@orvello/sdk 0.1.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.cjs CHANGED
@@ -4,7 +4,7 @@
4
4
  var CONTRACT_SHA256 = "4efd4e4b669168c9cab5419fa04dd4e26a2029de2d4b10a59918e366189e1072";
5
5
 
6
6
  // src/diagnose.ts
7
- var SDK_VERSION = "0.1.0" ;
7
+ var SDK_VERSION = "0.2.1" ;
8
8
  function normalizeBaseUrl(raw) {
9
9
  const trimmed = raw.trim();
10
10
  if (!trimmed) throw new Error("Base URL cannot be empty");
@@ -183,6 +183,776 @@ function mapPaymentAccountToBankDetails(account) {
183
183
  };
184
184
  }
185
185
 
186
+ // src/route-index.generated.ts
187
+ var ROUTE_INDEX = {
188
+ "DELETE__api_amp_proxy_key": ["DELETE", "/api/amp-proxy/:key", "n", "public", 0],
189
+ "GET__api_amp_proxy__discover": ["GET", "/api/amp-proxy/_discover", "n", "public", 0],
190
+ "GET__api_amp_proxy_key": ["GET", "/api/amp-proxy/:key", "n", "public", 0],
191
+ "POST__api_amp_proxy_key": ["POST", "/api/amp-proxy/:key", "n", "public", 0],
192
+ "admin_vat_create_system_settings": ["POST", "/admin/vat/system-settings", "b", "frontend_permission_http", 4],
193
+ "admin_vat_get_company_settings_history": ["GET", "/admin/vat/company/:companyId/settings-history", "b", "frontend_permission_http", 1],
194
+ "admin_vat_get_system_settings": ["GET", "/admin/vat/system-settings", "b", "frontend_permission_http", 0],
195
+ "admin_vat_get_system_settings_history": ["GET", "/admin/vat/system-settings/history", "b", "frontend_permission_http", 2],
196
+ "admin_vat_update_company_settings": ["PUT", "/admin/vat/company/:companyId/settings", "b", "frontend_permission_http", 5],
197
+ "admin_vat_update_system_settings": ["PUT", "/admin/vat/system-settings/:id", "b", "frontend_permission_http", 5],
198
+ "app_info_get": ["GET", "/app-info", "b", "frontend_bearer_http", 2],
199
+ "app_info_health": ["GET", "/app-info/health", "n", "public", 0],
200
+ "app_info_manifest": ["GET", "/app-info/manifest", "n", "public", 0],
201
+ "app_info_own_permissions_get": ["GET", "/app-info/ownPermissions", "b", "frontend_bearer_http", 2],
202
+ "bookkeeping_assets_add_cost_component": ["POST", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 5],
203
+ "bookkeeping_assets_apply_sonderafa": ["POST", "/bookkeeping/assets/:assetId/sonderafa", "b", "frontend_permission_http", 5],
204
+ "bookkeeping_assets_create": ["POST", "/bookkeeping/assets", "b", "frontend_permission_http", 4],
205
+ "bookkeeping_assets_delete": ["DELETE", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
206
+ "bookkeeping_assets_delete_cost_component": ["DELETE", "/bookkeeping/assets/:assetId/cost-components/:componentId", "b", "frontend_permission_http", 1],
207
+ "bookkeeping_assets_dispose": ["POST", "/bookkeeping/assets/:assetId/dispose", "b", "frontend_permission_http", 5],
208
+ "bookkeeping_assets_finalize_depreciation": ["POST", "/bookkeeping/assets/depreciation/finalize", "b", "frontend_permission_http", 4],
209
+ "bookkeeping_assets_generate_depreciation": ["POST", "/bookkeeping/assets/depreciation/generate", "b", "frontend_permission_http", 4],
210
+ "bookkeeping_assets_get_by_id": ["GET", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
211
+ "bookkeeping_assets_get_depreciation_records": ["GET", "/bookkeeping/assets/depreciation/records", "b", "frontend_permission_http", 2],
212
+ "bookkeeping_assets_get_sammelposten_pool": ["GET", "/bookkeeping/assets/sammelposten-pools/:poolId", "b", "frontend_permission_http", 1],
213
+ "bookkeeping_assets_iab_create": ["POST", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 4],
214
+ "bookkeeping_assets_iab_delete": ["DELETE", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
215
+ "bookkeeping_assets_iab_dissolve": ["POST", "/bookkeeping/assets/iab/:iabId/dissolve", "b", "frontend_permission_http", 5],
216
+ "bookkeeping_assets_iab_get": ["GET", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
217
+ "bookkeeping_assets_iab_list": ["GET", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 0],
218
+ "bookkeeping_assets_iab_reverse": ["POST", "/bookkeeping/assets/iab/:iabId/reverse", "b", "frontend_permission_http", 5],
219
+ "bookkeeping_assets_list_cost_components": ["GET", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 1],
220
+ "bookkeeping_assets_list_sammelposten_pools": ["GET", "/bookkeeping/assets/sammelposten-pools", "b", "frontend_permission_http", 0],
221
+ "bookkeeping_assets_search": ["GET", "/bookkeeping/assets", "b", "frontend_permission_http", 2],
222
+ "bookkeeping_assets_switch_to_linear": ["POST", "/bookkeeping/assets/:assetId/switch-to-linear", "b", "frontend_permission_http", 5],
223
+ "bookkeeping_assets_update": ["PUT", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 5],
224
+ "bookkeeping_audit_logs": ["GET", "/bookkeeping/audit/logs", "b", "frontend_permission_http", 2],
225
+ "bookkeeping_capital_movements_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/cash-confirm", "b", "frontend_permission_http", 5],
226
+ "bookkeeping_capital_movements_confirm": ["POST", "/bookkeeping/capital-movements/:id/confirm", "b", "frontend_permission_http", 1],
227
+ "bookkeeping_capital_movements_create": ["POST", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 4],
228
+ "bookkeeping_capital_movements_delete": ["DELETE", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
229
+ "bookkeeping_capital_movements_get_by_id": ["GET", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
230
+ "bookkeeping_capital_movements_kapitalkonto": ["GET", "/bookkeeping/capital-movements/kapitalkonto", "b", "frontend_permission_http", 2],
231
+ "bookkeeping_capital_movements_reverse": ["POST", "/bookkeeping/capital-movements/:id/reverse", "b", "frontend_permission_http", 5],
232
+ "bookkeeping_capital_movements_revoke_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
233
+ "bookkeeping_capital_movements_search": ["GET", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 2],
234
+ "bookkeeping_capital_movements_update": ["PATCH", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 5],
235
+ "bookkeeping_expenses_analyze_receipt": ["POST", "/bookkeeping/expenses/analyze-receipt", "b", "frontend_permission_http", 0],
236
+ "bookkeeping_expenses_bulk_confirm": ["POST", "/bookkeeping/expenses/bulk-confirm", "b", "frontend_permission_http", 4],
237
+ "bookkeeping_expenses_confirm": ["POST", "/bookkeeping/expenses/:id/confirm", "b", "frontend_permission_http", 1],
238
+ "bookkeeping_expenses_confirm_cash": ["POST", "/bookkeeping/expenses/:id/confirm-cash", "b", "frontend_permission_http", 5],
239
+ "bookkeeping_expenses_create": ["POST", "/bookkeeping/expenses", "b", "frontend_permission_http", 4],
240
+ "bookkeeping_expenses_create_external": ["POST", "/bookkeeping/expenses/external", "b", "unified_bearer", 4, ["expenses:write"]],
241
+ "bookkeeping_expenses_delete": ["DELETE", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
242
+ "bookkeeping_expenses_get_by_id": ["GET", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
243
+ "bookkeeping_expenses_mark_as_asset": ["POST", "/bookkeeping/expenses/:id/mark-as-asset", "b", "frontend_permission_http", 5],
244
+ "bookkeeping_expenses_revoke_cash_confirm": ["POST", "/bookkeeping/expenses/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
245
+ "bookkeeping_expenses_search": ["GET", "/bookkeeping/expenses", "b", "frontend_permission_http", 2],
246
+ "bookkeeping_expenses_update": ["PUT", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 5],
247
+ "bookkeeping_expenses_upload_receipt": ["POST", "/bookkeeping/expenses/:id/upload-receipt", "b", "frontend_permission_http", 1],
248
+ "bookkeeping_iap_payouts_import": ["POST", "/bookkeeping/iap-payouts/import", "b", "frontend_permission_http", 4],
249
+ "bookkeeping_iap_payouts_list": ["GET", "/bookkeeping/iap-payouts", "b", "frontend_permission_http", 2],
250
+ "bookkeeping_income_tax_create_employment": ["POST", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 4],
251
+ "bookkeeping_income_tax_create_sonderausgaben": ["POST", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 4],
252
+ "bookkeeping_income_tax_create_steuerminderungen": ["POST", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 4],
253
+ "bookkeeping_income_tax_create_vorsorge": ["POST", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 4],
254
+ "bookkeeping_income_tax_create_werbungskosten": ["POST", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 4],
255
+ "bookkeeping_income_tax_delete_employment": ["DELETE", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
256
+ "bookkeeping_income_tax_delete_sonderausgaben": ["DELETE", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 1],
257
+ "bookkeeping_income_tax_delete_steuerminderungen": ["DELETE", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 1],
258
+ "bookkeeping_income_tax_delete_vorsorge": ["DELETE", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 1],
259
+ "bookkeeping_income_tax_delete_werbungskosten": ["DELETE", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 1],
260
+ "bookkeeping_income_tax_get_employment": ["GET", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
261
+ "bookkeeping_income_tax_get_estimate": ["GET", "/bookkeeping/income-tax/estimate", "b", "frontend_permission_http", 2],
262
+ "bookkeeping_income_tax_get_settings": ["GET", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 0],
263
+ "bookkeeping_income_tax_get_summary": ["GET", "/bookkeeping/income-tax/summary", "b", "frontend_permission_http", 2],
264
+ "bookkeeping_income_tax_get_vorauszahlungen": ["GET", "/bookkeeping/income-tax/vorauszahlungen", "b", "frontend_permission_http", 2],
265
+ "bookkeeping_income_tax_list_employment": ["GET", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 2],
266
+ "bookkeeping_income_tax_list_sonderausgaben": ["GET", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 2],
267
+ "bookkeeping_income_tax_list_steuerminderungen": ["GET", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 2],
268
+ "bookkeeping_income_tax_list_vorsorge": ["GET", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 2],
269
+ "bookkeeping_income_tax_list_werbungskosten": ["GET", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 2],
270
+ "bookkeeping_income_tax_update_employment": ["PUT", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 5],
271
+ "bookkeeping_income_tax_update_sonderausgaben": ["PUT", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 5],
272
+ "bookkeeping_income_tax_update_steuerminderungen": ["PUT", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 5],
273
+ "bookkeeping_income_tax_update_vorsorge": ["PUT", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 5],
274
+ "bookkeeping_income_tax_update_werbungskosten": ["PUT", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 5],
275
+ "bookkeeping_income_tax_upsert_settings": ["POST", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 4],
276
+ "bookkeeping_locks_get_state": ["GET", "/bookkeeping/locks/state", "b", "frontend_permission_http", 0],
277
+ "bookkeeping_locks_overview": ["GET", "/bookkeeping/locks/overview", "b", "frontend_permission_http", 2],
278
+ "bookkeeping_locks_recommendation": ["GET", "/bookkeeping/locks/recommendation", "b", "frontend_permission_http", 2],
279
+ "bookkeeping_locks_set": ["POST", "/bookkeeping/locks/set", "b", "frontend_permission_http", 4],
280
+ "bookkeeping_payments_create_manual_external": ["POST", "/bookkeeping/payments/external/manual", "b", "unified_bearer", 4, ["payments:write"]],
281
+ "bookkeeping_payments_list_accounts_external": ["GET", "/bookkeeping/payments/external/accounts", "b", "unified_bearer", 2, ["payments:read"]],
282
+ "bookkeeping_payments_settle_invoice_external": ["POST", "/bookkeeping/payments/external/settle-invoice", "b", "unified_bearer", 4, ["payments:write", "invoices:write"]],
283
+ "bookkeeping_reports_asset_register": ["GET", "/bookkeeping/reports/assets", "b", "frontend_permission_http", 2],
284
+ "bookkeeping_reports_category_breakdown": ["GET", "/bookkeeping/reports/category-breakdown", "b", "frontend_permission_http", 2],
285
+ "bookkeeping_reports_euer": ["GET", "/bookkeeping/reports/euer", "b", "frontend_permission_http", 2],
286
+ "bookkeeping_reports_monthly_trend": ["GET", "/bookkeeping/reports/monthly-trend", "b", "frontend_permission_http", 2],
287
+ "bookkeeping_reports_summary": ["GET", "/bookkeeping/reports/summary", "b", "frontend_permission_http", 2],
288
+ "bookkeeping_reports_vat_periods": ["GET", "/bookkeeping/reports/vat/periods", "b", "frontend_permission_http", 0],
289
+ "bookkeeping_reports_vat_status": ["GET", "/bookkeeping/reports/vat/status", "b", "frontend_permission_http", 0],
290
+ "bookkeeping_reports_vat_ustva": ["GET", "/bookkeeping/reports/vat/ustva", "b", "frontend_permission_http", 2],
291
+ "bookkeeping_reports_vendor_breakdown": ["GET", "/bookkeeping/reports/vendor-breakdown", "b", "frontend_permission_http", 2],
292
+ "bookkeeping_revenues_analyze_receipt": ["POST", "/bookkeeping/revenues/analyze-receipt", "b", "frontend_permission_http", 0],
293
+ "bookkeeping_revenues_bulk_confirm": ["POST", "/bookkeeping/revenues/bulk-confirm", "b", "frontend_permission_http", 4],
294
+ "bookkeeping_revenues_confirm": ["POST", "/bookkeeping/revenues/:id/confirm", "b", "frontend_permission_http", 1],
295
+ "bookkeeping_revenues_confirm_cash": ["POST", "/bookkeeping/revenues/:id/confirm-cash", "b", "frontend_permission_http", 5],
296
+ "bookkeeping_revenues_create": ["POST", "/bookkeeping/revenues", "b", "frontend_permission_http", 4],
297
+ "bookkeeping_revenues_create_external": ["POST", "/bookkeeping/revenues/external", "b", "unified_bearer", 4, ["revenues:write"]],
298
+ "bookkeeping_revenues_delete": ["DELETE", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
299
+ "bookkeeping_revenues_get_by_id": ["GET", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
300
+ "bookkeeping_revenues_invoice_adjustment_external": ["POST", "/bookkeeping/revenues/external/invoice-adjustment", "b", "unified_bearer", 4, ["revenues:write"]],
301
+ "bookkeeping_revenues_revoke_cash_confirm": ["POST", "/bookkeeping/revenues/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
302
+ "bookkeeping_revenues_search": ["GET", "/bookkeeping/revenues", "b", "frontend_permission_http", 2],
303
+ "bookkeeping_revenues_update": ["PUT", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 5],
304
+ "bookkeeping_revenues_upload_receipt": ["POST", "/bookkeeping/revenues/:id/upload-receipt", "b", "frontend_permission_http", 1],
305
+ "bookkeeping_tax_params_create": ["POST", "/bookkeeping/tax-params", "b", "frontend_permission_http", 4],
306
+ "bookkeeping_tax_params_health": ["GET", "/bookkeeping/tax-params/health", "b", "frontend_permission_http", 0],
307
+ "bookkeeping_tax_params_history": ["GET", "/bookkeeping/tax-params/:key/history", "b", "frontend_permission_http", 1],
308
+ "bookkeeping_tax_params_list": ["GET", "/bookkeeping/tax-params", "b", "frontend_permission_http", 2],
309
+ "bookkeeping_tax_params_sync": ["POST", "/bookkeeping/tax-params/sync", "b", "frontend_permission_http", 0],
310
+ "bookkeeping_tax_params_update": ["PATCH", "/bookkeeping/tax-params/:id", "b", "frontend_permission_http", 5],
311
+ "currency_rates_get": ["GET", "/currency-rates/:fromCurrency/:toCurrency", "k", "x_api_key_http", 3],
312
+ "customer_companies_create": ["POST", "/customer-companies/create", "b", "frontend_permission_http", 4],
313
+ "customer_companies_create_external": ["POST", "/customer-companies/external", "b", "unified_bearer", 4, ["companies:write"]],
314
+ "customer_companies_delete": ["DELETE", "/customer-companies/delete/:companyId", "b", "frontend_permission_http", 1],
315
+ "customer_companies_delete_external": ["DELETE", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:delete"]],
316
+ "customer_companies_employee_assignments_by_company_id": ["GET", "/customer-companies/employee-assignments/byCompanyId/:companyId", "b", "frontend_permission_http", 3],
317
+ "customer_companies_employee_assignments_by_employee_id": ["GET", "/customer-companies/employee-assignments/byEmployeeId/:employeeId", "b", "frontend_permission_http", 3],
318
+ "customer_companies_employee_assignments_create": ["POST", "/customer-companies/employee-assignments/create", "b", "frontend_permission_http", 4],
319
+ "customer_companies_employee_assignments_update": ["PUT", "/customer-companies/employee-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
320
+ "customer_companies_employees_create": ["POST", "/customer-companies/employees/create", "b", "frontend_permission_http", 4],
321
+ "customer_companies_employees_delete": ["DELETE", "/customer-companies/employees/delete/:employeeId", "b", "frontend_permission_http", 1],
322
+ "customer_companies_employees_get_by_id": ["GET", "/customer-companies/employees/byId/:employeeId", "b", "frontend_permission_http", 1],
323
+ "customer_companies_employees_search": ["GET", "/customer-companies/employees/search", "b", "frontend_permission_http", 2],
324
+ "customer_companies_employees_update": ["PUT", "/customer-companies/employees/update/:employeeId", "b", "frontend_permission_http", 5],
325
+ "customer_companies_get_by_id": ["GET", "/customer-companies/byId/:companyId", "b", "frontend_permission_http", 1],
326
+ "customer_companies_get_by_id_external": ["GET", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:read"]],
327
+ "customer_companies_get_full_by_id": ["GET", "/customer-companies/byId/:companyId/full", "b", "frontend_permission_http", 3],
328
+ "customer_companies_search": ["GET", "/customer-companies/search", "b", "frontend_permission_http", 2],
329
+ "customer_companies_search_external": ["GET", "/customer-companies/external", "b", "unified_bearer", 2, ["companies:read"]],
330
+ "customer_companies_update": ["PUT", "/customer-companies/update/:companyId", "b", "frontend_permission_http", 5],
331
+ "customer_companies_update_external": ["PUT", "/customer-companies/external/:companyId", "b", "unified_bearer", 5, ["companies:write"]],
332
+ "documents_assign": ["POST", "/documents/admin/assign", "b", "frontend_permission_http", 4],
333
+ "documents_create": ["POST", "/documents/admin/create", "b", "frontend_permission_http", 4],
334
+ "documents_delete": ["DELETE", "/documents/admin/delete/:documentId", "b", "frontend_permission_http", 3],
335
+ "documents_delete_assignment": ["DELETE", "/documents/admin/assignments/:assignmentId", "b", "frontend_permission_http", 1],
336
+ "documents_download_url": ["GET", "/documents/admin/byId/:documentId/download-url", "b", "frontend_permission_http", 3],
337
+ "documents_get_by_id": ["GET", "/documents/admin/byId/:documentId", "b", "frontend_permission_http", 1],
338
+ "documents_get_full_by_id": ["GET", "/documents/admin/byId/:documentId/full", "b", "frontend_permission_http", 1],
339
+ "documents_search": ["GET", "/documents/admin/search", "b", "frontend_permission_http", 2],
340
+ "documents_set_lock": ["PUT", "/documents/admin/lock/:documentId", "b", "frontend_permission_http", 5],
341
+ "documents_stream": ["GET", "/documents/admin/stream/:documentId", "b", "frontend_permission_http", 3],
342
+ "dunning_get_settings_external": ["GET", "/invoices/external/dunning/settings", "b", "unified_bearer", 2, ["invoices:read"]],
343
+ "dunning_issue_external": ["POST", "/invoices/external/dunning/:invoiceId/issue", "b", "unified_bearer", 5, ["invoices:write"]],
344
+ "dunning_notice_download_external": ["GET", "/invoices/external/dunning/notices/:noticeId/download", "b", "unified_bearer", 1, ["invoices:read"]],
345
+ "dunning_notice_pdf_external": ["GET", "/invoices/external/dunning/notices/:noticeId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
346
+ "dunning_preview_external": ["POST", "/invoices/external/dunning/:invoiceId/preview", "b", "unified_bearer", 5, ["invoices:read"]],
347
+ "dunning_suggestions_external": ["GET", "/invoices/external/dunning/suggestions", "b", "unified_bearer", 2, ["invoices:read"]],
348
+ "dunning_update_settings_external": ["PUT", "/invoices/external/dunning/settings", "b", "unified_bearer", 4, ["invoices:write"]],
349
+ "enterprise_onboarding_complete_step": ["POST", "/apps/enterprise/onboarding/complete-step", "b", "frontend_permission_http", 4],
350
+ "enterprise_onboarding_skip_step": ["POST", "/apps/enterprise/onboarding/skip-step", "b", "frontend_permission_http", 4],
351
+ "enterprise_onboarding_state_get": ["GET", "/apps/enterprise/onboarding/state", "b", "frontend_permission_http", 2],
352
+ "entitlements_assign": ["POST", "/entitlements", "b", "unified_bearer", 4, ["entitlements:write"]],
353
+ "entitlements_context_get_by_shop_assignment": ["GET", "/entitlements/context/by-shop-assignment/:shopAssignmentId", "b", "unified_bearer", 1, ["entitlements:read"]],
354
+ "entitlements_getAll": ["GET", "/entitlements/getAll", "b", "unified_bearer", 2, ["entitlements:read"]],
355
+ "entitlements_getAssigned": ["GET", "/entitlements/assigned", "b", "unified_bearer", 2, ["entitlements:read"]],
356
+ "entitlements_getById": ["GET", "/entitlements/:id", "b", "unified_bearer", 1, ["entitlements:read"]],
357
+ "entitlements_getUserEntitlements": ["GET", "/entitlements/user/:userId", "b", "unified_bearer", 1, ["entitlements:read"]],
358
+ "entitlements_get_state": ["GET", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:read"]],
359
+ "entitlements_list": ["GET", "/entitlements", "b", "unified_bearer", 2, ["entitlements:read"]],
360
+ "entitlements_revoke": ["DELETE", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:write"]],
361
+ "entitlements_update_state": ["PUT", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 5, ["entitlements:read", "entitlements:write"]],
362
+ "entitlements_usage_overages_pull": ["GET", "/entitlements/usage-overages", "b", "unified_bearer", 2, ["entitlements:read"]],
363
+ "exports_datev_buchungsstapel": ["GET", "/exports/bookkeeping/datev/buchungsstapel", "b", "frontend_permission_http", 0],
364
+ "exports_datev_metadata": ["GET", "/exports/bookkeeping/datev/metadata", "b", "frontend_permission_http", 0],
365
+ "invoice_dunning_delete_notice": ["DELETE", "/invoices/dunning/:invoiceId/notices/:noticeId", "b", "frontend_permission_http", 1],
366
+ "invoice_dunning_get_settings": ["GET", "/invoices/dunning/settings", "b", "frontend_permission_http", 2],
367
+ "invoice_dunning_issue": ["POST", "/invoices/dunning/:invoiceId/issue", "b", "frontend_permission_http", 5],
368
+ "invoice_dunning_list_notices": ["GET", "/invoices/dunning/:invoiceId/notices", "b", "frontend_permission_http", 1],
369
+ "invoice_dunning_notice_download": ["GET", "/invoices/dunning/notices/:noticeId/download", "b", "frontend_permission_http", 1],
370
+ "invoice_dunning_notice_pdf": ["GET", "/invoices/dunning/notices/:noticeId/pdf", "b", "frontend_permission_http", 1],
371
+ "invoice_dunning_preview": ["POST", "/invoices/dunning/:invoiceId/preview", "b", "frontend_permission_http", 5],
372
+ "invoice_dunning_suggestions": ["GET", "/invoices/dunning/suggestions", "b", "frontend_permission_http", 2],
373
+ "invoice_dunning_update_settings": ["PUT", "/invoices/dunning/settings", "b", "frontend_permission_http", 4],
374
+ "invoices_analysis": ["GET", "/invoices/:invoiceId/analysis", "b", "frontend_permission_http", 1],
375
+ "invoices_create_external": ["POST", "/invoices/external", "b", "unified_bearer", 4, ["invoices:write"]],
376
+ "invoices_create_manual": ["POST", "/invoices/manual", "b", "frontend_bearer_http", 4],
377
+ "invoices_credit_note_issue": ["POST", "/invoices/:invoiceId/credit-note/issue", "b", "frontend_permission_http", 5],
378
+ "invoices_credit_note_issue_external": ["POST", "/invoices/external/:invoiceId/credit-note/issue", "b", "unified_bearer", 5, ["invoices:publish"]],
379
+ "invoices_credit_note_preview": ["POST", "/invoices/:invoiceId/credit-note/preview", "b", "frontend_permission_http", 5],
380
+ "invoices_credit_note_preview_external": ["POST", "/invoices/external/:invoiceId/credit-note/preview", "b", "unified_bearer", 5, ["invoices:write"]],
381
+ "invoices_delete": ["DELETE", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
382
+ "invoices_delete_external": ["DELETE", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:delete"]],
383
+ "invoices_download_pdf": ["GET", "/invoices/:invoiceId/download", "n", "public", 3],
384
+ "invoices_download_pdf_external": ["GET", "/invoices/external/:invoiceId/download", "b", "unified_bearer", 1, ["invoices:read"]],
385
+ "invoices_get_by_id": ["GET", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
386
+ "invoices_get_by_id_external": ["GET", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:read"]],
387
+ "invoices_list_overdue": ["GET", "/invoices/overdue", "b", "frontend_permission_http", 2],
388
+ "invoices_list_pending": ["GET", "/invoices/pending", "b", "frontend_permission_http", 2],
389
+ "invoices_overdue_external": ["GET", "/invoices/external/overdue", "b", "unified_bearer", 2, ["invoices:read"]],
390
+ "invoices_payment_reconciliation": ["GET", "/invoices/:invoiceId/payment-reconciliation", "b", "frontend_permission_http", 1],
391
+ "invoices_pending_external": ["GET", "/invoices/external/pending", "b", "unified_bearer", 2, ["invoices:read"]],
392
+ "invoices_repair_pdf": ["POST", "/invoices/:invoiceId/repair-pdf", "b", "frontend_bearer_http", 1],
393
+ "invoices_search": ["GET", "/invoices", "b", "frontend_bearer_http", 2],
394
+ "invoices_search_external": ["GET", "/invoices/external", "b", "unified_bearer", 2, ["invoices:read"]],
395
+ "invoices_send_email_external": ["POST", "/invoices/external/:invoiceId/send-email", "b", "unified_bearer", 5, ["invoices:write"]],
396
+ "invoices_status_policy": ["GET", "/invoices/:invoiceId/status-policy", "b", "frontend_bearer_http", 1],
397
+ "invoices_status_policy_external": ["GET", "/invoices/external/:invoiceId/status-policy", "b", "unified_bearer", 1, ["invoices:read"]],
398
+ "invoices_update_status": ["PUT", "/invoices/:invoiceId/status", "b", "frontend_bearer_http", 5],
399
+ "invoices_update_status_external": ["PUT", "/invoices/external/:invoiceId/status", "b", "unified_bearer", 5, ["invoices:write"]],
400
+ "invoices_view_pdf": ["GET", "/invoices/:invoiceId/pdf", "n", "public", 3],
401
+ "invoices_view_pdf_external": ["GET", "/invoices/external/:invoiceId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
402
+ "logs_delete": ["DELETE", "/app-logs/delete/:logId", "b", "frontend_permission_http", 1],
403
+ "logs_delete_bulk": ["DELETE", "/app-logs/delete/mass/:logIds", "b", "frontend_permission_http", 1],
404
+ "logs_search": ["GET", "/app-logs/search", "b", "frontend_permission_http", 2],
405
+ "managing_companies_api_keys_by_id": ["GET", "/managing-companies/api-keys/byId/:apiKeyId", "b", "frontend_permission_http", 1],
406
+ "managing_companies_api_keys_create": ["POST", "/managing-companies/api-keys/create", "b", "frontend_permission_http", 4],
407
+ "managing_companies_api_keys_delete": ["DELETE", "/managing-companies/api-keys/delete/:apiKeyId", "b", "frontend_permission_http", 1],
408
+ "managing_companies_api_keys_list": ["GET", "/managing-companies/api-keys/list", "b", "frontend_permission_http", 2],
409
+ "managing_companies_api_keys_revoke": ["POST", "/managing-companies/api-keys/revoke/:apiKeyId", "b", "frontend_permission_http", 1],
410
+ "managing_companies_api_keys_update": ["PUT", "/managing-companies/api-keys/update/:apiKeyId", "b", "frontend_permission_http", 5],
411
+ "managing_companies_cost_centers_by_id": ["GET", "/managing-companies/cost-centers/byId/:id", "b", "frontend_permission_http", 1],
412
+ "managing_companies_cost_centers_by_ids": ["GET", "/managing-companies/cost-centers/by-ids", "b", "frontend_permission_http", 2],
413
+ "managing_companies_cost_centers_create": ["POST", "/managing-companies/cost-centers/create", "b", "frontend_permission_http", 4],
414
+ "managing_companies_cost_centers_delete": ["DELETE", "/managing-companies/cost-centers/delete/:id", "b", "frontend_permission_http", 1],
415
+ "managing_companies_cost_centers_list": ["GET", "/managing-companies/cost-centers/list/:managingCompanyId", "b", "frontend_permission_http", 3],
416
+ "managing_companies_cost_centers_logos_delete": ["DELETE", "/managing-companies/cost-centers/logos/delete/:id/:mode", "b", "frontend_permission_http", 1],
417
+ "managing_companies_cost_centers_logos_settings": ["GET", "/managing-companies/cost-centers/logos/settings/:id", "b", "frontend_permission_http", 1],
418
+ "managing_companies_cost_centers_logos_upload": ["POST", "/managing-companies/cost-centers/logos/upload/:id/:mode", "b", "frontend_permission_http", 1],
419
+ "managing_companies_cost_centers_logos_urls": ["GET", "/managing-companies/cost-centers/logos/urls/:id", "b", "frontend_permission_http", 1],
420
+ "managing_companies_cost_centers_my": ["GET", "/managing-companies/cost-centers/my/:managingCompanyId", "b", "frontend_permission_http", 1],
421
+ "managing_companies_cost_centers_update": ["PUT", "/managing-companies/cost-centers/update/:id", "b", "frontend_permission_http", 5],
422
+ "managing_companies_create": ["POST", "/managing-companies", "b", "frontend_permission_http", 4],
423
+ "managing_companies_current_external": ["GET", "/managing-companies/external/current", "b", "unified_bearer", 2, ["companies:read"]],
424
+ "managing_companies_delete": ["DELETE", "/managing-companies/:id", "b", "frontend_permission_http", 1],
425
+ "managing_companies_get_by_id": ["GET", "/managing-companies/:id", "b", "frontend_permission_http", 1],
426
+ "managing_companies_invites_accept": ["POST", "/managing-companies/invites/accept/:token", "b", "frontend_bearer_http", 1],
427
+ "managing_companies_invites_cancel": ["DELETE", "/managing-companies/invites/cancel/:inviteId", "b", "frontend_bearer_http", 5],
428
+ "managing_companies_invites_pending_company": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId", "b", "frontend_permission_http", 3],
429
+ "managing_companies_invites_pending_company_preview": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId/preview", "b", "frontend_bearer_http", 3],
430
+ "managing_companies_invites_pending_user": ["GET", "/managing-companies/invites/pending/user", "b", "frontend_permission_http", 2],
431
+ "managing_companies_invites_reject": ["POST", "/managing-companies/invites/reject/:token", "b", "frontend_bearer_http", 1],
432
+ "managing_companies_invoice_layouts_catalog": ["GET", "/managing-companies/invoice-layouts/catalog", "b", "frontend_bearer_http", 2],
433
+ "managing_companies_invoice_layouts_effective": ["GET", "/managing-companies/invoice-layouts/effective", "b", "frontend_bearer_http", 2],
434
+ "managing_companies_invoice_layouts_preview": ["GET", "/managing-companies/invoice-layouts/preview", "b", "frontend_bearer_http", 2],
435
+ "managing_companies_invoice_layouts_previews": ["GET", "/managing-companies/invoice-layouts/previews", "b", "frontend_bearer_http", 2],
436
+ "managing_companies_invoice_templates_archive": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/archive", "b", "frontend_bearer_http", 1],
437
+ "managing_companies_invoice_templates_create": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/create", "b", "frontend_bearer_http", 5],
438
+ "managing_companies_invoice_templates_duplicate": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/duplicate", "b", "frontend_bearer_http", 5],
439
+ "managing_companies_invoice_templates_from_invoice": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/from-invoice", "b", "frontend_bearer_http", 5],
440
+ "managing_companies_invoice_templates_get": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 1],
441
+ "managing_companies_invoice_templates_list": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/list", "b", "frontend_bearer_http", 3],
442
+ "managing_companies_invoice_templates_update": ["PUT", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 5],
443
+ "managing_companies_invoice_transparency_context": ["GET", "/managing-companies/invoice-transparency/:managingCompanyId/context", "b", "frontend_bearer_http", 1],
444
+ "managing_companies_invoice_transparency_quote": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/quote", "b", "frontend_bearer_http", 5],
445
+ "managing_companies_item_type_configs_archive": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value/archive", "b", "frontend_bearer_http", 1],
446
+ "managing_companies_item_type_configs_create": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs", "b", "frontend_bearer_http", 5],
447
+ "managing_companies_item_type_configs_update": ["PUT", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value", "b", "frontend_bearer_http", 5],
448
+ "managing_companies_list": ["GET", "/managing-companies", "b", "frontend_permission_http", 2],
449
+ "managing_companies_logos_delete": ["DELETE", "/managing-companies/logos/delete/:mode", "b", "frontend_bearer_http", 1],
450
+ "managing_companies_logos_set_mode": ["PUT", "/managing-companies/logos/mode", "b", "frontend_bearer_http", 4],
451
+ "managing_companies_logos_settings": ["GET", "/managing-companies/logos/settings", "b", "frontend_bearer_http", 2],
452
+ "managing_companies_logos_upload": ["POST", "/managing-companies/logos/upload/:mode", "b", "frontend_bearer_http", 1],
453
+ "managing_companies_logos_urls": ["GET", "/managing-companies/logos/urls", "b", "frontend_bearer_http", 2],
454
+ "managing_companies_selected_current": ["GET", "/managing-companies/selected/current", "b", "frontend_bearer_http", 2],
455
+ "managing_companies_selected_set": ["POST", "/managing-companies/selected/set/:companyId", "b", "frontend_bearer_http", 1],
456
+ "managing_companies_update": ["PUT", "/managing-companies/:id", "b", "frontend_permission_http", 5],
457
+ "managing_companies_user_assignments_assign": ["POST", "/managing-companies/user-assignments/assign", "b", "frontend_permission_http", 4],
458
+ "managing_companies_user_assignments_cost_centers_add": ["POST", "/managing-companies/user-assignments/cost-centers/add", "b", "frontend_permission_http", 4],
459
+ "managing_companies_user_assignments_cost_centers_remove": ["POST", "/managing-companies/user-assignments/cost-centers/remove", "b", "frontend_permission_http", 4],
460
+ "managing_companies_user_assignments_list": ["GET", "/managing-companies/user-assignments/list/:companyId", "b", "frontend_permission_http", 3],
461
+ "managing_companies_user_assignments_revoke": ["POST", "/managing-companies/user-assignments/revoke", "b", "frontend_permission_http", 4],
462
+ "managing_companies_user_assignments_update": ["PUT", "/managing-companies/user-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
463
+ "managing_companies_vat_settings_decision_upsert": ["PUT", "/managing-companies/vat-settings/:companyId/decisions/:decisionKey", "b", "frontend_bearer_http", 5],
464
+ "managing_companies_vat_settings_get": ["GET", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 1],
465
+ "managing_companies_vat_settings_tax_alerts": ["GET", "/managing-companies/vat-settings/:companyId/tax-alerts", "b", "frontend_bearer_http", 1],
466
+ "managing_companies_vat_settings_upsert": ["POST", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 5],
467
+ "oauth2_clients_audit": ["GET", "/oauth/clients/audit/:id", "b", "frontend_bearer_http", 3],
468
+ "oauth2_clients_create": ["POST", "/oauth/clients/create", "b", "frontend_bearer_http", 4],
469
+ "oauth2_clients_list": ["GET", "/oauth/clients/list", "b", "frontend_bearer_http", 2],
470
+ "oauth2_clients_revoke": ["DELETE", "/oauth/clients/revoke/:id", "b", "frontend_bearer_http", 1],
471
+ "oauth2_clients_update": ["PUT", "/oauth/clients/update/:id", "b", "frontend_bearer_http", 5],
472
+ "oauth2_external_clients_create": ["POST", "/oauth/clients/external", "k", "x_api_key_https", 4],
473
+ "oauth2_external_clients_delete": ["DELETE", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
474
+ "oauth2_external_clients_get": ["GET", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
475
+ "oauth2_external_clients_list": ["GET", "/oauth/clients/external/list", "k", "x_api_key_https", 2],
476
+ "oauth2_external_clients_retire": ["POST", "/oauth/clients/external/:idOrClientId/retire", "k", "x_api_key_https", 1],
477
+ "oauth2_external_clients_revoke": ["POST", "/oauth/clients/external/:idOrClientId/revoke", "k", "x_api_key_https", 1],
478
+ "oauth2_external_clients_rollback": ["POST", "/oauth/clients/external/:idOrClientId/rollback", "k", "x_api_key_https", 1],
479
+ "oauth2_external_clients_rotate": ["POST", "/oauth/clients/external/:idOrClientId/rotate", "k", "x_api_key_https", 1],
480
+ "oauth2_external_clients_update": ["PUT", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 5],
481
+ "oauth2_revoke": ["POST", "/oauth/revoke", "n", "public", 0],
482
+ "oauth2_scopes_list": ["GET", "/oauth/scopes", "b", "frontend_bearer_http", 2],
483
+ "oauth2_token": ["POST", "/oauth/token", "n", "public", 0],
484
+ "payments_allocate": ["POST", "/bookkeeping/payments/allocate/:paymentId", "b", "frontend_permission_http", 5],
485
+ "payments_allocation_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reversal-preview", "b", "frontend_permission_http", 1],
486
+ "payments_allocation_reverse": ["POST", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reverse", "b", "frontend_permission_http", 1],
487
+ "payments_apply_discount": ["POST", "/bookkeeping/payments/:paymentId/discount", "b", "frontend_permission_http", 5],
488
+ "payments_archive_account": ["POST", "/bookkeeping/payments/accounts/:accountId/archive", "b", "frontend_permission_http", 1],
489
+ "payments_book": ["POST", "/bookkeeping/payments/:paymentId/book", "b", "frontend_permission_http", 5],
490
+ "payments_booking_payment_suggestions": ["GET", "/bookkeeping/payments/booking-match/:targetType/:targetId/payment-suggestions", "b", "frontend_permission_http", 3],
491
+ "payments_cashbook": ["GET", "/bookkeeping/payments/cashbook", "b", "frontend_permission_http", 2],
492
+ "payments_confirm_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/confirm", "b", "frontend_permission_http", 4],
493
+ "payments_create_account": ["POST", "/bookkeeping/payments/accounts/create", "b", "frontend_permission_http", 4],
494
+ "payments_create_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 4],
495
+ "payments_create_import_profile": ["POST", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 4],
496
+ "payments_create_manual": ["POST", "/bookkeeping/payments/manual", "b", "frontend_permission_http", 4],
497
+ "payments_delete": ["DELETE", "/bookkeeping/payments/:paymentId", "b", "frontend_permission_http", 1],
498
+ "payments_delete_account": ["DELETE", "/bookkeeping/payments/accounts/:accountId", "b", "frontend_permission_http", 1],
499
+ "payments_download_csv_template": ["GET", "/bookkeeping/payments/import/csv/template/:profileKey", "b", "frontend_permission_http", 1],
500
+ "payments_get_account_by_id": ["GET", "/bookkeeping/payments/accounts/bdId/:accountId", "b", "frontend_permission_http", 1],
501
+ "payments_import_csv": ["POST", "/bookkeeping/payments/import/csv", "b", "frontend_permission_http", 4],
502
+ "payments_import_csv_preview": ["POST", "/bookkeeping/payments/import/csv/preview", "b", "frontend_permission_http", 4],
503
+ "payments_list_accounts": ["GET", "/bookkeeping/payments/accounts", "b", "frontend_permission_http", 2],
504
+ "payments_list_balance_snapshots": ["GET", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 2],
505
+ "payments_list_csv_profiles": ["GET", "/bookkeeping/payments/import/csv/profiles", "b", "frontend_permission_http", 0],
506
+ "payments_list_fee_proposals": ["GET", "/bookkeeping/payments/fee-proposals", "b", "frontend_permission_http", 2],
507
+ "payments_list_import_profiles": ["GET", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 2],
508
+ "payments_match_suggestions": ["GET", "/bookkeeping/payments/match/:paymentId/suggestions", "b", "frontend_permission_http", 3],
509
+ "payments_paypal_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/sync", "b", "frontend_permission_http", 3],
510
+ "payments_paypal_webhook_deregister": ["DELETE", "/bookkeeping/payments/accounts/:accountId/paypal/webhook", "b", "frontend_permission_http", 1],
511
+ "payments_paypal_webhook_receive": ["POST", "/bookkeeping/payments/public/paypal/webhook", "n", "public", 0],
512
+ "payments_paypal_webhook_register": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/webhook/register", "b", "frontend_permission_http", 5],
513
+ "payments_record_fee": ["POST", "/bookkeeping/payments/:paymentId/fee", "b", "frontend_permission_http", 5],
514
+ "payments_reject_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/reject", "b", "frontend_permission_http", 4],
515
+ "payments_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/reversal-preview", "b", "frontend_permission_http", 1],
516
+ "payments_reverse": ["POST", "/bookkeeping/payments/:paymentId/reverse", "b", "frontend_permission_http", 5],
517
+ "payments_search": ["GET", "/bookkeeping/payments/search", "b", "frontend_permission_http", 2],
518
+ "payments_sumup_oauth_callback": ["GET", "/bookkeeping/payments/public/sumup/oauth/callback", "n", "public", 2],
519
+ "payments_sumup_oauth_disconnect": ["DELETE", "/bookkeeping/payments/accounts/:accountId/sumup/oauth", "b", "frontend_permission_http", 1],
520
+ "payments_sumup_oauth_start": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/oauth/start", "b", "frontend_permission_http", 5],
521
+ "payments_sumup_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/sync", "b", "frontend_permission_http", 3],
522
+ "payments_transfer_link": ["POST", "/bookkeeping/payments/transfer/link", "b", "frontend_permission_http", 4],
523
+ "payments_transfer_linkable": ["GET", "/bookkeeping/payments/:paymentId/transfer/linkable", "b", "frontend_permission_http", 3],
524
+ "payments_transfer_unlink": ["POST", "/bookkeeping/payments/:paymentId/transfer/unlink", "b", "frontend_permission_http", 5],
525
+ "payments_unallocate": ["DELETE", "/bookkeeping/payments/allocations/:paymentId/:allocationId", "b", "frontend_permission_http", 1],
526
+ "payments_update": ["PUT", "/bookkeeping/payments/update/:paymentId", "b", "frontend_permission_http", 5],
527
+ "payments_update_account": ["PUT", "/bookkeeping/payments/accounts/update/:accountId", "b", "frontend_permission_http", 5],
528
+ "payments_update_fee_vat_treatment": ["PUT", "/bookkeeping/payments/accounts/:accountId/fee-vat-treatment", "b", "frontend_permission_http", 5],
529
+ "payments_update_import_profile": ["PUT", "/bookkeeping/payments/import/profiles/:id", "b", "frontend_permission_http", 5],
530
+ "payments_void_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots/:snapshotId/void", "b", "frontend_permission_http", 5],
531
+ "payments_writeoff": ["POST", "/bookkeeping/payments/:paymentId/writeoff", "b", "frontend_permission_http", 5],
532
+ "permissions_assign_to_role": ["POST", "/permissions/assign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
533
+ "permissions_assignments_list": ["GET", "/permissions/getAssignments", "b", "composite_and", 2],
534
+ "permissions_create": ["POST", "/permissions/create", "b", "frontend_permission_http", 4],
535
+ "permissions_list": ["GET", "/permissions/getAll", "b", "frontend_permission_http", 2],
536
+ "permissions_sync": ["POST", "/permissions/sync", "b", "frontend_permission_http", 2],
537
+ "permissions_unassign_from_role": ["DELETE", "/permissions/unassign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
538
+ "reconciliation_auto_match_confirm": ["POST", "/bookkeeping/reconciliation/auto-match/confirm", "b", "frontend_permission_http", 4],
539
+ "reconciliation_auto_match_preview": ["GET", "/bookkeeping/reconciliation/auto-match/preview", "b", "frontend_permission_http", 2],
540
+ "reconciliation_batch_suggestions": ["POST", "/bookkeeping/reconciliation/batch-suggestions", "b", "frontend_permission_http", 4],
541
+ "reconciliation_confirm_provider_payout": ["POST", "/bookkeeping/reconciliation/confirm-provider-payout", "b", "frontend_permission_http", 4],
542
+ "reconciliation_dashboard": ["GET", "/bookkeeping/reconciliation/dashboard", "b", "frontend_permission_http", 2],
543
+ "reconciliation_groups": ["GET", "/bookkeeping/reconciliation/groups", "b", "frontend_permission_http", 2],
544
+ "reconciliation_queue": ["GET", "/bookkeeping/reconciliation/queue", "b", "frontend_permission_http", 2],
545
+ "role_assignments_create": ["POST", "/role-assignments/create/:userId/:roleId", "b", "frontend_permission_http", 5],
546
+ "role_assignments_get_user_assignments": ["GET", "/role-assignments/getUserAssignments/:userId", "b", "frontend_permission_http", 1],
547
+ "role_assignments_list": ["GET", "/role-assignments/getAll", "b", "frontend_permission_http", 2],
548
+ "role_assignments_revoke": ["DELETE", "/role-assignments/delete/:userId/:roleId", "b", "frontend_permission_http", 1],
549
+ "roles_create": ["POST", "/roles/create", "b", "frontend_permission_http", 4],
550
+ "roles_delete": ["DELETE", "/roles/delete/:roleId", "b", "frontend_permission_http", 1],
551
+ "roles_get_by_id": ["GET", "/roles/getById/:roleId", "b", "frontend_permission_http", 1],
552
+ "roles_list": ["GET", "/roles/getAll", "b", "frontend_permission_http", 2],
553
+ "roles_update": ["PUT", "/roles/update/:roleId", "b", "frontend_permission_http", 5],
554
+ "settings_list": ["GET", "/settings/getAll", "b", "frontend_bearer_http", 2],
555
+ "settings_update": ["PUT", "/settings/update/:settingId/:key", "b", "frontend_permission_http", 5],
556
+ "user_activity_overview_get": ["POST", "/user-activity/user/:userId", "b", "frontend_permission_http", 5],
557
+ "user_activity_users_stats_list": ["GET", "/user-activity/users", "b", "frontend_permission_http", 2],
558
+ "users_create": ["POST", "/users/create", "b", "frontend_bearer_http", 4],
559
+ "users_delete": ["DELETE", "/users/delete/:userId", "b", "frontend_permission_http", 1],
560
+ "users_delete_external": ["DELETE", "/users/delete/external/:frontendUserId", "b", "frontend_bearer_http", 1],
561
+ "users_get_by_email": ["GET", "/users/getByEmail/:email", "b", "frontend_permission_http", 1],
562
+ "users_get_by_external_user_id": ["GET", "/users/getByExternalUserId/:externalUserId", "b", "frontend_bearer_http", 1],
563
+ "users_get_by_id": ["GET", "/users/getById/:userId", "b", "frontend_bearer_http", 3],
564
+ "users_list": ["GET", "/users/getAll", "b", "frontend_permission_http", 2],
565
+ "users_search": ["GET", "/users/search", "b", "frontend_permission_http", 2],
566
+ "users_update_external": ["PUT", "/users/update/external/:frontendUserId", "b", "frontend_bearer_http", 5],
567
+ "webhooks_delete": ["DELETE", "/webhooks/delete/:webhookId", "b", "frontend_permission_http", 1],
568
+ "webhooks_delete_bulk": ["DELETE", "/webhooks/delete/mass/:webhookIds", "b", "frontend_permission_http", 1],
569
+ "webhooks_list": ["GET", "/webhooks/getAll", "b", "frontend_permission_http", 2],
570
+ "work_tracking_approve": ["POST", "/apps/admin/work-tracking/approve/:workEntryId", "b", "frontend_permission_http", 5],
571
+ "work_tracking_assignment_create": ["POST", "/apps/admin/work-tracking/assignments/create", "b", "frontend_permission_http", 4],
572
+ "work_tracking_assignment_delete": ["DELETE", "/apps/admin/work-tracking/assignments/delete/:workEntryAssignmentId", "b", "frontend_permission_http", 1],
573
+ "work_tracking_assignment_update": ["PUT", "/apps/admin/work-tracking/assignments/update/:workEntryAssignmentId", "b", "frontend_permission_http", 5],
574
+ "work_tracking_bill": ["POST", "/apps/admin/work-tracking/bill", "b", "frontend_permission_http", 4],
575
+ "work_tracking_bill_preview": ["POST", "/apps/admin/work-tracking/bill/preview", "b", "frontend_permission_http", 4],
576
+ "work_tracking_create": ["POST", "/apps/admin/work-tracking/create", "b", "frontend_permission_http", 4],
577
+ "work_tracking_delete": ["DELETE", "/apps/admin/work-tracking/delete/:workEntryId", "b", "frontend_permission_http", 1],
578
+ "work_tracking_get_by_id": ["GET", "/apps/admin/work-tracking/byId/:workEntryId", "b", "frontend_permission_http", 1],
579
+ "work_tracking_get_my_role": ["GET", "/apps/admin/work-tracking/my-role", "b", "frontend_permission_http", 2],
580
+ "work_tracking_list": ["GET", "/apps/admin/work-tracking/list", "b", "frontend_permission_http", 2],
581
+ "work_tracking_reject": ["POST", "/apps/admin/work-tracking/reject/:workEntryId", "b", "frontend_permission_http", 5],
582
+ "work_tracking_update": ["PUT", "/apps/admin/work-tracking/update/:workEntryId", "b", "frontend_permission_http", 5]
583
+ };
584
+
585
+ // src/operations.ts
586
+ var API_KEY_AUTH_TYPES = /* @__PURE__ */ new Set(["x_api_key_http", "x_api_key_https"]);
587
+ var PUBLIC_AUTH_TYPES = /* @__PURE__ */ new Set(["public"]);
588
+ var VALIDATES_PARAMS = 1;
589
+ var VALIDATES_QUERY = 2;
590
+ var VALIDATES_BODY = 4;
591
+ var CHANNEL_BY_CODE = {
592
+ b: "bearer",
593
+ k: "api_key",
594
+ n: "none"
595
+ };
596
+ function authChannelForContractType(authType) {
597
+ if (!authType) return "bearer";
598
+ if (API_KEY_AUTH_TYPES.has(authType)) return "api_key";
599
+ if (PUBLIC_AUTH_TYPES.has(authType)) return "none";
600
+ return "bearer";
601
+ }
602
+ function toOperation(operationId, entry) {
603
+ const [method, path, channelCode, authType, validated, scopes] = entry;
604
+ return {
605
+ operationId,
606
+ method,
607
+ path,
608
+ authType,
609
+ // Der Code in der Tabelle ist bereits das Ergebnis von
610
+ // `authChannelForContractType` zur Erzeugungszeit; faellt er unbekannt aus,
611
+ // gilt dieselbe Regel noch einmal statt einer stillen Voreinstellung.
612
+ channel: CHANNEL_BY_CODE[channelCode] ?? authChannelForContractType(authType),
613
+ validated: {
614
+ params: (validated & VALIDATES_PARAMS) !== 0,
615
+ query: (validated & VALIDATES_QUERY) !== 0,
616
+ body: (validated & VALIDATES_BODY) !== 0
617
+ },
618
+ scopes: scopes ? [...scopes] : []
619
+ };
620
+ }
621
+ var cachedOperations = null;
622
+ function listOperations() {
623
+ if (!cachedOperations) {
624
+ cachedOperations = Object.entries(ROUTE_INDEX).map(
625
+ ([operationId, entry]) => toOperation(operationId, entry)
626
+ );
627
+ }
628
+ return cachedOperations;
629
+ }
630
+ function describeOperation(operationId) {
631
+ const entry = ROUTE_INDEX[operationId];
632
+ return entry ? toOperation(operationId, entry) : null;
633
+ }
634
+ var cachedPathIndex = null;
635
+ function pathIndex() {
636
+ if (cachedPathIndex) return cachedPathIndex;
637
+ const index = /* @__PURE__ */ new Map();
638
+ for (const operation of listOperations()) {
639
+ const segments = splitPath(operation.path);
640
+ const key = `${operation.method} ${segments.length}`;
641
+ const bucket = index.get(key);
642
+ if (bucket) bucket.push({ segments, operation });
643
+ else index.set(key, [{ segments, operation }]);
644
+ }
645
+ cachedPathIndex = index;
646
+ return index;
647
+ }
648
+ function splitPath(path) {
649
+ return path.split("/").filter((segment) => segment.length > 0);
650
+ }
651
+ function resolveOperation(method, path) {
652
+ const wanted = splitPath(path.split("?")[0] ?? path);
653
+ const bucket = pathIndex().get(`${method.toUpperCase()} ${wanted.length}`);
654
+ if (!bucket) return null;
655
+ let best = null;
656
+ for (const entry of bucket) {
657
+ let score = 0;
658
+ let matches = true;
659
+ for (let i = 0; i < wanted.length; i++) {
660
+ const template = entry.segments[i];
661
+ if (template.startsWith(":")) continue;
662
+ if (template === decodeSegment(wanted[i])) score++;
663
+ else {
664
+ matches = false;
665
+ break;
666
+ }
667
+ }
668
+ if (!matches) continue;
669
+ if (!best || score > best.score) best = { score, operation: entry.operation };
670
+ }
671
+ return best?.operation ?? null;
672
+ }
673
+ function decodeSegment(segment) {
674
+ try {
675
+ return decodeURIComponent(segment);
676
+ } catch {
677
+ return segment;
678
+ }
679
+ }
680
+ var OrvelloOperationError = class extends Error {
681
+ constructor(message, operationId) {
682
+ super(message);
683
+ this.operationId = operationId;
684
+ this.name = "OrvelloOperationError";
685
+ }
686
+ operationId;
687
+ };
688
+ function buildPath(operationId, params) {
689
+ const operation = describeOperation(operationId);
690
+ if (!operation) {
691
+ throw new OrvelloOperationError(
692
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against.`,
693
+ operationId
694
+ );
695
+ }
696
+ return "/" + splitPath(operation.path).map((segment) => {
697
+ if (!segment.startsWith(":")) return segment;
698
+ const name = segment.slice(1);
699
+ const value = params?.[name];
700
+ if (value === void 0 || value === null || value === "") {
701
+ throw new OrvelloOperationError(
702
+ `orvello operation "${operationId}" needs the path parameter "${name}" (${operation.method} ${operation.path}).`,
703
+ operationId
704
+ );
705
+ }
706
+ return encodeURIComponent(String(value));
707
+ }).join("/");
708
+ }
709
+
710
+ // src/capabilities.ts
711
+ var SDK_VERSION2 = "0.2.1" ;
712
+ var CLIENT_MANAGEMENT_OPS = [
713
+ "oauth2_external_clients_list",
714
+ "oauth2_external_clients_get",
715
+ "oauth2_external_clients_create",
716
+ "oauth2_external_clients_update",
717
+ "oauth2_external_clients_delete"
718
+ ];
719
+ var CLIENT_ROTATION_OPS = ["oauth2_external_clients_rotate"];
720
+ var GRACE_PERIOD_OPS = ["oauth2_external_clients_retire", "oauth2_external_clients_rollback"];
721
+ var REVOCATION_OPS = ["oauth2_external_clients_revoke"];
722
+ function capabilityFrom(operationIds, reasonWhenMissing) {
723
+ const present = operationIds.filter((id) => describeOperation(id) !== null);
724
+ if (present.length === operationIds.length) {
725
+ return { supported: true, operations: present };
726
+ }
727
+ const missing = operationIds.filter((id) => !present.includes(id));
728
+ return {
729
+ supported: false,
730
+ operations: present,
731
+ reason: `${reasonWhenMissing} Fehlend im Vertrag: ${missing.join(", ")}.`
732
+ };
733
+ }
734
+ function capabilityFromPrefix(prefix, reasonWhenMissing) {
735
+ const present = listOperations().filter((operation) => operation.operationId.startsWith(prefix)).map((operation) => operation.operationId);
736
+ return present.length > 0 ? { supported: true, operations: present } : { supported: false, operations: [], reason: reasonWhenMissing };
737
+ }
738
+ function orvelloCapabilities() {
739
+ const operations = listOperations();
740
+ const authChannels = { bearer: 0, api_key: 0, none: 0 };
741
+ for (const operation of operations) authChannels[operation.channel]++;
742
+ return {
743
+ service: "orvello",
744
+ sdkVersion: SDK_VERSION2,
745
+ contractSha256: CONTRACT_SHA256,
746
+ operationCount: operations.length,
747
+ authChannels,
748
+ capabilities: {
749
+ // `/health/contract` ist bewusst KEINE Vertrags-Route: der Endpunkt
750
+ // beschreibt den Vertrag und kann deshalb nicht in ihm stehen. Er gehoert
751
+ // zur Zusage dieses SDK und wird von `diagnoseOrvello` live geprueft.
752
+ contractFingerprint: {
753
+ supported: true,
754
+ operations: []
755
+ },
756
+ healthCheck: capabilityFrom(
757
+ ["app_info_health"],
758
+ "Ohne Erreichbarkeits-Endpunkt bleibt nur der Umweg ueber eine echte Anfrage."
759
+ ),
760
+ clientManagement: capabilityFrom(
761
+ CLIENT_MANAGEMENT_OPS,
762
+ "Ohne diese Routen kann ein Verwalter keine Zugaenge fuer andere Apps ausstellen."
763
+ ),
764
+ clientRotation: capabilityFrom(
765
+ CLIENT_ROTATION_OPS,
766
+ "Ohne Erneuerung ist ein einmal ausgegebenes Geheimnis dauerhaft."
767
+ ),
768
+ rotationGracePeriod: capabilityFrom(
769
+ GRACE_PERIOD_OPS,
770
+ "Ohne Rueckzug und Ruecknahme ist jede Erneuerung ein harter Schnitt."
771
+ ),
772
+ clientRevocation: capabilityFrom(
773
+ REVOCATION_OPS,
774
+ "Ohne Widerruf bleibt ein kompromittierter Zugang bis zum Ablauf gueltig."
775
+ ),
776
+ entitlements: capabilityFromPrefix(
777
+ "entitlements_",
778
+ "Dieser Vertrag kennt keine Berechtigungs-Routen."
779
+ ),
780
+ invoicing: capabilityFromPrefix(
781
+ "invoices_",
782
+ "Dieser Vertrag kennt keine Rechnungs-Routen."
783
+ ),
784
+ serverSideDryRun: {
785
+ supported: false,
786
+ operations: [],
787
+ reason: "orvello bietet keinen serverseitigen Probelauf fuer die Client-Verwaltung an (`dryRun` gibt es nur in der Buchhaltung). Nebenwirkungsfrei pruefbar ist der Weg trotzdem: `preflightOrvello` beweist Erreichbarkeit, Vertrag und Credential, ohne zu schreiben \u2014 es beweist damit die Berechtigung, nicht das Ergebnis."
788
+ }
789
+ }
790
+ };
791
+ }
792
+
793
+ // src/preflight.ts
794
+ var HEALTH_PATH = describeOperation("app_info_health")?.path ?? "/app-info/health";
795
+ function step(name, ok, detail, skipped = false) {
796
+ return { name, ok, skipped, detail };
797
+ }
798
+ async function preflightOrvello(host, operationId, options = {}) {
799
+ const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
800
+ const steps = [];
801
+ const problems = [];
802
+ const report = (extra) => ({
803
+ ok: problems.length === 0,
804
+ operationId,
805
+ method: null,
806
+ path: null,
807
+ baseUrl: null,
808
+ authChannel: null,
809
+ sideEffects: "none",
810
+ serverSideDryRun: false,
811
+ steps,
812
+ problems,
813
+ checkedAt,
814
+ ...extra
815
+ });
816
+ const operation = describeOperation(operationId);
817
+ if (!operation) {
818
+ steps.push(
819
+ step(
820
+ "operation",
821
+ false,
822
+ `Der Vertrag, gegen den dieses SDK gebaut wurde, kennt "${operationId}" nicht. Entweder ist der Name falsch, oder das SDK ist aelter als der Dienst.`
823
+ )
824
+ );
825
+ problems.push(`Unbekannte Operation "${operationId}".`);
826
+ return report({});
827
+ }
828
+ steps.push(
829
+ step(
830
+ "operation",
831
+ true,
832
+ `${operation.method} ${operation.path} (Auth laut Vertrag: ${operation.authType || "keine Angabe"} \u2192 Bahn "${operation.channel}").`
833
+ )
834
+ );
835
+ let path = null;
836
+ try {
837
+ path = buildPath(operationId, options.params);
838
+ steps.push(step("path-parameters", true, `Gerufen wuerde: ${operation.method} ${path}`));
839
+ } catch (error) {
840
+ const detail = error instanceof OrvelloOperationError ? error.message : String(error);
841
+ steps.push(step("path-parameters", false, detail));
842
+ problems.push(detail);
843
+ return report({ method: operation.method, authChannel: operation.channel });
844
+ }
845
+ const shapeProblems = [];
846
+ if (operation.validated.body && options.body === void 0) {
847
+ shapeProblems.push("Der Dienst validiert einen Body, es wurde aber keiner uebergeben.");
848
+ }
849
+ if (!operation.validated.body && options.body !== void 0) {
850
+ shapeProblems.push("Es wurde ein Body uebergeben, den diese Route nicht auswertet.");
851
+ }
852
+ if (operation.validated.query && options.query === void 0) {
853
+ shapeProblems.push(
854
+ "Die Route validiert Query-Parameter; ohne uebergebene Werte gelten allein die Voreinstellungen des Dienstes."
855
+ );
856
+ }
857
+ if (shapeProblems.length === 0) {
858
+ steps.push(step("request-shape", true, "Body- und Query-Erwartung des Vertrags sind erfuellt."));
859
+ } else {
860
+ const hard = operation.validated.body && options.body === void 0;
861
+ steps.push(step("request-shape", !hard, shapeProblems.join(" ")));
862
+ if (hard) problems.push(shapeProblems[0]);
863
+ }
864
+ const baseUrl = await host.resolveBaseUrl().catch(() => null);
865
+ if (!baseUrl) {
866
+ steps.push(step("reachable", false, "Die Basis-URL des Dienstes konnte nicht aufgeloest werden."));
867
+ problems.push("Basis-URL nicht aufloesbar.");
868
+ return report({ method: operation.method, path, authChannel: operation.channel });
869
+ }
870
+ const timeoutMs = options.timeoutMs ?? 8e3;
871
+ const reachable = await probeReachable(host, baseUrl, timeoutMs, options.signal);
872
+ steps.push(step("reachable", reachable.ok, reachable.detail));
873
+ if (!reachable.ok) {
874
+ problems.push(reachable.detail);
875
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
876
+ }
877
+ const diagnosis = await diagnoseOrvello({
878
+ baseUrl,
879
+ fetch: host.fetchImpl(),
880
+ timeoutMs,
881
+ signal: options.signal
882
+ });
883
+ if (diagnosis.contract.status === "match") {
884
+ steps.push(step("contract", true, `Vertrag stimmt ueberein (${diagnosis.contract.sdk.slice(0, 12)}).`));
885
+ } else if (diagnosis.contract.status === "drift") {
886
+ const detail = diagnosis.problems[0] ?? "Vertrags-Abweichung zwischen SDK und Dienst.";
887
+ steps.push(step("contract", false, detail));
888
+ problems.push(detail);
889
+ } else {
890
+ steps.push(
891
+ step(
892
+ "contract",
893
+ false,
894
+ diagnosis.problems[0] ?? "Der Vertrag der Gegenstelle konnte nicht ermittelt werden.",
895
+ true
896
+ )
897
+ );
898
+ }
899
+ if (operation.channel === "none") {
900
+ steps.push(step("credential-configured", true, "Die Route ist oeffentlich und braucht kein Credential.", true));
901
+ steps.push(step("credential-accepted", true, "Entfaellt: oeffentliche Route.", true));
902
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
903
+ }
904
+ const configured = await host.hasCredentialFor(operation.channel);
905
+ const channelName = operation.channel === "api_key" ? "der Verwaltungs-Schluessel (Header `x-api-key`)" : "das Bearer-Credential (OAuth2-Client oder Token)";
906
+ steps.push(
907
+ step(
908
+ "credential-configured",
909
+ configured,
910
+ configured ? `${channelName} ist hinterlegt.` : `${channelName} fehlt. Diese Route ist ohne ihn nicht aufrufbar.`
911
+ )
912
+ );
913
+ if (!configured) {
914
+ problems.push(`Kein Credential fuer die Bahn "${operation.channel}" hinterlegt.`);
915
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
916
+ }
917
+ if (options.skipCredentialProbe) {
918
+ steps.push(
919
+ step("credential-accepted", false, "Auf Wunsch uebersprungen \u2014 hinterlegt ist nicht angenommen.", true)
920
+ );
921
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
922
+ }
923
+ const accepted = await host.probeCredential(operation.channel, options.signal);
924
+ steps.push(step("credential-accepted", accepted.ok, accepted.detail));
925
+ if (!accepted.ok) problems.push(accepted.detail);
926
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
927
+ }
928
+ async function probeReachable(host, baseUrl, timeoutMs, signal) {
929
+ const doFetch = host.fetchImpl();
930
+ const controller = new AbortController();
931
+ const onAbort = () => controller.abort(signal?.reason);
932
+ signal?.addEventListener("abort", onAbort, { once: true });
933
+ if (signal?.aborted) controller.abort(signal.reason);
934
+ const timer = setTimeout(() => controller.abort(new Error(`Reachability probe timed out after ${timeoutMs}ms`)), timeoutMs);
935
+ const started = Date.now();
936
+ try {
937
+ const response = await doFetch(`${baseUrl}${HEALTH_PATH}`, {
938
+ method: "GET",
939
+ headers: { accept: "application/json" },
940
+ signal: controller.signal
941
+ });
942
+ const took = Date.now() - started;
943
+ return {
944
+ ok: response.status < 500,
945
+ detail: response.status < 500 ? `${baseUrl} antwortet (${response.status}, ${took} ms).` : `${baseUrl} antwortet mit ${response.status} \u2014 der Dienst laeuft, aber nicht gesund.`
946
+ };
947
+ } catch (error) {
948
+ const detail = error instanceof Error ? error.message : String(error);
949
+ return { ok: false, detail: `${baseUrl} ist nicht erreichbar: ${detail}` };
950
+ } finally {
951
+ clearTimeout(timer);
952
+ signal?.removeEventListener("abort", onAbort);
953
+ }
954
+ }
955
+
186
956
  // src/client.ts
187
957
  var OrvelloApiError = class extends Error {
188
958
  constructor(status, statusText, endpoint, body, message) {
@@ -206,14 +976,20 @@ var OrvelloApiError = class extends Error {
206
976
  return this.body;
207
977
  }
208
978
  };
209
- var OrvelloClient = class {
979
+ var OrvelloClient = class _OrvelloClient {
210
980
  baseUrl;
211
981
  auth;
982
+ managementApiKey;
983
+ extraHeaders;
212
984
  doFetch;
213
985
  timeoutMs;
214
986
  maxRetries;
215
987
  retryBaseDelayMs;
216
988
  cachedOAuthToken = null;
989
+ breakerThreshold;
990
+ breakerCooldownMs;
991
+ breakerFailures = 0;
992
+ breakerLastFailureAt = null;
217
993
  // Cached default bank account (5 minutes TTL)
218
994
  _bankAccountCache = null;
219
995
  _bankAccountCacheTime = 0;
@@ -230,10 +1006,19 @@ var OrvelloClient = class {
230
1006
  } else {
231
1007
  this.auth = this.envAuth();
232
1008
  }
1009
+ this.managementApiKey = config.managementApiKey ?? this.envManagementApiKey();
1010
+ this.extraHeaders = config.headers;
233
1011
  this.doFetch = config.fetch || globalThis.fetch;
234
1012
  this.timeoutMs = config.timeoutMs ?? 15e3;
235
1013
  this.maxRetries = config.maxRetries ?? 3;
236
1014
  this.retryBaseDelayMs = config.retryBaseDelayMs ?? 500;
1015
+ if (config.circuitBreaker === false) {
1016
+ this.breakerThreshold = Number.POSITIVE_INFINITY;
1017
+ this.breakerCooldownMs = 0;
1018
+ } else {
1019
+ this.breakerThreshold = config.circuitBreaker?.threshold ?? 5;
1020
+ this.breakerCooldownMs = config.circuitBreaker?.cooldownMs ?? 6e4;
1021
+ }
237
1022
  }
238
1023
  envBaseUrl() {
239
1024
  if (typeof process === "undefined" || !process?.env) return void 0;
@@ -252,10 +1037,31 @@ var OrvelloClient = class {
252
1037
  if (apiKey) return { apiKey };
253
1038
  return void 0;
254
1039
  }
1040
+ envManagementApiKey() {
1041
+ if (typeof process === "undefined" || !process?.env) return void 0;
1042
+ const key = process.env.ORVELLO_MANAGEMENT_API_KEY;
1043
+ return key && key !== "todo" ? key : void 0;
1044
+ }
255
1045
  async resolveBaseUrl() {
256
1046
  const val = typeof this.baseUrl === "function" ? await this.baseUrl() : this.baseUrl;
257
1047
  return val.replace(/\/+$/, "");
258
1048
  }
1049
+ static async resolveValue(provider) {
1050
+ if (provider === void 0) return void 0;
1051
+ return typeof provider === "function" ? await provider() : provider;
1052
+ }
1053
+ /**
1054
+ * Der Verwaltungs-Schluessel, sofern hinterlegt.
1055
+ *
1056
+ * Ein leerer String zaehlt als "nicht hinterlegt". Sonst waere die haeufigste
1057
+ * Fehlkonfiguration — eine gesetzte, aber leere Umgebungsvariable — von einem
1058
+ * echten Wert nicht zu unterscheiden, und der Fehler kaeme erst als `403` vom
1059
+ * Dienst zurueck.
1060
+ */
1061
+ async resolveManagementApiKey() {
1062
+ const key = (await _OrvelloClient.resolveValue(this.managementApiKey))?.trim();
1063
+ return key ? key : void 0;
1064
+ }
259
1065
  async getAuthHeader() {
260
1066
  if (!this.auth) return null;
261
1067
  if (typeof this.auth === "string") {
@@ -334,6 +1140,9 @@ var OrvelloClient = class {
334
1140
  const baseUrl = await this.resolveBaseUrl();
335
1141
  const cleanPath = path.startsWith("/") ? path : `/${path}`;
336
1142
  const url = new URL(`${baseUrl}${cleanPath}`);
1143
+ const method = (options.method ?? "GET").toUpperCase();
1144
+ const authChannel = options.authChannel ?? resolveOperation(method, cleanPath)?.channel ?? "bearer";
1145
+ this.assertCircuitClosed(cleanPath);
337
1146
  if (options.query) {
338
1147
  for (const [k, v] of Object.entries(options.query)) {
339
1148
  if (v !== void 0 && v !== null) {
@@ -352,13 +1161,30 @@ var OrvelloClient = class {
352
1161
  timeoutMs
353
1162
  );
354
1163
  try {
355
- const authHeader = await this.getAuthHeader();
356
1164
  const headers = new Headers(options.headers);
357
- if (!headers.has("Accept")) {
358
- headers.set("Accept", options.rawResponse ? "*/*" : "application/json");
1165
+ const configured = await _OrvelloClient.resolveValue(this.extraHeaders);
1166
+ if (configured) {
1167
+ for (const [name, value] of Object.entries(configured)) {
1168
+ if (!headers.has(name)) headers.set(name, value);
1169
+ }
359
1170
  }
360
- if (authHeader && !headers.has("Authorization")) {
361
- headers.set("Authorization", authHeader);
1171
+ if (authChannel === "bearer") {
1172
+ const authHeader = await this.getAuthHeader();
1173
+ if (authHeader && !headers.has("Authorization")) {
1174
+ headers.set("Authorization", authHeader);
1175
+ }
1176
+ } else if (authChannel === "api_key") {
1177
+ const key = await this.resolveManagementApiKey();
1178
+ if (!key) {
1179
+ throw new OrvelloApiError(
1180
+ 0,
1181
+ "missing management credential",
1182
+ cleanPath,
1183
+ null,
1184
+ `${method} ${cleanPath} is a management route and needs the \`x-api-key\` credential. Pass \`managementApiKey\` to createOrvelloClient() or set ORVELLO_MANAGEMENT_API_KEY. It is a different value from the OAuth2 client used for the business routes.`
1185
+ );
1186
+ }
1187
+ if (!headers.has("x-api-key")) headers.set("x-api-key", key);
362
1188
  }
363
1189
  if (options.idempotencyKey && !headers.has("Idempotency-Key")) {
364
1190
  headers.set("Idempotency-Key", options.idempotencyKey);
@@ -372,7 +1198,7 @@ var OrvelloClient = class {
372
1198
  signal: controller.signal
373
1199
  });
374
1200
  if (!resp.ok) {
375
- if (resp.status === 401) {
1201
+ if (resp.status === 401 && authChannel === "bearer") {
376
1202
  const hadCachedToken = Boolean(this.cachedOAuthToken);
377
1203
  this.cachedOAuthToken = null;
378
1204
  if (hadCachedToken && attempt === 0 && attempt < maxRetries) {
@@ -387,11 +1213,14 @@ var OrvelloClient = class {
387
1213
  }
388
1214
  const apiMessage = errBody && typeof errBody === "object" && "message" in errBody && typeof errBody.message === "string" ? errBody.message : void 0;
389
1215
  const error = new OrvelloApiError(resp.status, resp.statusText, cleanPath, errBody, apiMessage);
1216
+ if (resp.status >= 500) this.recordFailure();
1217
+ else this.recordSuccess();
390
1218
  if (!this.isRetriable(resp.status, error) || attempt >= maxRetries) {
391
1219
  throw error;
392
1220
  }
393
1221
  lastError = error;
394
1222
  } else {
1223
+ this.recordSuccess();
395
1224
  const contentType = resp.headers.get("content-type") || "";
396
1225
  if (options.rawResponse || contentType.includes("application/pdf")) {
397
1226
  return await resp.blob();
@@ -414,6 +1243,7 @@ var OrvelloClient = class {
414
1243
  if (err instanceof OrvelloApiError && !this.isRetriable(err.status, err)) {
415
1244
  throw err;
416
1245
  }
1246
+ if (!(err instanceof OrvelloApiError)) this.recordFailure();
417
1247
  if (!this.isRetriable(null, err) || attempt >= maxRetries) {
418
1248
  throw err;
419
1249
  }
@@ -427,6 +1257,231 @@ var OrvelloClient = class {
427
1257
  }
428
1258
  throw lastError;
429
1259
  }
1260
+ // ── Sicherungsautomat ────────────────────────────────────────────────────
1261
+ recordSuccess() {
1262
+ this.breakerFailures = 0;
1263
+ this.breakerLastFailureAt = null;
1264
+ }
1265
+ recordFailure() {
1266
+ this.breakerFailures++;
1267
+ this.breakerLastFailureAt = Date.now();
1268
+ }
1269
+ /**
1270
+ * Ist der Dienst nach aktuellem Wissen ansprechbar?
1271
+ *
1272
+ * Antwortet ohne Netzzugriff aus dem Zustand des Automaten. Nach Ablauf der
1273
+ * Abkuehlzeit gilt er wieder als ansprechbar — der naechste echte Aufruf
1274
+ * entscheidet dann, ob das stimmt.
1275
+ */
1276
+ isAvailable() {
1277
+ if (this.breakerFailures < this.breakerThreshold) return true;
1278
+ if (this.breakerLastFailureAt === null) return true;
1279
+ return Date.now() - this.breakerLastFailureAt > this.breakerCooldownMs;
1280
+ }
1281
+ /** Der Zustand des Automaten, unverfaelscht — fuer Diagnose-Oberflaechen. */
1282
+ circuitState() {
1283
+ return {
1284
+ open: !this.isAvailable(),
1285
+ consecutiveFailures: this.breakerFailures,
1286
+ lastFailureAt: this.breakerLastFailureAt,
1287
+ threshold: this.breakerThreshold,
1288
+ cooldownMs: this.breakerCooldownMs
1289
+ };
1290
+ }
1291
+ /** Den Automaten von Hand schliessen, etwa nach einer behobenen Stoerung. */
1292
+ resetCircuit() {
1293
+ this.recordSuccess();
1294
+ }
1295
+ assertCircuitClosed(path) {
1296
+ if (this.isAvailable()) return;
1297
+ const waited = this.breakerLastFailureAt ? Date.now() - this.breakerLastFailureAt : 0;
1298
+ const remaining = Math.max(0, this.breakerCooldownMs - waited);
1299
+ throw new OrvelloApiError(
1300
+ 0,
1301
+ "circuit open",
1302
+ path,
1303
+ null,
1304
+ `orvello is not answering: ${this.breakerFailures} consecutive transport failures. Not retrying for another ${Math.ceil(remaining / 1e3)}s.`
1305
+ );
1306
+ }
1307
+ // ── Vertragsgetriebener Aufruf ───────────────────────────────────────────
1308
+ /**
1309
+ * Eine Operation des Vertrags ueber ihre `operationId` aufrufen.
1310
+ *
1311
+ * Methode, Pfad und Credential-Bahn kommen aus dem Vertrag; der Aufrufer gibt
1312
+ * nur die Werte. Das ist der Weg fuer alles, wofuer es keine getippte Methode
1313
+ * gibt — und der Weg, der bei einer neuen Route sofort mitwaechst, statt auf
1314
+ * eine Handarbeit in diesem Client zu warten.
1315
+ *
1316
+ * Der Rueckgabetyp ist bewusst offen: die genauen Typen je Operation stehen im
1317
+ * Unterpfad `@orvello/sdk/contract` und werden hier als Typ-Argument gesetzt.
1318
+ * Ein `operationId`, den der Vertrag nicht kennt, wirft sofort — nicht erst,
1319
+ * wenn der Dienst mit 404 antwortet.
1320
+ */
1321
+ async call(operationId, options = {}) {
1322
+ const operation = describeOperation(operationId);
1323
+ if (!operation) {
1324
+ throw new OrvelloOperationError(
1325
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against (@orvello/sdk speaks ${orvelloCapabilities().operationCount} operations).`,
1326
+ operationId
1327
+ );
1328
+ }
1329
+ const { params, body, ...rest } = options;
1330
+ const path = buildPath(operationId, params);
1331
+ return this.request(path, {
1332
+ ...rest,
1333
+ method: operation.method,
1334
+ authChannel: rest.authChannel ?? operation.channel,
1335
+ ...body === void 0 ? {} : { body: JSON.stringify(body) }
1336
+ });
1337
+ }
1338
+ // ── Zustand und Faehigkeiten ─────────────────────────────────────────────
1339
+ /**
1340
+ * Steht der Dienst, und wird unser Credential angenommen?
1341
+ *
1342
+ * ⭐ `available` und `authenticated` sind zwei Fragen, und der Bericht haelt sie
1343
+ * auseinander. Ein Dienst, der laeuft, aber unser Credential ablehnt, ist nicht
1344
+ * "verfuegbar" im Sinne dessen, der ihn benutzen will — und ein `authenticated:
1345
+ * null` heisst "nicht gefragt", nie "in Ordnung".
1346
+ */
1347
+ async checkHealth(options = {}) {
1348
+ const started = Date.now();
1349
+ const timeoutMs = options.timeoutMs ?? 8e3;
1350
+ let baseUrl;
1351
+ try {
1352
+ baseUrl = await this.resolveBaseUrl();
1353
+ } catch (error) {
1354
+ return {
1355
+ available: false,
1356
+ responseTimeMs: Date.now() - started,
1357
+ authenticated: null,
1358
+ error: error instanceof Error ? error.message : String(error)
1359
+ };
1360
+ }
1361
+ const controller = new AbortController();
1362
+ const onAbort = () => controller.abort(options.signal?.reason);
1363
+ options.signal?.addEventListener("abort", onAbort, { once: true });
1364
+ if (options.signal?.aborted) controller.abort(options.signal.reason);
1365
+ const timer = setTimeout(() => controller.abort(new Error(`Health check timed out after ${timeoutMs}ms`)), timeoutMs);
1366
+ try {
1367
+ const response = await this.doFetch(`${baseUrl}${HEALTH_PATH}`, {
1368
+ method: "GET",
1369
+ headers: { accept: "application/json" },
1370
+ signal: controller.signal
1371
+ });
1372
+ if (response.status >= 500) {
1373
+ this.recordFailure();
1374
+ return {
1375
+ available: false,
1376
+ responseTimeMs: Date.now() - started,
1377
+ authenticated: null,
1378
+ error: `orvello answered ${response.status} on ${HEALTH_PATH}`
1379
+ };
1380
+ }
1381
+ this.recordSuccess();
1382
+ } catch (error) {
1383
+ this.recordFailure();
1384
+ return {
1385
+ available: false,
1386
+ responseTimeMs: Date.now() - started,
1387
+ authenticated: null,
1388
+ error: error instanceof Error ? error.message : String(error)
1389
+ };
1390
+ } finally {
1391
+ clearTimeout(timer);
1392
+ options.signal?.removeEventListener("abort", onAbort);
1393
+ }
1394
+ if (!this.auth) {
1395
+ return { available: true, responseTimeMs: Date.now() - started, authenticated: null };
1396
+ }
1397
+ try {
1398
+ const header = await this.getAuthHeader();
1399
+ return {
1400
+ available: true,
1401
+ responseTimeMs: Date.now() - started,
1402
+ authenticated: Boolean(header)
1403
+ };
1404
+ } catch (error) {
1405
+ return {
1406
+ available: true,
1407
+ responseTimeMs: Date.now() - started,
1408
+ authenticated: false,
1409
+ error: error instanceof Error ? error.message : String(error)
1410
+ };
1411
+ }
1412
+ }
1413
+ /** Was der Vertrag hergibt — ohne Netz, ohne Credential. */
1414
+ capabilities() {
1415
+ return orvelloCapabilities();
1416
+ }
1417
+ /** Spricht die laufende Gegenstelle denselben Vertrag wie dieses SDK? */
1418
+ async diagnose(options = {}) {
1419
+ return diagnoseOrvello({
1420
+ baseUrl: this.baseUrl,
1421
+ fetch: this.doFetch,
1422
+ ...options
1423
+ });
1424
+ }
1425
+ /**
1426
+ * Wuerde dieser Aufruf heute klappen? Prueft den ganzen Weg — Erreichbarkeit,
1427
+ * Vertrag, Credential — und schreibt dabei nichts.
1428
+ *
1429
+ * Gedacht fuer Verbindungs-Verwalter: eine Kante laesst sich damit turnusmaessig
1430
+ * nachpruefen, ohne sie anzufassen, und vor einem freigegebenen Schreibschritt
1431
+ * laesst sich zeigen, was er tun wuerde.
1432
+ */
1433
+ async preflight(operationId, options = {}) {
1434
+ const host = {
1435
+ resolveBaseUrl: () => this.resolveBaseUrl(),
1436
+ fetchImpl: () => this.doFetch,
1437
+ hasCredentialFor: async (channel) => {
1438
+ if (channel === "none") return true;
1439
+ if (channel === "api_key") return Boolean(await this.resolveManagementApiKey());
1440
+ return Boolean(this.auth);
1441
+ },
1442
+ probeCredential: (channel, signal) => this.probeCredential(channel, signal)
1443
+ };
1444
+ const report = await preflightOrvello(host, operationId, options);
1445
+ return {
1446
+ ...report,
1447
+ serverSideDryRun: this.capabilities().capabilities.serverSideDryRun.supported
1448
+ };
1449
+ }
1450
+ /**
1451
+ * Ein ausschliesslich lesender Aufruf auf einer Credential-Bahn.
1452
+ *
1453
+ * Je Bahn die guenstigste Frage, die ohne Nebenwirkung beantwortet, ob das
1454
+ * Credential angenommen wird:
1455
+ * - `api_key` → die Auflistung der Zugaenge mit `pageSize=1`
1456
+ * - `bearer` → das Holen des Tokens (der Dienst prueft dabei Kennung und Geheimnis)
1457
+ */
1458
+ async probeCredential(channel, signal) {
1459
+ if (channel === "none") return { ok: true, detail: "Oeffentliche Route, kein Credential noetig." };
1460
+ if (channel === "api_key") {
1461
+ try {
1462
+ await this.call("oauth2_external_clients_list", {
1463
+ query: { pageSize: 1 },
1464
+ maxRetries: 0,
1465
+ signal
1466
+ });
1467
+ return { ok: true, detail: "Der Verwaltungs-Schluessel wird angenommen (Leseprobe auf die Zugangsliste)." };
1468
+ } catch (error) {
1469
+ if (error instanceof OrvelloApiError) {
1470
+ return {
1471
+ ok: false,
1472
+ detail: error.status === 403 || error.status === 401 ? `Der Verwaltungs-Schluessel wird abgelehnt (${error.status}). Der Wert ist gesetzt, aber nicht der, den der Dienst erwartet.` : `Leseprobe fehlgeschlagen (${error.status}): ${error.message}`
1473
+ };
1474
+ }
1475
+ return { ok: false, detail: `Leseprobe fehlgeschlagen: ${error.message}` };
1476
+ }
1477
+ }
1478
+ try {
1479
+ const header = await this.getAuthHeader();
1480
+ return header ? { ok: true, detail: "Das Bearer-Credential wird angenommen (Token wurde ausgestellt)." } : { ok: false, detail: "Es konnte kein Bearer-Credential ermittelt werden." };
1481
+ } catch (error) {
1482
+ return { ok: false, detail: `Token konnte nicht geholt werden: ${error.message}` };
1483
+ }
1484
+ }
430
1485
  // ── Invoices ─────────────────────────────────────────────────────────────
431
1486
  invoices = {
432
1487
  search: (query, options) => this.request("/invoices/external", {
@@ -735,14 +1790,23 @@ function createOrvelloClient(config) {
735
1790
  }
736
1791
 
737
1792
  exports.CONTRACT_SHA256 = CONTRACT_SHA256;
1793
+ exports.HEALTH_PATH = HEALTH_PATH;
738
1794
  exports.OrvelloApiError = OrvelloApiError;
739
1795
  exports.OrvelloClient = OrvelloClient;
1796
+ exports.OrvelloOperationError = OrvelloOperationError;
1797
+ exports.authChannelForContractType = authChannelForContractType;
740
1798
  exports.buildBase64Receipt = buildBase64Receipt;
1799
+ exports.buildPath = buildPath;
741
1800
  exports.calculateVat = calculateVat;
742
1801
  exports.createOrvelloClient = createOrvelloClient;
1802
+ exports.describeOperation = describeOperation;
743
1803
  exports.diagnoseOrvello = diagnoseOrvello;
744
1804
  exports.formatAmount = formatAmount;
745
1805
  exports.isKleinunternehmer = isKleinunternehmer;
1806
+ exports.listOperations = listOperations;
746
1807
  exports.mapPaymentAccountToBankDetails = mapPaymentAccountToBankDetails;
1808
+ exports.orvelloCapabilities = orvelloCapabilities;
1809
+ exports.preflightOrvello = preflightOrvello;
1810
+ exports.resolveOperation = resolveOperation;
747
1811
  //# sourceMappingURL=index.cjs.map
748
1812
  //# sourceMappingURL=index.cjs.map