@sixtyninecommerce/admin 0.8.0 → 0.10.0

package/dist/api-tokens/index.d.ts

@@ -1,10 +1,10 @@
 import { type Page, type Transport } from '@sixtyninecommerce/core';
 import type { ApiToken, Call, CreateApiTokenInput, ListOptions, UpdateApiTokenInput } from '../types.js';
-export declare const API_TOKEN_FIELDS = "\n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n";
-export declare const LIST_QUERY = "\n  query ApiTokens($options: ApiTokenListOptions) {\n    apiTokens(options: $options) {\n      totalItems\n      items { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n }\n    }\n  }\n";
-export declare const CREATE_MUTATION = "\n  mutation CreateApiToken($input: CreateApiTokenInput!) {\n    createApiToken(input: $input) {\n      token\n      apiToken { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n }\n    }\n  }\n";
-export declare const UPDATE_MUTATION = "\n  mutation UpdateApiToken($input: UpdateApiTokenInput!) {\n    updateApiToken(input: $input) { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n }\n  }\n";
-export declare const REVOKE_MUTATION = "\n  mutation RevokeApiToken($id: ID!) {\n    revokeApiToken(id: $id) { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n }\n  }\n";
+export declare const API_TOKEN_FIELDS = "\n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n  fieldOwnership\n";
+export declare const LIST_QUERY = "\n  query ApiTokens($options: ApiTokenListOptions) {\n    apiTokens(options: $options) {\n      totalItems\n      items { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n  fieldOwnership\n }\n    }\n  }\n";
+export declare const CREATE_MUTATION = "\n  mutation CreateApiToken($input: CreateApiTokenInput!) {\n    createApiToken(input: $input) {\n      token\n      apiToken { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n  fieldOwnership\n }\n    }\n  }\n";
+export declare const UPDATE_MUTATION = "\n  mutation UpdateApiToken($input: UpdateApiTokenInput!) {\n    updateApiToken(input: $input) { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n  fieldOwnership\n }\n  }\n";
+export declare const REVOKE_MUTATION = "\n  mutation RevokeApiToken($id: ID!) {\n    revokeApiToken(id: $id) { \n  id\n  name\n  tokenPrefix\n  permissions\n  channelId\n  locationIds\n  expiresAt\n  lastUsedAt\n  revokedAt\n  createdAt\n  fieldOwnership\n }\n  }\n";
 export declare const DELETE_MUTATION = "\n  mutation DeleteApiTokens($ids: [ID!]!) {\n    deleteApiTokens(ids: $ids) {\n      result\n      message\n    }\n  }\n";
 /** The raw token is shown exactly once, at creation. */
 export interface CreatedApiToken {
@@ -21,7 +21,17 @@ export interface CreatedApiToken {
  */
 export interface ApiTokensModule {
     list(options?: ListOptions): Promise<Page<ApiToken>>;
+    /**
+     * Mint a token. `fieldOwnership` hands it field groups (see `ApiToken.fieldOwnership`): the
+     * engine refuses a group the token could not change, one you cannot change yourself, one
+     * another app or token owns on the store, or one Exact or the store's organization writes
+     * (`FieldGroupGrantRefusalCode`), before anything is minted.
+     */
     create(input: CreateApiTokenInput, options?: Call): Promise<CreatedApiToken>;
+    /**
+     * Edit a live token. `fieldOwnership` omitted or null keeps its groups (dropping any its new
+     * permissions cannot change); a list replaces them, judging only the groups it adds.
+     */
     update(id: string, input: UpdateApiTokenInput, options?: Call): Promise<ApiToken>;
     revoke(id: string, options?: Call): Promise<ApiToken>;
     delete(ids: string[], options?: Call): Promise<void>;

package/dist/api-tokens/index.js

@@ -10,6 +10,7 @@ export const API_TOKEN_FIELDS = /* GraphQL */ `
   lastUsedAt
   revokedAt
   createdAt
+  fieldOwnership
 `;
 export const LIST_QUERY = /* GraphQL */ `
   query ApiTokens($options: ApiTokenListOptions) {

package/dist/apps/event-subscription.d.ts

@@ -0,0 +1,59 @@
+import { type Transport } from '@sixtyninecommerce/core';
+import type { RotatedEventSubscriptionSecret } from '../events/index.js';
+import type { Call } from '../types.js';
+/**
+ * The calling installation's own event subscription (headless spec §6.9 "App
+ * subscriptions").
+ *
+ * Installing an app that declares `events.endpoint` creates it; the platform
+ * then POSTs the app's declared events there, signed. The app FETCHES its
+ * signing secret — it is never pushed to the endpoint, because anyone can POST
+ * to a public URL and a pushed secret is one an attacker could plant.
+ */
+export interface AppEventSubscription {
+    id: string;
+    /** The rendered endpoint deliveries go to. */
+    url: string;
+    eventFilters: string[];
+    enabled: boolean;
+    disabledReason: string | null;
+    /**
+     * True when the app declares `customerData: none`: the customer's name and
+     * email are then withheld (`customer.redacted: true`, the id kept). False at
+     * `identity` and `full`, whose deliveries carry them. An erased customer's
+     * are blank at every level (`customer.erased: true`).
+     */
+    redactCustomerIdentity: boolean;
+    deliveryScope: string;
+    createdAt: string;
+    /** When the secret was taken. Null on the one answer that carries it. */
+    secretFetchedAt: string | null;
+    /**
+     * The signing secret (hex), on the FIRST read only — store it then. Every later
+     * read omits it; a lost secret is replaced with `rotateSecret()`. Pass it to
+     * `createEventHandler` / `verifyEventDelivery`.
+     */
+    secret?: string;
+    /** The same key as a Standard Webhooks `whsec_` secret. First read only. */
+    secretStandard?: string;
+    [extra: string]: unknown;
+}
+export interface AppEventSubscriptionModule {
+    /**
+     * Read it. Needs the INSTALLATION's own credential (`auth: { app, installationId }`)
+     * and answers `NotFoundError` (`EVENT_SUBSCRIPTION_NOT_FOUND`) when the app
+     * declares no events, waits for consent, or is not active. Takes no idempotency
+     * key: the first answer carries the secret, which the platform never stores
+     * for replay.
+     */
+    (options?: Omit<Call, 'idempotencyKey'>): Promise<AppEventSubscription>;
+    /**
+     * Issue a new signing secret and answer it ONCE; the old one keeps co-signing
+     * for 24 hours. Same rules as `events.subscriptions.rotateSecret`, including
+     * `force` and the refusal of a second rotation inside the overlap.
+     */
+    rotateSecret(options?: {
+        force?: boolean;
+    } & Omit<Call, 'idempotencyKey'>): Promise<RotatedEventSubscriptionSecret>;
+}
+export declare function createAppEventSubscriptionModule(transport: Transport): AppEventSubscriptionModule;

package/dist/apps/event-subscription.js

@@ -0,0 +1,32 @@
+import { ValidationError } from '@sixtyninecommerce/core';
+function refuseIdempotencyKey(options, what) {
+    if (options && 'idempotencyKey' in options && options.idempotencyKey !== undefined) {
+        throw new ValidationError({
+            code: 'IDEMPOTENCY_NOT_SUPPORTED',
+            message: `${what} takes no idempotency key: its answer carries a signing secret, which the platform never stores for replay.`,
+            status: 400,
+            service: 'plugins',
+        });
+    }
+}
+export function createAppEventSubscriptionModule(transport) {
+    const read = async (options) => {
+        refuseIdempotencyKey(options, 'apps.installation.eventSubscription');
+        // ONE attempt, although it is a GET: the first answer spends the secret on
+        // the server, so an automatic retry after a lost response would come back
+        // "successfully" without it. A caller that sees the error reads again, and
+        // if `secretFetchedAt` is then set, calls `rotateSecret()`.
+        return transport.rest('plugins', { method: 'GET', path: '/event-subscriptions/installation' }, { ...options, retry: { attempts: 1 } });
+    };
+    return Object.assign(read, {
+        async rotateSecret(options) {
+            refuseIdempotencyKey(options, 'apps.installation.eventSubscription.rotateSecret');
+            const { force, ...call } = options ?? {};
+            return transport.rest('plugins', {
+                method: 'POST',
+                path: '/event-subscriptions/installation/rotate-secret',
+                query: { force: force === true ? true : undefined },
+            }, call);
+        },
+    });
+}

package/dist/apps/hook-secret.d.ts

@@ -0,0 +1,22 @@
+import { type Transport } from '@sixtyninecommerce/core';
+import type { Call } from '../types.js';
+/** The calling installation's hook signing secret (headless spec §8.14, user decision E6). */
+export interface AppHookSecret {
+    installationId: string;
+    /** Standard Webhooks `whsec_…`: pass it to `createHookHandler({ secret })`. */
+    secret: string;
+    /** ISO-8601 with offset: when it was taken. */
+    fetchedAt: string;
+}
+export type AppHookSecretModule = (options?: Omit<Call, 'idempotencyKey'>) => Promise<AppHookSecret>;
+/**
+ * Read the calling installation's hook secret — ONCE. Needs the installation's
+ * own credential (`auth: { app, installationId }`); any other principal is
+ * refused `HOOK_SECRET_NOT_ALLOWED`. Store it: every later read is refused
+ * `HOOK_SECRET_ALREADY_FETCHED` (a `ConflictError`), and `HOOK_SECRET_NOT_FOUND`
+ * means the app declares no hooks or the merchant has not approved them yet.
+ *
+ * The platform signs every hook call to this installation with it; it is never
+ * pushed to your URL, because anyone can POST to a public URL.
+ */
+export declare function createAppHookSecretModule(transport: Transport): AppHookSecretModule;

package/dist/apps/hook-secret.js

@@ -0,0 +1,36 @@
+import { ValidationError } from '@sixtyninecommerce/core';
+const FETCH_HOOK_SECRET = /* GraphQL */ `
+  mutation FetchAppHookSecret {
+    fetchAppHookSecret {
+      installationId
+      secret
+      fetchedAt
+    }
+  }
+`;
+/**
+ * Read the calling installation's hook secret — ONCE. Needs the installation's
+ * own credential (`auth: { app, installationId }`); any other principal is
+ * refused `HOOK_SECRET_NOT_ALLOWED`. Store it: every later read is refused
+ * `HOOK_SECRET_ALREADY_FETCHED` (a `ConflictError`), and `HOOK_SECRET_NOT_FOUND`
+ * means the app declares no hooks or the merchant has not approved them yet.
+ *
+ * The platform signs every hook call to this installation with it; it is never
+ * pushed to your URL, because anyone can POST to a public URL.
+ */
+export function createAppHookSecretModule(transport) {
+    return async (options) => {
+        if (options && 'idempotencyKey' in options && options.idempotencyKey !== undefined) {
+            throw new ValidationError({
+                code: 'IDEMPOTENCY_NOT_SUPPORTED',
+                message: 'apps.installation.hookSecret takes no idempotency key: its answer carries a signing secret, which the platform never stores for replay.',
+                status: 400,
+                service: 'vendure',
+            });
+        }
+        // ONE attempt: the first answer spends the secret on the server, so an
+        // automatic retry after a lost response would come back "already fetched".
+        const data = await transport.graphql({ api: 'admin', query: FETCH_HOOK_SECRET, variables: {} }, { ...options, retry: { attempts: 1 } });
+        return data.fetchAppHookSecret;
+    };
+}

package/dist/apps/index.d.ts

@@ -1,4 +1,5 @@
 import type { Transport } from '@sixtyninecommerce/core';
+import { type FieldGroupOwnership } from '../tenant/field-groups.js';
 import type { Call } from '../types.js';
 export declare const APP_FIELDS = "\n  id\n  slug\n  name\n  ownerLabel\n  declaredPermissions\n  declaredEvents\n  declaredFieldOwnership\n  customerData\n  customerDataPurpose\n  metafieldDefinitions\n  configSchema\n  hooks\n  headTemplates\n  sandboxOnly\n  status\n  manifestVersion\n  createdAt\n  updatedAt\n";
 export declare const INSTALLATION_FIELDS = "\n  id\n  appId\n  targetKind\n  targetId\n  grantedPermissions\n  grantedFieldOwnership\n  locationIds\n  status\n  consentVersion\n  pendingConsentReasons\n  installedAt\n  uninstalledAt\n";
@@ -7,6 +8,7 @@ export declare const MY_INSTALLATIONS_QUERY = "\n  query MyInstallations {\n
 export declare const INSTALLATION_QUERY = "\n  query AppInstallation($id: ID!) {\n    appInstallation(id: $id) { \n  id\n  appId\n  targetKind\n  targetId\n  grantedPermissions\n  grantedFieldOwnership\n  locationIds\n  status\n  consentVersion\n  pendingConsentReasons\n  installedAt\n  uninstalledAt\n }\n  }\n";
 export declare const INSTALL_MUTATION = "\n  mutation InstallApp($input: InstallAppInput!) {\n    installApp(input: $input) { \n  id\n  appId\n  targetKind\n  targetId\n  grantedPermissions\n  grantedFieldOwnership\n  locationIds\n  status\n  consentVersion\n  pendingConsentReasons\n  installedAt\n  uninstalledAt\n }\n  }\n";
 export declare const APPROVE_MUTATION = "\n  mutation ApproveInstallationConsent($id: ID!, $input: ApproveInstallationConsentInput) {\n    approveInstallationConsent(id: $id, input: $input) { \n  id\n  appId\n  targetKind\n  targetId\n  grantedPermissions\n  grantedFieldOwnership\n  locationIds\n  status\n  consentVersion\n  pendingConsentReasons\n  installedAt\n  uninstalledAt\n }\n  }\n";
+export declare const RELEASE_FIELD_GROUP_MUTATION = "\n  mutation ReleaseFieldGroup($input: ReleaseFieldGroupInput!, $idempotencyKey: String) {\n    releaseFieldGroup(input: $input, idempotencyKey: $idempotencyKey) { \n  group\n  ownerKind\n  ownerId\n  label\n  appSlug\n  paused\n }\n  }\n";
 export declare const UNINSTALL_MUTATION = "\n  mutation UninstallApp($id: ID!) {\n    uninstallApp(id: $id) { \n  id\n  appId\n  targetKind\n  targetId\n  grantedPermissions\n  grantedFieldOwnership\n  locationIds\n  status\n  consentVersion\n  pendingConsentReasons\n  installedAt\n  uninstalledAt\n }\n  }\n";
 /** A registered app, as a tenant admin sees it on the consent screen. */
 export interface App {
@@ -17,7 +19,11 @@ export interface App {
     /** The ceiling on what an installation may be granted. */
     declaredPermissions: string[];
     declaredEvents: string[];
-    /** Normalised `"<entity>.<field>"` claims, e.g. `product.price`. */
+    /**
+     * The field groups the app asks to own, by key: `price` (Price), `stock` (Stock),
+     * `product_details` (Product details), `customer_details` (Customer details). Each is a fixed
+     * list of fields the platform defines; an app never claims a single field.
+     */
     declaredFieldOwnership: string[];
     /** `none` | `identity` | `full`. */
     customerData: string;
@@ -26,6 +32,7 @@ export interface App {
     configSchema: Record<string, unknown> | null;
     hooks: unknown[];
     headTemplates: unknown[];
+    /** Installable on a sandbox store only (`SANDBOX_ONLY_APP` elsewhere). */
     sandboxOnly: boolean;
     /** `active` | `suspended`. */
     status: string;
@@ -40,7 +47,7 @@ export interface AppInstallation {
     targetKind: string;
     targetId: string;
     grantedPermissions: string[];
-    /** Normalised `"<entity>.<field>"` claims, e.g. `product.price`. */
+    /** The field groups this installation was granted, by key (see `App.declaredFieldOwnership`). */
     grantedFieldOwnership: string[];
     /** Null means unrestricted. */
     locationIds: string[] | null;
@@ -66,6 +73,13 @@ export interface ApproveConsentInput {
      */
     acknowledgedConsentReasons?: string[];
     grantedPermissions?: string[];
+    /**
+     * Replaces the granted field groups, by key (`price`, `stock`, `product_details`,
+     * `customer_details`), each one the app declares. Any other value is refused with
+     * `FIELD_GROUP_INVALID` (a `ValidationError`). A group the installation does not own yet is
+     * judged as on `install` (`FieldGroupGrantRefusalCode`); one it owns already is kept. Omit it
+     * to keep the current set: a group the approved permissions cannot change is then dropped.
+     */
     grantedFieldOwnership?: string[];
     /**
      * Replace the stock-location restriction. Omit to keep it; pass `null` to LIFT
@@ -75,10 +89,24 @@ export interface ApproveConsentInput {
      */
     locationIds?: string[] | null;
 }
+/** The owner a release names: an app installation or a personal API token of this store. */
+export interface FieldGroupOwnerRef {
+    kind: 'app_installation' | 'api_token';
+    /** The installation id or the API token id. */
+    id: string;
+}
 export interface InstallAppInput {
     appId: string;
     /** Must be a subset of the app's `declaredPermissions`, and of the caller's own. */
     grantedPermissions?: string[];
+    /**
+     * Field groups to grant, by key (`price`, `stock`, `product_details`, `customer_details`), a
+     * subset of the app's `declaredFieldOwnership`. Any other value is refused with
+     * `FIELD_GROUP_INVALID` (a `ValidationError`). The store's rules apply too: the app must be
+     * granted a permission that changes each group, you must be able to change it yourself, no
+     * other app or token may own it here, and neither Exact nor the store's organization may
+     * write it (`FieldGroupGrantRefusalCode`).
+     */
     grantedFieldOwnership?: string[];
     /** Restrict the installation to these stock locations. Omit for unrestricted. */
     locationIds?: string[];
@@ -97,7 +125,13 @@ export interface InstallAppInput {
 export interface AppsModule {
     /** Apps a platform operator has enabled for this store and that are not suspended. */
     list(options?: Call): Promise<App[]>;
-    /** Consent to a subset of an app's declarations and install it. */
+    /**
+     * Consent to a subset of an app's declarations and install it.
+     *
+     * An app with `sandboxOnly: true` installs on a sandbox store only
+     * (`platform.provisionStore({ sandbox: true })`); on any other store the
+     * engine refuses it with `SANDBOX_ONLY_APP`.
+     */
     install(input: InstallAppInput, options?: Call): Promise<AppInstallation>;
     /** This store's installations, newest first. */
     installations(options?: Call): Promise<AppInstallation[]>;
@@ -113,5 +147,22 @@ export interface AppsModule {
     approveConsent(id: string, grants?: ApproveConsentInput, options?: Call): Promise<AppInstallation>;
     /** Revoke every token and end the grant. The row is kept as provenance. */
     uninstall(id: string, options?: Call): Promise<AppInstallation>;
+    /**
+     * Release one field group from one owner on this store, in one recorded step: the group comes
+     * off the installation's `grantedFieldOwnership` or the API token's `fieldOwnership`, the
+     * engine audits it and announces `app.field_ownership_changed`, and staff, imports and other
+     * apps can be granted it or change that data again. The owner keeps everything else.
+     *
+     * Releasing an installation's group needs `InstallApps`, a token's `ManageApiToken`
+     * (`PermissionDeniedError FORBIDDEN` otherwise). Refused `FIELD_GROUP_NOT_HELD`
+     * (`BusinessRuleError`) when the owner does not own the group — an uninstalled installation
+     * and a revoked or expired token own none — and `ENTITY_NOT_FOUND` (`NotFoundError`) for an
+     * owner on another store.
+     *
+     * `options.idempotencyKey` is honoured: a retry under the same key within 24 h answers the
+     * first release instead of releasing again (a repeat WITHOUT the key answers
+     * `FIELD_GROUP_NOT_HELD`).
+     */
+    releaseFieldGroup(owner: FieldGroupOwnerRef, group: string, options?: Call): Promise<FieldGroupOwnership>;
 }
 export declare function createAppsModule(transport: Transport): AppsModule;

package/dist/apps/index.js

@@ -1,3 +1,4 @@
+import { FIELD_GROUP_OWNERSHIP_FIELDS } from '../tenant/field-groups.js';
 export const APP_FIELDS = /* GraphQL */ `
   id
   slug
@@ -57,6 +58,11 @@ export const APPROVE_MUTATION = /* GraphQL */ `
     approveInstallationConsent(id: $id, input: $input) { ${INSTALLATION_FIELDS} }
   }
 `;
+export const RELEASE_FIELD_GROUP_MUTATION = /* GraphQL */ `
+  mutation ReleaseFieldGroup($input: ReleaseFieldGroupInput!, $idempotencyKey: String) {
+    releaseFieldGroup(input: $input, idempotencyKey: $idempotencyKey) { ${FIELD_GROUP_OWNERSHIP_FIELDS} }
+  }
+`;
 export const UNINSTALL_MUTATION = /* GraphQL */ `
   mutation UninstallApp($id: ID!) {
     uninstallApp(id: $id) { ${INSTALLATION_FIELDS} }
@@ -84,6 +90,17 @@ export function createAppsModule(transport) {
             const data = await transport.graphql({ api: 'admin', query: APPROVE_MUTATION, variables: { id, input: grants ?? null } }, options);
             return data.approveInstallationConsent;
         },
+        async releaseFieldGroup(owner, group, options) {
+            const data = await transport.graphql({
+                api: 'admin',
+                query: RELEASE_FIELD_GROUP_MUTATION,
+                variables: {
+                    input: { ownerKind: owner.kind, ownerId: owner.id, group },
+                    idempotencyKey: options?.idempotencyKey,
+                },
+            }, options);
+            return data.releaseFieldGroup;
+        },
         async uninstall(id, options) {
             const data = await transport.graphql({ api: 'admin', query: UNINSTALL_MUTATION, variables: { id } }, options);
             return data.uninstallApp;

package/dist/audit/index.d.ts

@@ -150,6 +150,13 @@ export interface AuditCorrelation {
  * reads at once rather than up to a permission-cache later. That costs one
  * extra round trip per call, which is why these are poller routes, not
  * something to put behind a table a browser repaints.
+ *
+ * **An app installation below `customerData: full`** reads the same rows with
+ * every field that can carry customer data null — `actorLabel`, `targetLabel`,
+ * `errorDetail`, `metadata`, and a call's `endpoint`, `requestBody`,
+ * `responseBody` and `error` — and a text search (`q`) is refused with
+ * `PermissionDeniedError` code `CUSTOMER_DATA_NOT_GRANTED`. Ids, codes,
+ * outcomes and moments stay.
  */
 export interface AuditModule {
     events(filter?: AuditEventFilter): Promise<Page<AuditEvent>>;

package/dist/auth/queries.d.ts

@@ -7,5 +7,9 @@
  * header, which the transport hands to `Principal.onToken`.
  */
 export declare const LOGIN_MUTATION = "\n  mutation Login($username: String!, $password: String!) {\n    login(username: $username, password: $password) {\n      __typename\n      ... on CurrentUser {\n        id\n      }\n      ... on ErrorResult {\n        errorCode\n        message\n      }\n    }\n  }\n";
-export declare const ME_QUERY = "\n  query Me {\n    me {\n      id\n      identifier\n      channels {\n        id\n        code\n        token\n        permissions\n      }\n    }\n    activeAdministrator {\n      id\n      firstName\n      lastName\n      emailAddress\n    }\n  }\n";
+/**
+ * `channelKind` / `organizationId` need a platform release that serves them
+ * (#812); against an older engine this document fails validation as a whole.
+ */
+export declare const ME_QUERY = "\n  query Me {\n    me {\n      id\n      identifier\n      channels {\n        id\n        code\n        token\n        permissions\n        channelKind\n        organizationId\n      }\n    }\n    activeAdministrator {\n      id\n      firstName\n      lastName\n      emailAddress\n    }\n  }\n";
 export declare const LOGOUT_MUTATION = "\n  mutation Logout {\n    logout {\n      success\n    }\n  }\n";

package/dist/auth/queries.js

@@ -20,6 +20,10 @@ export const LOGIN_MUTATION = /* GraphQL */ `
     }
   }
 `;
+/**
+ * `channelKind` / `organizationId` need a platform release that serves them
+ * (#812); against an older engine this document fails validation as a whole.
+ */
 export const ME_QUERY = /* GraphQL */ `
   query Me {
     me {
@@ -30,6 +34,8 @@ export const ME_QUERY = /* GraphQL */ `
         code
         token
         permissions
+        channelKind
+        organizationId
       }
     }
     activeAdministrator {