignments_list": ["GET", "/role-assignments/getAll", "b", "frontend_permission_http", 2],
546
+ "role_assignments_revoke": ["DELETE", "/role-assignments/delete/:userId/:roleId", "b", "frontend_permission_http", 1],
547
+ "roles_create": ["POST", "/roles/create", "b", "frontend_permission_http", 4],
548
+ "roles_delete": ["DELETE", "/roles/delete/:roleId", "b", "frontend_permission_http", 1],
549
+ "roles_get_by_id": ["GET", "/roles/getById/:roleId", "b", "frontend_permission_http", 1],
550
+ "roles_list": ["GET", "/roles/getAll", "b", "frontend_permission_http", 2],
551
+ "roles_update": ["PUT", "/roles/update/:roleId", "b", "frontend_permission_http", 5],
552
+ "settings_list": ["GET", "/settings/getAll", "b", "frontend_bearer_http", 2],
553
+ "settings_update": ["PUT", "/settings/update/:settingId/:key", "b", "frontend_permission_http", 5],
554
+ "user_activity_overview_get": ["POST", "/user-activity/user/:userId", "b", "frontend_permission_http", 5],
555
+ "user_activity_users_stats_list": ["GET", "/user-activity/users", "b", "frontend_permission_http", 2],
556
+ "users_create": ["POST", "/users/create", "b", "frontend_bearer_http", 4],
557
+ "users_delete": ["DELETE", "/users/delete/:userId", "b", "frontend_permission_http", 1],
558
+ "users_delete_external": ["DELETE", "/users/delete/external/:frontendUserId", "b", "frontend_bearer_http", 1],
559
+ "users_get_by_email": ["GET", "/users/getByEmail/:email", "b", "frontend_permission_http", 1],
560
+ "users_get_by_external_user_id": ["GET", "/users/getByExternalUserId/:externalUserId", "b", "frontend_bearer_http", 1],
561
+ "users_get_by_id": ["GET", "/users/getById/:userId", "b", "frontend_bearer_http", 3],
562
+ "users_list": ["GET", "/users/getAll", "b", "frontend_permission_http", 2],
563
+ "users_search": ["GET", "/users/search", "b", "frontend_permission_http", 2],
564
+ "users_update_external": ["PUT", "/users/update/external/:frontendUserId", "b", "frontend_bearer_http", 5],
565
+ "webhooks_delete": ["DELETE", "/webhooks/delete/:webhookId", "b", "frontend_permission_http", 1],
566
+ "webhooks_delete_bulk": ["DELETE", "/webhooks/delete/mass/:webhookIds", "b", "frontend_permission_http", 1],
567
+ "webhooks_list": ["GET", "/webhooks/getAll", "b", "frontend_permission_http", 2],
568
+ "work_tracking_approve": ["POST", "/apps/admin/work-tracking/approve/:workEntryId", "b", "frontend_permission_http", 5],
569
+ "work_tracking_assignment_create": ["POST", "/apps/admin/work-tracking/assignments/create", "b", "frontend_permission_http", 4],
570
+ "work_tracking_assignment_delete": ["DELETE", "/apps/admin/work-tracking/assignments/delete/:workEntryAssignmentId", "b", "frontend_permission_http", 1],
571
+ "work_tracking_assignment_update": ["PUT", "/apps/admin/work-tracking/assignments/update/:workEntryAssignmentId", "b", "frontend_permission_http", 5],
572
+ "work_tracking_bill": ["POST", "/apps/admin/work-tracking/bill", "b", "frontend_permission_http", 4],
573
+ "work_tracking_bill_preview": ["POST", "/apps/admin/work-tracking/bill/preview", "b", "frontend_permission_http", 4],
574
+ "work_tracking_create": ["POST", "/apps/admin/work-tracking/create", "b", "frontend_permission_http", 4],
575
+ "work_tracking_delete": ["DELETE", "/apps/admin/work-tracking/delete/:workEntryId", "b", "frontend_permission_http", 1],
576
+ "work_tracking_get_by_id": ["GET", "/apps/admin/work-tracking/byId/:workEntryId", "b", "frontend_permission_http", 1],
577
+ "work_tracking_get_my_role": ["GET", "/apps/admin/work-tracking/my-role", "b", "frontend_permission_http", 2],
578
+ "work_tracking_list": ["GET", "/apps/admin/work-tracking/list", "b", "frontend_permission_http", 2],
579
+ "work_tracking_reject": ["POST", "/apps/admin/work-tracking/reject/:workEntryId", "b", "frontend_permission_http", 5],
580
+ "work_tracking_update": ["PUT", "/apps/admin/work-tracking/update/:workEntryId", "b", "frontend_permission_http", 5]
581
+ };
582
+
583
+ // src/operations.ts
584
+ var API_KEY_AUTH_TYPES = /* @__PURE__ */ new Set(["x_api_key_http", "x_api_key_https"]);
585
+ var PUBLIC_AUTH_TYPES = /* @__PURE__ */ new Set(["public"]);
586
+ var VALIDATES_PARAMS = 1;
587
+ var VALIDATES_QUERY = 2;
588
+ var VALIDATES_BODY = 4;
589
+ var CHANNEL_BY_CODE = {
590
+ b: "bearer",
591
+ k: "api_key",
592
+ n: "none"
593
+ };
594
+ function authChannelForContractType(authType) {
595
+ if (!authType) return "bearer";
596
+ if (API_KEY_AUTH_TYPES.has(authType)) return "api_key";
597
+ if (PUBLIC_AUTH_TYPES.has(authType)) return "none";
598
+ return "bearer";
599
+ }
600
+ function toOperation(operationId, entry) {
601
+ const [method, path, channelCode, authType, validated, scopes] = entry;
602
+ return {
603
+ operationId,
604
+ method,
605
+ path,
606
+ authType,
607
+ // Der Code in der Tabelle ist bereits das Ergebnis von
608
+ // `authChannelForContractType` zur Erzeugungszeit; faellt er unbekannt aus,
609
+ // gilt dieselbe Regel noch einmal statt einer stillen Voreinstellung.
610
+ channel: CHANNEL_BY_CODE[channelCode] ?? authChannelForContractType(authType),
611
+ validated: {
612
+ params: (validated & VALIDATES_PARAMS) !== 0,
613
+ query: (validated & VALIDATES_QUERY) !== 0,
614
+ body: (validated & VALIDATES_BODY) !== 0
615
+ },
616
+ scopes: scopes ? [...scopes] : []
617
+ };
618
+ }
619
+ var cachedOperations = null;
620
+ function listOperations() {
621
+ if (!cachedOperations) {
622
+ cachedOperations = Object.entries(ROUTE_INDEX).map(
623
+ ([operationId, entry]) => toOperation(operationId, entry)
624
+ );
625
+ }
626
+ return cachedOperations;
627
+ }
628
+ function describeOperation(operationId) {
629
+ const entry = ROUTE_INDEX[operationId];
630
+ return entry ? toOperation(operationId, entry) : null;
631
+ }
632
+ var cachedPathIndex = null;
633
+ function pathIndex() {
634
+ if (cachedPathIndex) return cachedPathIndex;
635
+ const index = /* @__PURE__ */ new Map();
636
+ for (const operation of listOperations()) {
637
+ const segments = splitPath(operation.path);
638
+ const key = `${operation.method} ${segments.length}`;
639
+ const bucket = index.get(key);
640
+ if (bucket) bucket.push({ segments, operation });
641
+ else index.set(key, [{ segments, operation }]);
642
+ }
643
+ cachedPathIndex = index;
644
+ return index;
645
+ }
646
+ function splitPath(path) {
647
+ return path.split("/").filter((segment) => segment.length > 0);
648
+ }
649
+ function resolveOperation(method, path) {
650
+ const wanted = splitPath(path.split("?")[0] ?? path);
651
+ const bucket = pathIndex().get(`${method.toUpperCase()} ${wanted.length}`);
652
+ if (!bucket) return null;
653
+ let best = null;
654
+ for (const entry of bucket) {
655
+ let score = 0;
656
+ let matches = true;
657
+ for (let i = 0; i < wanted.length; i++) {
658
+ const template = entry.segments[i];
659
+ if (template.startsWith(":")) continue;
660
+ if (template === decodeSegment(wanted[i])) score++;
661
+ else {
662
+ matches = false;
663
+ break;
664
+ }
665
+ }
666
+ if (!matches) continue;
667
+ if (!best || score > best.score) best = { score, operation: entry.operation };
668
+ }
669
+ return best?.operation ?? null;
670
+ }
671
+ function decodeSegment(segment) {
672
+ try {
673
+ return decodeURIComponent(segment);
674
+ } catch {
675
+ return segment;
676
+ }
677
+ }
678
+ var OrvelloOperationError = class extends Error {
679
+ constructor(message, operationId) {
680
+ super(message);
681
+ this.operationId = operationId;
682
+ this.name = "OrvelloOperationError";
683
+ }
684
+ operationId;
685
+ };
686
+ function buildPath(operationId, params) {
687
+ const operation = describeOperation(operationId);
688
+ if (!operation) {
689
+ throw new OrvelloOperationError(
690
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against.`,
691
+ operationId
692
+ );
693
+ }
694
+ return "/" + splitPath(operation.path).map((segment) => {
695
+ if (!segment.startsWith(":")) return segment;
696
+ const name = segment.slice(1);
697
+ const value = params?.[name];
698
+ if (value === void 0 || value === null || value === "") {
699
+ throw new OrvelloOperationError(
700
+ `orvello operation "${operationId}" needs the path parameter "${name}" (${operation.method} ${operation.path}).`,
701
+ operationId
702
+ );
703
+ }
704
+ return encodeURIComponent(String(value));
705
+ }).join("/");
706
+ }
707
+
708
+ // src/capabilities.ts
709
+ var SDK_VERSION2 = "0.2.0" ;
710
+ var CLIENT_MANAGEMENT_OPS = [
711
+ "oauth2_external_clients_list",
712
+ "oauth2_external_clients_get",
713
+ "oauth2_external_clients_create",
714
+ "oauth2_external_clients_update",
715
+ "oauth2_external_clients_delete"
716
+ ];
717
+ var CLIENT_ROTATION_OPS = ["oauth2_external_clients_rotate"];
718
+ var GRACE_PERIOD_OPS = ["oauth2_external_clients_retire", "oauth2_external_clients_rollback"];
719
+ var REVOCATION_OPS = ["oauth2_external_clients_revoke"];
720
+ function capabilityFrom(operationIds, reasonWhenMissing) {
721
+ const present = operationIds.filter((id) => describeOperation(id) !== null);
722
+ if (present.length === operationIds.length) {
723
+ return { supported: true, operations: present };
724
+ }
725
+ const missing = operationIds.filter((id) => !present.includes(id));
726
+ return {
727
+ supported: false,
728
+ operations: present,
729
+ reason: `${reasonWhenMissing} Fehlend im Vertrag: ${missing.join(", ")}.`
730
+ };
731
+ }
732
+ function capabilityFromPrefix(prefix, reasonWhenMissing) {
733
+ const present = listOperations().filter((operation) => operation.operationId.startsWith(prefix)).map((operation) => operation.operationId);
734
+ return present.length > 0 ? { supported: true, operations: present } : { supported: false, operations: [], reason: reasonWhenMissing };
735
+ }
736
+ function orvelloCapabilities() {
737
+ const operations = listOperations();
738
+ const authChannels = { bearer: 0, api_key: 0, none: 0 };
739
+ for (const operation of operations) authChannels[operation.channel]++;
740
+ return {
741
+ service: "orvello",
742
+ sdkVersion: SDK_VERSION2,
743
+ contractSha256: CONTRACT_SHA256,
744
+ operationCount: operations.length,
745
+ authChannels,
746
+ capabilities: {
747
+ // `/health/contract` ist bewusst KEINE Vertrags-Route: der Endpunkt
748
+ // beschreibt den Vertrag und kann deshalb nicht in ihm stehen. Er gehoert
749
+ // zur Zusage dieses SDK und wird von `diagnoseOrvello` live geprueft.
750
+ contractFingerprint: {
751
+ supported: true,
752
+ operations: []
753
+ },
754
+ healthCheck: capabilityFrom(
755
+ ["app_info_health"],
756
+ "Ohne Erreichbarkeits-Endpunkt bleibt nur der Umweg ueber eine echte Anfrage."
757
+ ),
758
+ clientManagement: capabilityFrom(
759
+ CLIENT_MANAGEMENT_OPS,
760
+ "Ohne diese Routen kann ein Verwalter keine Zugaenge fuer andere Apps ausstellen."
761
+ ),
762
+ clientRotation: capabilityFrom(
763
+ CLIENT_ROTATION_OPS,
764
+ "Ohne Erneuerung ist ein einmal ausgegebenes Geheimnis dauerhaft."
765
+ ),
766
+ rotationGracePeriod: capabilityFrom(
767
+ GRACE_PERIOD_OPS,
768
+ "Ohne Rueckzug und Ruecknahme ist jede Erneuerung ein harter Schnitt."
769
+ ),
770
+ clientRevocation: capabilityFrom(
771
+ REVOCATION_OPS,
772
+ "Ohne Widerruf bleibt ein kompromittierter Zugang bis zum Ablauf gueltig."
773
+ ),
774
+ entitlements: capabilityFromPrefix(
775
+ "entitlements_",
776
+ "Dieser Vertrag kennt keine Berechtigungs-Routen."
777
+ ),
778
+ invoicing: capabilityFromPrefix(
779
+ "invoices_",
780
+ "Dieser Vertrag kennt keine Rechnungs-Routen."
781
+ ),
782
+ serverSideDryRun: {
783
+ supported: false,
784
+ operations: [],
785
+ reason: "orvello bietet keinen serverseitigen Probelauf fuer die Client-Verwaltung an (`dryRun` gibt es nur in der Buchhaltung). Nebenwirkungsfrei pruefbar ist der Weg trotzdem: `preflightOrvello` beweist Erreichbarkeit, Vertrag und Credential, ohne zu schreiben \u2014 es beweist damit die Berechtigung, nicht das Ergebnis."
786
+ }
787
+ }
788
+ };
789
+ }
790
+
791
+ // src/preflight.ts
792
+ function step(name, ok, detail, skipped = false) {
793
+ return { name, ok, skipped, detail };
794
+ }
795
+ async function preflightOrvello(host, operationId, options = {}) {
796
+ const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
797
+ const steps = [];
798
+ const problems = [];
799
+ const report = (extra) => ({
800
+ ok: problems.length === 0,
801
+ operationId,
802
+ method: null,
803
+ path: null,
804
+ baseUrl: null,
805
+ authChannel: null,
806
+ sideEffects: "none",
807
+ serverSideDryRun: false,
808
+ steps,
809
+ problems,
810
+ checkedAt,
811
+ ...extra
812
+ });
813
+ const operation = describeOperation(operationId);
814
+ if (!operation) {
815
+ steps.push(
816
+ step(
817
+ "operation",
818
+ false,
819
+ `Der Vertrag, gegen den dieses SDK gebaut wurde, kennt "${operationId}" nicht. Entweder ist der Name falsch, oder das SDK ist aelter als der Dienst.`
820
+ )
821
+ );
822
+ problems.push(`Unbekannte Operation "${operationId}".`);
823
+ return report({});
824
+ }
825
+ steps.push(
826
+ step(
827
+ "operation",
828
+ true,
829
+ `${operation.method} ${operation.path} (Auth laut Vertrag: ${operation.authType || "keine Angabe"} \u2192 Bahn "${operation.channel}").`
830
+ )
831
+ );
832
+ let path = null;
833
+ try {
834
+ path = buildPath(operationId, options.params);
835
+ steps.push(step("path-parameters", true, `Gerufen wuerde: ${operation.method} ${path}`));
836
+ } catch (error) {
837
+ const detail = error instanceof OrvelloOperationError ? error.message : String(error);
838
+ steps.push(step("path-parameters", false, detail));
839
+ problems.push(detail);
840
+ return report({ method: operation.method, authChannel: operation.channel });
841
+ }
842
+ const shapeProblems = [];
843
+ if (operation.validated.body && options.body === void 0) {
844
+ shapeProblems.push("Der Dienst validiert einen Body, es wurde aber keiner uebergeben.");
845
+ }
846
+ if (!operation.validated.body && options.body !== void 0) {
847
+ shapeProblems.push("Es wurde ein Body uebergeben, den diese Route nicht auswertet.");
848
+ }
849
+ if (operation.validated.query && options.query === void 0) {
850
+ shapeProblems.push(
851
+ "Die Route validiert Query-Parameter; ohne uebergebene Werte gelten allein die Voreinstellungen des Dienstes."
852
+ );
853
+ }
854
+ if (shapeProblems.length === 0) {
855
+ steps.push(step("request-shape", true, "Body- und Query-Erwartung des Vertrags sind erfuellt."));
856
+ } else {
857
+ const hard = operation.validated.body && options.body === void 0;
858
+ steps.push(step("request-shape", !hard, shapeProblems.join(" ")));
859
+ if (hard) problems.push(shapeProblems[0]);
860
+ }
861
+ const baseUrl = await host.resolveBaseUrl().catch(() => null);
862
+ if (!baseUrl) {
863
+ steps.push(step("reachable", false, "Die Basis-URL des Dienstes konnte nicht aufgeloest werden."));
864
+ problems.push("Basis-URL nicht aufloesbar.");
865
+ return report({ method: operation.method, path, authChannel: operation.channel });
866
+ }
867
+ const timeoutMs = options.timeoutMs ?? 8e3;
868
+ const reachable = await probeReachable(host, baseUrl, timeoutMs, options.signal);
869
+ steps.push(step("reachable", reachable.ok, reachable.detail));
870
+ if (!reachable.ok) {
871
+ problems.push(reachable.detail);
872
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
873
+ }
874
+ const diagnosis = await diagnoseOrvello({
875
+ baseUrl,
876
+ fetch: host.fetchImpl(),
877
+ timeoutMs,
878
+ signal: options.signal
879
+ });
880
+ if (diagnosis.contract.status === "match") {
881
+ steps.push(step("contract", true, `Vertrag stimmt ueberein (${diagnosis.contract.sdk.slice(0, 12)}).`));
882
+ } else if (diagnosis.contract.status === "drift") {
883
+ const detail = diagnosis.problems[0] ?? "Vertrags-Abweichung zwischen SDK und Dienst.";
884
+ steps.push(step("contract", false, detail));
885
+ problems.push(detail);
886
+ } else {
887
+ steps.push(
888
+ step(
889
+ "contract",
890
+ false,
891
+ diagnosis.problems[0] ?? "Der Vertrag der Gegenstelle konnte nicht ermittelt werden.",
892
+ true
893
+ )
894
+ );
895
+ }
896
+ if (operation.channel === "none") {
897
+ steps.push(step("credential-configured", true, "Die Route ist oeffentlich und braucht kein Credential.", true));
898
+ steps.push(step("credential-accepted", true, "Entfaellt: oeffentliche Route.", true));
899
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
900
+ }
901
+ const configured = await host.hasCredentialFor(operation.channel);
902
+ const channelName = operation.channel === "api_key" ? "der Verwaltungs-Schluessel (Header `x-api-key`)" : "das Bearer-Credential (OAuth2-Client oder Token)";
903
+ steps.push(
904
+ step(
905
+ "credential-configured",
906
+ configured,
907
+ configured ? `${channelName} ist hinterlegt.` : `${channelName} fehlt. Diese Route ist ohne ihn nicht aufrufbar.`
908
+ )
909
+ );
910
+ if (!configured) {
911
+ problems.push(`Kein Credential fuer die Bahn "${operation.channel}" hinterlegt.`);
912
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
913
+ }
914
+ if (options.skipCredentialProbe) {
915
+ steps.push(
916
+ step("credential-accepted", false, "Auf Wunsch uebersprungen \u2014 hinterlegt ist nicht angenommen.", true)
917
+ );
918
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
919
+ }
920
+ const accepted = await host.probeCredential(operation.channel, options.signal);
921
+ steps.push(step("credential-accepted", accepted.ok, accepted.detail));
922
+ if (!accepted.ok) problems.push(accepted.detail);
923
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
924
+ }
925
+ async function probeReachable(host, baseUrl, timeoutMs, signal) {
926
+ const doFetch = host.fetchImpl();
927
+ const controller = new AbortController();
928
+ const onAbort = () => controller.abort(signal?.reason);
929
+ signal?.addEventListener("abort", onAbort, { once: true });
930
+ if (signal?.aborted) controller.abort(signal.reason);
931
+ const timer = setTimeout(() => controller.abort(new Error(`Reachability probe timed out after ${timeoutMs}ms`)), timeoutMs);
932
+ const started = Date.now();
933
+ try {
934
+ const response = await doFetch(`${baseUrl}/health`, {
935
+ method: "GET",
936
+ headers: { accept: "application/json" },
937
+ signal: controller.signal
938
+ });
939
+ const took = Date.now() - started;
940
+ return {
941
+ ok: response.status < 500,
942
+ detail: response.status < 500 ? `${baseUrl} antwortet (${response.status}, ${took} ms).` : `${baseUrl} antwortet mit ${response.status} \u2014 der Dienst laeuft, aber nicht gesund.`
943
+ };
944
+ } catch (error) {
945
+ const detail = error instanceof Error ? error.message : String(error);
946
+ return { ok: false, detail: `${baseUrl} ist nicht erreichbar: ${detail}` };
947
+ } finally {
948
+ clearTimeout(timer);
949
+ signal?.removeEventListener("abort", onAbort);
950
+ }
951
+ }
952
+
184
953
  // src/client.ts
185
954
  var OrvelloApiError = class extends Error {
186
955
  constructor(status, statusText, endpoint, body, message) {
@@ -204,14 +973,20 @@ var OrvelloApiError = class extends Error {
204
973
  return this.body;
205
974
  }
206
975
  };
207
- var OrvelloClient = class {
976
+ var OrvelloClient = class _OrvelloClient {
208
977
  baseUrl;
209
978
  auth;
979
+ managementApiKey;
980
+ extraHeaders;
210
981
  doFetch;
211
982
  timeoutMs;
212
983
  maxRetries;
213
984
  retryBaseDelayMs;
214
985
  cachedOAuthToken = null;
986
+ breakerThreshold;
987
+ breakerCooldownMs;
988
+ breakerFailures = 0;
989
+ breakerLastFailureAt = null;
215
990
  // Cached default bank account (5 minutes TTL)
216
991
  _bankAccountCache = null;
217
992
  _bankAccountCacheTime = 0;
@@ -228,10 +1003,19 @@ var OrvelloClient = class {
228
1003
  } else {
229
1004
  this.auth = this.envAuth();
230
1005
  }
1006
+ this.managementApiKey = config.managementApiKey ?? this.envManagementApiKey();
1007
+ this.extraHeaders = config.headers;
231
1008
  this.doFetch = config.fetch || globalThis.fetch;
232
1009
  this.timeoutMs = config.timeoutMs ?? 15e3;
233
1010
  this.maxRetries = config.maxRetries ?? 3;
234
1011
  this.retryBaseDelayMs = config.retryBaseDelayMs ?? 500;
1012
+ if (config.circuitBreaker === false) {
1013
+ this.breakerThreshold = Number.POSITIVE_INFINITY;
1014
+ this.breakerCooldownMs = 0;
1015
+ } else {
1016
+ this.breakerThreshold = config.circuitBreaker?.threshold ?? 5;
1017
+ this.breakerCooldownMs = config.circuitBreaker?.cooldownMs ?? 6e4;
1018
+ }
235
1019
  }
236
1020
  envBaseUrl() {
237
1021
  if (typeof process === "undefined" || !process?.env) return void 0;
@@ -250,10 +1034,31 @@ var OrvelloClient = class {
250
1034
  if (apiKey) return { apiKey };
251
1035
  return void 0;
252
1036
  }
1037
+ envManagementApiKey() {
1038
+ if (typeof process === "undefined" || !process?.env) return void 0;
1039
+ const key = process.env.ORVELLO_MANAGEMENT_API_KEY;
1040
+ return key && key !== "todo" ? key : void 0;
1041
+ }
253
1042
  async resolveBaseUrl() {
254
1043
  const val = typeof this.baseUrl === "function" ? await this.baseUrl() : this.baseUrl;
255
1044
  return val.replace(/\/+$/, "");
256
1045
  }
1046
+ static async resolveValue(provider) {
1047
+ if (provider === void 0) return void 0;
1048
+ return typeof provider === "function" ? await provider() : provider;
1049
+ }
1050
+ /**
1051
+ * Der Verwaltungs-Schluessel, sofern hinterlegt.
1052
+ *
1053
+ * Ein leerer String zaehlt als "nicht hinterlegt". Sonst waere die haeufigste
1054
+ * Fehlkonfiguration — eine gesetzte, aber leere Umgebungsvariable — von einem
1055
+ * echten Wert nicht zu unterscheiden, und der Fehler kaeme erst als `403` vom
1056
+ * Dienst zurueck.
1057
+ */
1058
+ async resolveManagementApiKey() {
1059
+ const key = (await _OrvelloClient.resolveValue(this.managementApiKey))?.trim();
1060
+ return key ? key : void 0;
1061
+ }
257
1062
  async getAuthHeader() {
258
1063
  if (!this.auth) return null;
259
1064
  if (typeof this.auth === "string") {
@@ -332,6 +1137,9 @@ var OrvelloClient = class {
332
1137
  const baseUrl = await this.resolveBaseUrl();
333
1138
  const cleanPath = path.startsWith("/") ? path : `/${path}`;
334
1139
  const url = new URL(`${baseUrl}${cleanPath}`);
1140
+ const method = (options.method ?? "GET").toUpperCase();
1141
+ const authChannel = options.authChannel ?? resolveOperation(method, cleanPath)?.channel ?? "bearer";
1142
+ this.assertCircuitClosed(cleanPath);
335
1143
  if (options.query) {
336
1144
  for (const [k, v] of Object.entries(options.query)) {
337
1145
  if (v !== void 0 && v !== null) {
@@ -350,13 +1158,30 @@ var OrvelloClient = class {
350
1158
  timeoutMs
351
1159
  );
352
1160
  try {
353
- const authHeader = await this.getAuthHeader();
354
1161
  const headers = new Headers(options.headers);
355
- if (!headers.has("Accept")) {
356
- headers.set("Accept", options.rawResponse ? "*/*" : "application/json");
1162
+ const configured = await _OrvelloClient.resolveValue(this.extraHeaders);
1163
+ if (configured) {
1164
+ for (const [name, value] of Object.entries(configured)) {
1165
+ if (!headers.has(name)) headers.set(name, value);
1166
+ }
357
1167
  }
358
- if (authHeader && !headers.has("Authorization")) {
359
- headers.set("Authorization", authHeader);
1168
+ if (authChannel === "bearer") {
1169
+ const authHeader = await this.getAuthHeader();
1170
+ if (authHeader && !headers.has("Authorization")) {
1171
+ headers.set("Authorization", authHeader);
1172
+ }
1173
+ } else if (authChannel === "api_key") {
1174
+ const key = await this.resolveManagementApiKey();
1175
+ if (!key) {
1176
+ throw new OrvelloApiError(
1177
+ 0,
1178
+ "missing management credential",
1179
+ cleanPath,
1180
+ null,
1181
+ `${method} ${cleanPath} is a management route and needs the \`x-api-key\` credential. Pass \`managementApiKey\` to createOrvelloClient() or set ORVELLO_MANAGEMENT_API_KEY. It is a different value from the OAuth2 client used for the business routes.`
1182
+ );
1183
+ }
1184
+ if (!headers.has("x-api-key")) headers.set("x-api-key", key);
360
1185
  }
361
1186
  if (options.idempotencyKey && !headers.has("Idempotency-Key")) {
362
1187
  headers.set("Idempotency-Key", options.idempotencyKey);
@@ -370,7 +1195,7 @@ var OrvelloClient = class {
370
1195
  signal: controller.signal
371
1196
  });
372
1197
  if (!resp.ok) {
373
- if (resp.status === 401) {
1198
+ if (resp.status === 401 && authChannel === "bearer") {
374
1199
  const hadCachedToken = Boolean(this.cachedOAuthToken);
375
1200
  this.cachedOAuthToken = null;
376
1201
  if (hadCachedToken && attempt === 0 && attempt < maxRetries) {
@@ -385,11 +1210,14 @@ var OrvelloClient = class {
385
1210
  }
386
1211
  const apiMessage = errBody && typeof errBody === "object" && "message" in errBody && typeof errBody.message === "string" ? errBody.message : void 0;
387
1212
  const error = new OrvelloApiError(resp.status, resp.statusText, cleanPath, errBody, apiMessage);
1213
+ if (resp.status >= 500) this.recordFailure();
1214
+ else this.recordSuccess();
388
1215
  if (!this.isRetriable(resp.status, error) || attempt >= maxRetries) {
389
1216
  throw error;
390
1217
  }
391
1218
  lastError = error;
392
1219
  } else {
1220
+ this.recordSuccess();
393
1221
  const contentType = resp.headers.get("content-type") || "";
394
1222
  if (options.rawResponse || contentType.includes("application/pdf")) {
395
1223
  return await resp.blob();
@@ -412,6 +1240,7 @@ var OrvelloClient = class {
412
1240
  if (err instanceof OrvelloApiError && !this.isRetriable(err.status, err)) {
413
1241
  throw err;
414
1242
  }
1243
+ if (!(err instanceof OrvelloApiError)) this.recordFailure();
415
1244
  if (!this.isRetriable(null, err) || attempt >= maxRetries) {
416
1245
  throw err;
417
1246
  }
@@ -425,6 +1254,231 @@ var OrvelloClient = class {
425
1254
  }
426
1255
  throw lastError;
427
1256
  }
1257
+ // ── Sicherungsautomat ────────────────────────────────────────────────────
1258
+ recordSuccess() {
1259
+ this.breakerFailures = 0;
1260
+ this.breakerLastFailureAt = null;
1261
+ }
1262
+ recordFailure() {
1263
+ this.breakerFailures++;
1264
+ this.breakerLastFailureAt = Date.now();
1265
+ }
1266
+ /**
1267
+ * Ist der Dienst nach aktuellem Wissen ansprechbar?
1268
+ *
1269
+ * Antwortet ohne Netzzugriff aus dem Zustand des Automaten. Nach Ablauf der
1270
+ * Abkuehlzeit gilt er wieder als ansprechbar — der naechste echte Aufruf
1271
+ * entscheidet dann, ob das stimmt.
1272
+ */
1273
+ isAvailable() {
1274
+ if (this.breakerFailures < this.breakerThreshold) return true;
1275
+ if (this.breakerLastFailureAt === null) return true;
1276
+ return Date.now() - this.breakerLastFailureAt > this.breakerCooldownMs;
1277
+ }
1278
+ /** Der Zustand des Automaten, unverfaelscht — fuer Diagnose-Oberflaechen. */
1279
+ circuitState() {
1280
+ return {
1281
+ open: !this.isAvailable(),
1282
+ consecutiveFailures: this.breakerFailures,
1283
+ lastFailureAt: this.breakerLastFailureAt,
1284
+ threshold: this.breakerThreshold,
1285
+ cooldownMs: this.breakerCooldownMs
1286
+ };
1287
+ }
1288
+ /** Den Automaten von Hand schliessen, etwa nach einer behobenen Stoerung. */
1289
+ resetCircuit() {
1290
+ this.recordSuccess();
1291
+ }
1292
+ assertCircuitClosed(path) {
1293
+ if (this.isAvailable()) return;
1294
+ const waited = this.breakerLastFailureAt ? Date.now() - this.breakerLastFailureAt : 0;
1295
+ const remaining = Math.max(0, this.breakerCooldownMs - waited);
1296
+ throw new OrvelloApiError(
1297
+ 0,
1298
+ "circuit open",
1299
+ path,
1300
+ null,
1301
+ `orvello is not answering: ${this.breakerFailures} consecutive transport failures. Not retrying for another ${Math.ceil(remaining / 1e3)}s.`
1302
+ );
1303
+ }
1304
+ // ── Vertragsgetriebener Aufruf ───────────────────────────────────────────
1305
+ /**
1306
+ * Eine Operation des Vertrags ueber ihre `operationId` aufrufen.
1307
+ *
1308
+ * Methode, Pfad und Credential-Bahn kommen aus dem Vertrag; der Aufrufer gibt
1309
+ * nur die Werte. Das ist der Weg fuer alles, wofuer es keine getippte Methode
1310
+ * gibt — und der Weg, der bei einer neuen Route sofort mitwaechst, statt auf
1311
+ * eine Handarbeit in diesem Client zu warten.
1312
+ *
1313
+ * Der Rueckgabetyp ist bewusst offen: die genauen Typen je Operation stehen im
1314
+ * Unterpfad `@orvello/sdk/contract` und werden hier als Typ-Argument gesetzt.
1315
+ * Ein `operationId`, den der Vertrag nicht kennt, wirft sofort — nicht erst,
1316
+ * wenn der Dienst mit 404 antwortet.
1317
+ */
1318
+ async call(operationId, options = {}) {
1319
+ const operation = describeOperation(operationId);
1320
+ if (!operation) {
1321
+ throw new OrvelloOperationError(
1322
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against (@orvello/sdk speaks ${orvelloCapabilities().operationCount} operations).`,
1323
+ operationId
1324
+ );
1325
+ }
1326
+ const { params, body, ...rest } = options;
1327
+ const path = buildPath(operationId, params);
1328
+ return this.request(path, {
1329
+ ...rest,
1330
+ method: operation.method,
1331
+ authChannel: rest.authChannel ?? operation.channel,
1332
+ ...body === void 0 ? {} : { body: JSON.stringify(body) }
1333
+ });
1334
+ }
1335
+ // ── Zustand und Faehigkeiten ─────────────────────────────────────────────
1336
+ /**
1337
+ * Steht der Dienst, und wird unser Credential angenommen?
1338
+ *
1339
+ * ⭐ `available` und `authenticated` sind zwei Fragen, und der Bericht haelt sie
1340
+ * auseinander. Ein Dienst, der laeuft, aber unser Credential ablehnt, ist nicht
1341
+ * "verfuegbar" im Sinne dessen, der ihn benutzen will — und ein `authenticated:
1342
+ * null` heisst "nicht gefragt", nie "in Ordnung".
1343
+ */
1344
+ async checkHealth(options = {}) {
1345
+ const started = Date.now();
1346
+ const timeoutMs = options.timeoutMs ?? 8e3;
1347
+ let baseUrl;
1348
+ try {
1349
+ baseUrl = await this.resolveBaseUrl();
1350
+ } catch (error) {
1351
+ return {
1352
+ available: false,
1353
+ responseTimeMs: Date.now() - started,
1354
+ authenticated: null,
1355
+ error: error instanceof Error ? error.message : String(error)
1356
+ };
1357
+ }
1358
+ const controller = new AbortController();
1359
+ const onAbort = () => controller.abort(options.signal?.reason);
1360
+ options.signal?.addEventListener("abort", onAbort, { once: true });
1361
+ if (options.signal?.aborted) controller.abort(options.signal.reason);
1362
+ const timer = setTimeout(() => controller.abort(new Error(`Health check timed out after ${timeoutMs}ms`)), timeoutMs);
1363
+ try {
1364
+ const response = await this.doFetch(`${baseUrl}/health`, {
1365
+ method: "GET",
1366
+ headers: { accept: "application/json" },
1367
+ signal: controller.signal
1368
+ });
1369
+ if (response.status >= 500) {
1370
+ this.recordFailure();
1371
+ return {
1372
+ available: false,
1373
+ responseTimeMs: Date.now() - started,
1374
+ authenticated: null,
1375
+ error: `orvello answered ${response.status} on /health`
1376
+ };
1377
+ }
1378
+ this.recordSuccess();
1379
+ } catch (error) {
1380
+ this.recordFailure();
1381
+ return {
1382
+ available: false,
1383
+ responseTimeMs: Date.now() - started,
1384
+ authenticated: null,
1385
+ error: error instanceof Error ? error.message : String(error)
1386
+ };
1387
+ } finally {
1388
+ clearTimeout(timer);
1389
+ options.signal?.removeEventListener("abort", onAbort);
1390
+ }
1391
+ if (!this.auth) {
1392
+ return { available: true, responseTimeMs: Date.now() - started, authenticated: null };
1393
+ }
1394
+ try {
1395
+ const header = await this.getAuthHeader();
1396
+ return {
1397
+ available: true,
1398
+ responseTimeMs: Date.now() - started,
1399
+ authenticated: Boolean(header)
1400
+ };
1401
+ } catch (error) {
1402
+ return {
1403
+ available: true,
1404
+ responseTimeMs: Date.now() - started,
1405
+ authenticated: false,
1406
+ error: error instanceof Error ? error.message : String(error)
1407
+ };
1408
+ }
1409
+ }
1410
+ /** Was der Vertrag hergibt — ohne Netz, ohne Credential. */
1411
+ capabilities() {
1412
+ return orvelloCapabilities();
1413
+ }
1414
+ /** Spricht die laufende Gegenstelle denselben Vertrag wie dieses SDK? */
1415
+ async diagnose(options = {}) {
1416
+ return diagnoseOrvello({
1417
+ baseUrl: this.baseUrl,
1418
+ fetch: this.doFetch,
1419
+ ...options
1420
+ });
1421
+ }
1422
+ /**
1423
+ * Wuerde dieser Aufruf heute klappen? Prueft den ganzen Weg — Erreichbarkeit,
1424
+ * Vertrag, Credential — und schreibt dabei nichts.
1425
+ *
1426
+ * Gedacht fuer Verbindungs-Verwalter: eine Kante laesst sich damit turnusmaessig
1427
+ * nachpruefen, ohne sie anzufassen, und vor einem freigegebenen Schreibschritt
1428
+ * laesst sich zeigen, was er tun wuerde.
1429
+ */
1430
+ async preflight(operationId, options = {}) {
1431
+ const host = {
1432
+ resolveBaseUrl: () => this.resolveBaseUrl(),
1433
+ fetchImpl: () => this.doFetch,
1434
+ hasCredentialFor: async (channel) => {
1435
+ if (channel === "none") return true;
1436
+ if (channel === "api_key") return Boolean(await this.resolveManagementApiKey());
1437
+ return Boolean(this.auth);
1438
+ },
1439
+ probeCredential: (channel, signal) => this.probeCredential(channel, signal)
1440
+ };
1441
+ const report = await preflightOrvello(host, operationId, options);
1442
+ return {
1443
+ ...report,
1444
+ serverSideDryRun: this.capabilities().capabilities.serverSideDryRun.supported
1445
+ };
1446
+ }
1447
+ /**
1448
+ * Ein ausschliesslich lesender Aufruf auf einer Credential-Bahn.
1449
+ *
1450
+ * Je Bahn die guenstigste Frage, die ohne Nebenwirkung beantwortet, ob das
1451
+ * Credential angenommen wird:
1452
+ * - `api_key` → die Auflistung der Zugaenge mit `pageSize=1`
1453
+ * - `bearer` → das Holen des Tokens (der Dienst prueft dabei Kennung und Geheimnis)
1454
+ */
1455
+ async probeCredential(channel, signal) {
1456
+ if (channel === "none") return { ok: true, detail: "Oeffentliche Route, kein Credential noetig." };
1457
+ if (channel === "api_key") {
1458
+ try {
1459
+ await this.call("oauth2_external_clients_list", {
1460
+ query: { pageSize: 1 },
1461
+ maxRetries: 0,
1462
+ signal
1463
+ });
1464
+ return { ok: true, detail: "Der Verwaltungs-Schluessel wird angenommen (Leseprobe auf die Zugangsliste)." };
1465
+ } catch (error) {
1466
+ if (error instanceof OrvelloApiError) {
1467
+ return {
1468
+ ok: false,
1469
+ detail: error.status === 403 || error.status === 401 ? `Der Verwaltungs-Schluessel wird abgelehnt (${error.status}). Der Wert ist gesetzt, aber nicht der, den der Dienst erwartet.` : `Leseprobe fehlgeschlagen (${error.status}): ${error.message}`
1470
+ };
1471
+ }
1472
+ return { ok: false, detail: `Leseprobe fehlgeschlagen: ${error.message}` };
1473
+ }
1474
+ }
1475
+ try {
1476
+ const header = await this.getAuthHeader();
1477
+ return header ? { ok: true, detail: "Das Bearer-Credential wird angenommen (Token wurde ausgestellt)." } : { ok: false, detail: "Es konnte kein Bearer-Credential ermittelt werden." };
1478
+ } catch (error) {
1479
+ return { ok: false, detail: `Token konnte nicht geholt werden: ${error.message}` };
1480
+ }
1481
+ }
428
1482
  // ── Invoices ─────────────────────────────────────────────────────────────
429
1483
  invoices = {
430
1484
  search: (query, options) => this.request("/invoices/external", {
@@ -732,6 +1786,6 @@ function createOrvelloClient(config) {
732
1786
  return new OrvelloClient(config);
733
1787
  }
734
1788
 
735
- export { CONTRACT_SHA256, OrvelloApiError, OrvelloClient, buildBase64Receipt, calculateVat, createOrvelloClient, diagnoseOrvello, formatAmount, isKleinunternehmer, mapPaymentAccountToBankDetails };
1789
+ export { CONTRACT_SHA256, OrvelloApiError, OrvelloClient, OrvelloOperationError, authChannelForContractType, buildBase64Receipt, buildPath, calculateVat, createOrvelloClient, describeOperation, diagnoseOrvello, formatAmount, isKleinunternehmer, listOperations, mapPaymentAccountToBankDetails, orvelloCapabilities, preflightOrvello, resolveOperation };
736
1790
  //# sourceMappingURL=index.js.map
737
1791
  //# sourceMappingURL=index.js.map