@tanqory/plugin-sdk 0.6.1 → 0.6.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tanqory Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,aAAa,EAAoB,MAAM,qBAAqB,CAAA;AAG7F;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAA;IACxB,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,6BAA6B;IAC7B,KAAK,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B,kEAAkE;IAClE,GAAG,EAAE,WAAW,GAAG,IAAI,CAAA;IACvB,6EAA6E;IAC7E,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IAC/B,sFAAsF;IACtF,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5F;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7F,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5D,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,eAAe,CA2EjF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,aAAa,EAAoB,MAAM,qBAAqB,CAAA;AAG7F;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAA;IACxB,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,6BAA6B;IAC7B,KAAK,EAAE,aAAa,GAAG,IAAI,CAAA;IAC3B,kEAAkE;IAClE,GAAG,EAAE,WAAW,GAAG,IAAI,CAAA;IACvB,6EAA6E;IAC7E,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IAC/B,sFAAsF;IACtF,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5F;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7F,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5D,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,eAAe,CAkFjF"}

package/dist/client/index.js

@@ -97,10 +97,19 @@ function useTanqoryApp(options = {}) {
         error,
         store,
         api,
-        can: (scope) => 
-        // `'*'` is the store-owner wildcard. Without this branch the one merchant
-        // guaranteed to be allowed everything would see no actions at all.
-        store?.permissions.includes('*') || store?.permissions.includes(scope) || false,
+        can: (scope) => {
+            if (!store)
+                return false;
+            // The host already intersects the merchant's permissions with the app's
+            // grant for a marketplace guest (app-bridge ≥0.7), so `permissions` is
+            // the right thing to check on either path. `grantedScopes`, when present,
+            // is the grant itself — a scope outside it is refused even for a store
+            // owner, whose `'*'` wildcard otherwise made this return true for every
+            // scope regardless of what was granted.
+            if (store.grantedScopes && !store.grantedScopes.includes(scope))
+                return false;
+            return store.permissions.includes('*') || store.permissions.includes(scope);
+        },
         toast: (variant, title, description) => bridgeRef.current?.post('TOAST', { variant, title, description }),
     };
 }

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;AA2EA,sCA2EC;AAtJD,oDAA6F;AAC7F,iCAA0E;AA4C1E,MAAM,oBAAoB,GAAG,CAAC,yBAAyB,CAAC,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAA,gBAAQ,EAAmB,SAAS,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAuB,IAAI,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,IAAA,cAAM,EAAqB,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,IAAA,cAAM,EAAC,KAAK,CAAC,CAAA;IAE5B,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAM;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;QAErB,MAAM,MAAM,GAAG,IAAA,8BAAiB,EAAC;YAC/B,cAAc,EAAE,OAAO,CAAC,kBAAkB,IAAI,oBAAoB;SACnE,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,GAAG,MAAM,CAAA;QAE1B,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,QAAQ,CAAC,qDAAqD,CAAC,CAAA;YAC/D,SAAS,CAAC,OAAO,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;QAC3B,IAAI,SAAS,GAAG,KAAK,CAAA;QAErB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,sEAAsE;gBACtE,uEAAuE;gBACvE,6CAA6C;gBAC7C,IAAI,OAAO,GAAyB,IAAI,CAAA;gBACxC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;oBAC/B,CAAC;oBAAC,OAAO,SAAS,EAAE,CAAC;wBACnB,IAAI,SAAS;4BAAE,OAAM;wBACrB,IAAI,OAAO,KAAK,CAAC;4BAAE,MAAM,SAAS,CAAA;oBACpC,CAAC;gBACH,CAAC;gBACD,IAAI,SAAS,IAAI,CAAC,OAAO;oBAAE,OAAM;gBAEjC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACjB,SAAS,CAAC,OAAO,CAAC,CAAA;gBAClB,MAAM,CAAC,KAAK,EAAE,CAAA;YAChB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,SAAS;oBAAE,OAAM;gBACrB,QAAQ,CAAC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;gBAC7E,SAAS,CAAC,OAAO,CAAC,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;YAChB,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAuB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAElE,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,KAAK,OAAO;QACzB,KAAK;QACL,KAAK;QACL,GAAG;QACH,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;QACb,0EAA0E;QAC1E,mEAAmE;QACnE,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK;QACjF,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACrC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KACpE,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAA+C;IAC/D,KAAK,UAAU,OAAO,CACpB,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,KAAiD;QAEjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAA;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAEpD,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,eAAe,CACrD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC,QAAQ,EAAE,EAAE;YAChB,CAAC,CAAC,EAAE,CAAA;QAEN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YACvC,MAAM;YACN,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,MAAM,EAAE;YAC5D,IAAI;SACL,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;YACtC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAC5D,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1C,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;AA2EA,sCAkFC;AA7JD,oDAA6F;AAC7F,iCAA0E;AA4C1E,MAAM,oBAAoB,GAAG,CAAC,yBAAyB,CAAC,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAA,gBAAQ,EAAmB,SAAS,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAuB,IAAI,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,IAAA,cAAM,EAAqB,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,IAAA,cAAM,EAAC,KAAK,CAAC,CAAA;IAE5B,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAM;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;QAErB,MAAM,MAAM,GAAG,IAAA,8BAAiB,EAAC;YAC/B,cAAc,EAAE,OAAO,CAAC,kBAAkB,IAAI,oBAAoB;SACnE,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,GAAG,MAAM,CAAA;QAE1B,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,QAAQ,CAAC,qDAAqD,CAAC,CAAA;YAC/D,SAAS,CAAC,OAAO,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;QAC3B,IAAI,SAAS,GAAG,KAAK,CAAA;QAErB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,sEAAsE;gBACtE,uEAAuE;gBACvE,6CAA6C;gBAC7C,IAAI,OAAO,GAAyB,IAAI,CAAA;gBACxC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;oBAC/B,CAAC;oBAAC,OAAO,SAAS,EAAE,CAAC;wBACnB,IAAI,SAAS;4BAAE,OAAM;wBACrB,IAAI,OAAO,KAAK,CAAC;4BAAE,MAAM,SAAS,CAAA;oBACpC,CAAC;gBACH,CAAC;gBACD,IAAI,SAAS,IAAI,CAAC,OAAO;oBAAE,OAAM;gBAEjC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACjB,SAAS,CAAC,OAAO,CAAC,CAAA;gBAClB,MAAM,CAAC,KAAK,EAAE,CAAA;YAChB,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,SAAS;oBAAE,OAAM;gBACrB,QAAQ,CAAC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;gBAC7E,SAAS,CAAC,OAAO,CAAC,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;YAChB,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAuB,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAElE,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,KAAK,OAAO;QACzB,KAAK;QACL,KAAK;QACL,GAAG;QACH,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAA;YACxB,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wCAAwC;YACxC,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC7E,OAAO,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7E,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACrC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KACpE,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAA+C;IAC/D,KAAK,UAAU,OAAO,CACpB,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,KAAiD;QAEjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAA;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAEpD,wEAAwE;QACxE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;YAC1B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,eAAe,CACrD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACnD,CAAC,QAAQ,EAAE,EAAE;YAChB,CAAC,CAAC,EAAE,CAAA;QAEN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;YACvC,MAAM;YACN,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,MAAM,EAAE;YAC5D,IAAI;SACL,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;YACtC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAC5D,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1C,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanqory/plugin-sdk",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/tanqory/tanqory-platform-packages.git",

package/dist/manifest.schema.spec.d.ts

@@ -1,18 +0,0 @@
-/**
- * The JSON Schema and `parseAppManifest` must agree.
- *
- * `parseAppManifest` is hand-written on purpose — this package is installed by
- * strangers, and a schema library would be one more dependency they are asked to
- * trust. So the schema shipped for editors and agents cannot be derived from it;
- * it is written alongside, and would drift the moment anyone changed one and not
- * the other.
- *
- * This is what stops that. Every case runs through both, and the two must reach
- * the same verdict. A rule added to one and forgotten in the other fails here
- * rather than in someone's editor six weeks later, telling them a manifest is
- * fine that submission will reject.
- *
- * `ajv` is a devDependency. Nothing here ships.
- */
-export {};
-//# sourceMappingURL=manifest.schema.spec.d.ts.map

package/dist/manifest.schema.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.schema.spec.d.ts","sourceRoot":"","sources":["../src/manifest.schema.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/manifest.schema.spec.js

@@ -1,164 +0,0 @@
-"use strict";
-/**
- * The JSON Schema and `parseAppManifest` must agree.
- *
- * `parseAppManifest` is hand-written on purpose — this package is installed by
- * strangers, and a schema library would be one more dependency they are asked to
- * trust. So the schema shipped for editors and agents cannot be derived from it;
- * it is written alongside, and would drift the moment anyone changed one and not
- * the other.
- *
- * This is what stops that. Every case runs through both, and the two must reach
- * the same verdict. A rule added to one and forgotten in the other fails here
- * rather than in someone's editor six weeks later, telling them a manifest is
- * fine that submission will reject.
- *
- * `ajv` is a devDependency. Nothing here ships.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const ajv_1 = __importDefault(require("ajv"));
-const vitest_1 = require("vitest");
-const manifest_1 = require("./manifest");
-const schema = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '..', 'schema', 'tanqory-app.schema.json'), 'utf8'));
-const ajv = new ajv_1.default({ allErrors: true, strict: false });
-const validateWithSchema = ajv.compile(schema);
-const VALID = {
-    handle: 'order-notifier',
-    name: 'Order Notifier',
-    appUrl: 'https://order-notifier.example.com',
-    devUrl: 'http://localhost:3000',
-    embedded: { enabled: true, path: '/embed' },
-    scopes: ['orders.view'],
-    webhooks: [{ topic: 'orders/create', path: '/hooks/orders' }],
-};
-/** What each side says about the same input. */
-function verdicts(manifest) {
-    let validator = true;
-    try {
-        (0, manifest_1.parseAppManifest)(manifest);
-    }
-    catch {
-        validator = false;
-    }
-    return { schema: validateWithSchema(manifest), validator };
-}
-const cases = [
-    ['the scaffold default', VALID, true],
-    ['no devUrl', { ...VALID, devUrl: undefined }, true],
-    [
-        'a manifest with every optional field',
-        {
-            ...VALID,
-            supportUrl: 'https://example.com/support',
-            privacyPolicyUrl: 'https://example.com/privacy',
-            appType: 'embed',
-            navigation: { placement: 'orders', items: [{ label: 'Settings', path: '/embed/settings' }] },
-            iframe: { minHeight: 600, width: 'full' },
-        },
-        true,
-    ],
-    [
-        'notification capability with a dispatchUrl',
-        {
-            ...VALID,
-            provides: ['notification-channel:sms'],
-            notifications: { dispatchUrl: 'https://example.com/dispatch' },
-        },
-        true,
-    ],
-    ['an uppercase handle', { ...VALID, handle: 'OrderNotifier' }, false],
-    ['a handle with spaces', { ...VALID, handle: 'order notifier' }, false],
-    ['a leading hyphen in the handle', { ...VALID, handle: '-order' }, false],
-    ['no handle at all', { ...VALID, handle: undefined }, false],
-    ['an empty name', { ...VALID, name: '' }, false],
-    ['a plain http appUrl', { ...VALID, appUrl: 'http://example.com' }, false],
-    [
-        'a devUrl on plain http that is not localhost',
-        { ...VALID, devUrl: 'http://example.com' },
-        false,
-    ],
-    ['scopes as a string', { ...VALID, scopes: 'orders.view' }, false],
-    ['a duplicated scope', { ...VALID, scopes: ['orders.view', 'orders.view'] }, false],
-    [
-        'an embedded.path with no leading slash',
-        { ...VALID, embedded: { enabled: true, path: 'embed' } },
-        false,
-    ],
-    ['embedded.enabled as a string', { ...VALID, embedded: { enabled: 'yes' } }, false],
-    [
-        'a webhook path with no leading slash',
-        { ...VALID, webhooks: [{ topic: 'orders/create', path: 'hooks' }] },
-        false,
-    ],
-    ['a webhook with no topic', { ...VALID, webhooks: [{ path: '/hooks' }] }, false],
-    ['appType outside the enum', { ...VALID, appType: 'popup' }, false],
-    ['iframe.width outside the enum', { ...VALID, iframe: { width: 'wide' } }, false],
-    ['a negative iframe.minHeight', { ...VALID, iframe: { minHeight: -1 } }, false],
-    ['navigation with no placement', { ...VALID, navigation: { items: [] } }, false],
-    [
-        'a navigation item with no label',
-        { ...VALID, navigation: { placement: 'orders', items: [{ path: '/embed' }] } },
-        false,
-    ],
-    // The field that never existed but shipped in an early first-party manifest.
-    // Rejected by name so the fix is obvious rather than silently ignored.
-    ['the legacy embeddedPath field', { ...VALID, embeddedPath: '/embed' }, false],
-    // Taking over a notification with nowhere for it to go.
-    [
-        'a notification capability with no dispatchUrl',
-        { ...VALID, provides: ['notification-override:order_confirmation'] },
-        false,
-    ],
-    [
-        'a dispatchUrl on localhost',
-        {
-            ...VALID,
-            provides: ['notification-channel:sms'],
-            notifications: { dispatchUrl: 'http://localhost:3000/dispatch' },
-        },
-        false,
-    ],
-];
-(0, vitest_1.describe)('the JSON Schema agrees with parseAppManifest', () => {
-    vitest_1.it.each(cases)('%s', (_label, manifest, expected) => {
-        const { schema: bySchema, validator: byValidator } = verdicts(manifest);
-        // The assertion that matters is that they agree. Comparing both to the
-        // expectation separately would let a case pass while the two disagreed
-        // about why.
-        (0, vitest_1.expect)({ schema: bySchema, validator: byValidator }).toEqual({
-            schema: expected,
-            validator: expected,
-        });
-    });
-    (0, vitest_1.it)('lists every field the type declares, so a new one cannot be forgotten', () => {
-        // `additionalProperties: false` means a field added to the type but not to
-        // the schema is rejected by an editor while submission accepts it — the
-        // drift that is hardest to spot, because the tool is wrong and the platform
-        // is right.
-        const declared = Object.keys(schema.properties).sort();
-        (0, vitest_1.expect)(declared).toEqual([
-            '$schema',
-            'appType',
-            'appUrl',
-            'devUrl',
-            'embedded',
-            'embeddedPath',
-            'handle',
-            'iframe',
-            'name',
-            'navigation',
-            'notifications',
-            'privacyPolicyUrl',
-            'provides',
-            'scopes',
-            'supportUrl',
-            'webhooks',
-        ].sort());
-    });
-});
-//# sourceMappingURL=manifest.schema.spec.js.map

package/dist/manifest.schema.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.schema.spec.js","sourceRoot":"","sources":["../src/manifest.schema.spec.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;AAEH,qCAAsC;AACtC,yCAAgC;AAEhC,8CAAqB;AACrB,mCAA6C;AAE7C,yCAA6C;AAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CACjF,CAAA;AAED,MAAM,GAAG,GAAG,IAAI,aAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;AACvD,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAE9C,MAAM,KAAK,GAAG;IACZ,MAAM,EAAE,gBAAgB;IACxB,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,aAAa,CAAC;IACvB,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;CAC9D,CAAA;AAED,gDAAgD;AAChD,SAAS,QAAQ,CAAC,QAAiB;IACjC,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC;QACH,IAAA,2BAAgB,EAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,KAAK,CAAA;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAY,EAAE,SAAS,EAAE,CAAA;AACvE,CAAC;AAED,MAAM,KAAK,GAAsC;IAC/C,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,CAAC;IACrC,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC;IACpD;QACE,sCAAsC;QACtC;YACE,GAAG,KAAK;YACR,UAAU,EAAE,6BAA6B;YACzC,gBAAgB,EAAE,6BAA6B;YAC/C,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC5F,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE;SAC1C;QACD,IAAI;KACL;IACD;QACE,4CAA4C;QAC5C;YACE,GAAG,KAAK;YACR,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,aAAa,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE;SAC/D;QACD,IAAI;KACL;IAED,CAAC,qBAAqB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,KAAK,CAAC;IACrE,CAAC,sBAAsB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,CAAC;IACvE,CAAC,gCAAgC,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;IACzE,CAAC,kBAAkB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC;IAC5D,CAAC,eAAe,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC;IAChD,CAAC,qBAAqB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,CAAC;IAC1E;QACE,8CAA8C;QAC9C,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE;QAC1C,KAAK;KACN;IACD,CAAC,oBAAoB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC;IAClE,CAAC,oBAAoB,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC;IACnF;QACE,wCAAwC;QACxC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QACxD,KAAK;KACN;IACD,CAAC,8BAA8B,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC;IACnF;QACE,sCAAsC;QACtC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE;QACnE,KAAK;KACN;IACD,CAAC,yBAAyB,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC;IAChF,CAAC,0BAA0B,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC;IACnE,CAAC,+BAA+B,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC;IACjF,CAAC,6BAA6B,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC;IAC/E,CAAC,8BAA8B,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC;IAChF;QACE,iCAAiC;QACjC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;QAC9E,KAAK;KACN;IACD,6EAA6E;IAC7E,uEAAuE;IACvE,CAAC,+BAA+B,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC;IAC9E,wDAAwD;IACxD;QACE,+CAA+C;QAC/C,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,0CAA0C,CAAC,EAAE;QACpE,KAAK;KACN;IACD;QACE,4BAA4B;QAC5B;YACE,GAAG,KAAK;YACR,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,aAAa,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE;SACjE;QACD,KAAK;KACN;CACF,CAAA;AAED,IAAA,iBAAQ,EAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,WAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAClD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAEvE,uEAAuE;QACvE,uEAAuE;QACvE,aAAa;QACb,IAAA,eAAM,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAC3D,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,YAAY;QACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,OAAO,CACtB;YACE,SAAS;YACT,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,YAAY;YACZ,eAAe;YACf,kBAAkB;YAClB,UAAU;YACV,QAAQ;YACR,YAAY;YACZ,UAAU;SACX,CAAC,IAAI,EAAE,CACT,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/manifest.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=manifest.spec.d.ts.map

package/dist/manifest.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.spec.d.ts","sourceRoot":"","sources":["../src/manifest.spec.ts"],"names":[],"mappings":""}

package/dist/manifest.spec.js

@@ -1,193 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const manifest_1 = require("./manifest");
-const VALID = {
-    handle: 'order-notifier',
-    name: 'Order Notifier',
-    appUrl: 'https://order-notifier.example.com',
-    scopes: ['orders.view'],
-};
-/** Collect the problems without asserting on prose. */
-function problemsOf(input) {
-    try {
-        (0, manifest_1.parseAppManifest)(input);
-        return [];
-    }
-    catch (error) {
-        return error instanceof manifest_1.ManifestError ? error.problems : [String(error)];
-    }
-}
-(0, vitest_1.describe)('parseAppManifest', () => {
-    (0, vitest_1.it)('accepts a minimal manifest', () => {
-        (0, vitest_1.expect)((0, manifest_1.parseAppManifest)(VALID)).toMatchObject({ handle: 'order-notifier' });
-    });
-    (0, vitest_1.it)('reports every problem at once, not just the first', () => {
-        // A validator that stops at the first error turns a five-field mistake into
-        // five round trips — and this is the first thing a new developer runs.
-        const problems = problemsOf({ handle: 'Not Valid', appUrl: 'ftp://x', scopes: 'nope' });
-        (0, vitest_1.expect)(problems.length).toBeGreaterThanOrEqual(4);
-    });
-    (0, vitest_1.describe)('handle', () => {
-        vitest_1.it.each([
-            ['uppercase', 'OrderNotifier'],
-            ['spaces', 'order notifier'],
-            ['leading hyphen', '-order'],
-            ['double hyphen', 'order--notifier'],
-            ['empty', ''],
-        ])('rejects %s', (_label, handle) => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, handle })).not.toEqual([]);
-        });
-    });
-    (0, vitest_1.describe)('urls', () => {
-        (0, vitest_1.it)('requires https for appUrl', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, appUrl: 'http://example.com' })).not.toEqual([]);
-        });
-        (0, vitest_1.it)('allows http on localhost for devUrl only', () => {
-            // A merchant is never sent to devUrl, and demanding TLS on a laptop is
-            // friction with no payoff.
-            (0, vitest_1.expect)(problemsOf({ ...VALID, devUrl: 'http://localhost:3000' })).toEqual([]);
-            (0, vitest_1.expect)(problemsOf({ ...VALID, devUrl: 'http://evil.example.com' })).not.toEqual([]);
-        });
-    });
-    (0, vitest_1.describe)('scopes', () => {
-        (0, vitest_1.it)('rejects a duplicate', () => {
-            // Silently de-duplicating would make the consent screen and the manifest
-            // disagree about what was asked for.
-            (0, vitest_1.expect)(problemsOf({ ...VALID, scopes: ['orders.view', 'orders.view'] })).not.toEqual([]);
-        });
-        (0, vitest_1.it)('accepts an empty list', () => {
-            // An app that only renders UI needs no scopes, and forcing one would push
-            // developers to request something they do not use.
-            (0, vitest_1.expect)(problemsOf({ ...VALID, scopes: [] })).toEqual([]);
-        });
-    });
-    (0, vitest_1.describe)('webhooks', () => {
-        (0, vitest_1.it)('requires a topic and a rooted path', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, webhooks: [{ topic: '', path: 'no-slash' }] }).length).toBe(2);
-        });
-        (0, vitest_1.it)('accepts a well-formed subscription', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, webhooks: [{ topic: 'orders/create', path: '/hooks/orders' }] })).toEqual([]);
-        });
-    });
-    (0, vitest_1.it)('requires embedded.path to be rooted when present', () => {
-        (0, vitest_1.expect)(problemsOf({ ...VALID, embedded: { enabled: true, path: 'embed' } })).not.toEqual([]);
-        (0, vitest_1.expect)(problemsOf({ ...VALID, embedded: { enabled: true, path: '/embed' } })).toEqual([]);
-    });
-    (0, vitest_1.it)('does not throw on null or a non-object', () => {
-        (0, vitest_1.expect)(problemsOf(null)).not.toEqual([]);
-        (0, vitest_1.expect)(problemsOf('a string')).not.toEqual([]);
-    });
-    (0, vitest_1.describe)('manifest v2 — surface declaration', () => {
-        (0, vitest_1.it)('accepts a full v2 manifest', () => {
-            (0, vitest_1.expect)(problemsOf({
-                ...VALID,
-                appType: 'embed',
-                navigation: {
-                    placement: 'marketing',
-                    items: [
-                        { label: 'Campaigns', path: '/campaigns' },
-                        { label: 'Automations', path: '/automations' },
-                    ],
-                },
-                iframe: { minHeight: 480, width: 'full' },
-                provides: ['marketing-suite'],
-            })).toEqual([]);
-        });
-        (0, vitest_1.it)('a v1 manifest with none of the new fields stays valid unchanged', () => {
-            (0, vitest_1.expect)(problemsOf(VALID)).toEqual([]);
-        });
-        (0, vitest_1.it)('rejects the legacy top-level embeddedPath by name', () => {
-            const problems = problemsOf({ ...VALID, embeddedPath: '/embed' });
-            (0, vitest_1.expect)(problems.join(' ')).toContain('embeddedPath');
-            (0, vitest_1.expect)(problems.join(' ')).toContain('embedded: { enabled: true');
-        });
-        (0, vitest_1.it)('rejects an unknown appType', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, appType: 'popup' })).not.toEqual([]);
-        });
-        (0, vitest_1.it)('navigation.placement must be a slug; membership is enforced at review, not here', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, navigation: { placement: 'Not A Slug' } })).not.toEqual([]);
-            // Shape-valid but not a known slot today — the SDK passes it so a new
-            // platform slot never requires an SDK release; review owns the list.
-            (0, vitest_1.expect)(problemsOf({ ...VALID, navigation: { placement: 'future_slot' } })).toEqual([]);
-        });
-        (0, vitest_1.it)('navigation items need a label and a rooted, traversal-free path', () => {
-            const problems = problemsOf({
-                ...VALID,
-                navigation: { placement: 'marketing', items: [{ label: '', path: '/a/../b' }] },
-            });
-            (0, vitest_1.expect)(problems.length).toBe(2);
-        });
-        (0, vitest_1.it)('iframe constraints: positive minHeight, width from the pair', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, iframe: { minHeight: -1 } })).not.toEqual([]);
-            (0, vitest_1.expect)(problemsOf({ ...VALID, iframe: { width: 'wide' } })).not.toEqual([]);
-            (0, vitest_1.expect)(problemsOf({ ...VALID, iframe: { minHeight: 320, width: 'centered' } })).toEqual([]);
-        });
-        (0, vitest_1.it)('provides entries are slugs, no duplicates', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, provides: ['Marketing Suite'] })).not.toEqual([]);
-            (0, vitest_1.expect)(problemsOf({ ...VALID, provides: ['marketing-suite', 'marketing-suite'] })).not.toEqual([]);
-            (0, vitest_1.expect)(problemsOf({ ...VALID, provides: ['marketing-suite'] })).toEqual([]);
-        });
-    });
-    (0, vitest_1.describe)('notification capabilities', () => {
-        const NOTIFY = { dispatchUrl: 'https://hooks.example.com/tanqory/notifications' };
-        (0, vitest_1.it)('accepts an override and a channel alongside a plain capability', () => {
-            (0, vitest_1.expect)(problemsOf({
-                ...VALID,
-                provides: [
-                    'marketing-suite',
-                    'notification-override:order_new',
-                    'notification-channel:line',
-                ],
-                notifications: NOTIFY,
-            })).toEqual([]);
-        });
-        (0, vitest_1.it)('passes an unknown type or channel name — that vocabulary is the platform’s', () => {
-            // Shape-valid but not in today's registry. The SDK lets it through for
-            // the same reason it lets an unknown nav placement through: the list
-            // lives server-side and must grow without an SDK release.
-            (0, vitest_1.expect)(problemsOf({
-                ...VALID,
-                provides: ['notification-override:some_future_type'],
-                notifications: NOTIFY,
-            })).toEqual([]);
-        });
-        (0, vitest_1.it)('rejects an unknown capability family', () => {
-            const problems = problemsOf({
-                ...VALID,
-                provides: ['notification-takeover:order_new'],
-                notifications: NOTIFY,
-            });
-            (0, vitest_1.expect)(problems.join(' ')).toContain('notification-takeover');
-            (0, vitest_1.expect)(problems.join(' ')).toContain('notification-override:<name>');
-        });
-        vitest_1.it.each([
-            ['an empty name', 'notification-override:'],
-            ['an uppercase name', 'notification-channel:LINE'],
-            ['a spaced name', 'notification-override:order new'],
-            ['a second colon', 'notification-override:order:new'],
-        ])('rejects %s', (_label, capability) => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, provides: [capability], notifications: NOTIFY })).not.toEqual([]);
-        });
-        (0, vitest_1.it)('requires a dispatchUrl once a notification capability is declared', () => {
-            // A takeover with nowhere to deliver drops every message it claimed —
-            // the one failure mode a merchant would never see in the UI.
-            const problems = problemsOf({ ...VALID, provides: ['notification-override:order_new'] });
-            (0, vitest_1.expect)(problems.join(' ')).toContain('notifications.dispatchUrl');
-        });
-        (0, vitest_1.it)('does not require a dispatchUrl for a plain capability', () => {
-            (0, vitest_1.expect)(problemsOf({ ...VALID, provides: ['marketing-suite'] })).toEqual([]);
-        });
-        vitest_1.it.each([
-            ['http', 'http://hooks.example.com/n'],
-            ['localhost', 'https://localhost:3000/n'],
-            ['a loopback ip', 'https://127.0.0.1/n'],
-            ['not a URL at all', '/notifications'],
-        ])('rejects a dispatchUrl on %s', (_label, dispatchUrl) => {
-            // Unlike `devUrl`, this URL is called BY Tanqory. A laptop address here
-            // is one nothing can ever reach, so it is refused rather than tolerated.
-            (0, vitest_1.expect)(problemsOf({ ...VALID, notifications: { dispatchUrl } })).not.toEqual([]);
-        });
-    });
-});
-//# sourceMappingURL=manifest.spec.js.map

package/dist/manifest.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.spec.js","sourceRoot":"","sources":["../src/manifest.spec.ts"],"names":[],"mappings":";;AAAA,mCAA6C;AAE7C,yCAA4D;AAE5D,MAAM,KAAK,GAAG;IACZ,MAAM,EAAE,gBAAgB;IACxB,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,CAAC,aAAa,CAAC;CACxB,CAAA;AAED,uDAAuD;AACvD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC;QACH,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,wBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,IAAA,eAAM,EAAC,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,IAAA,eAAM,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,WAAE,CAAC,IAAI,CAAC;YACN,CAAC,WAAW,EAAE,eAAe,CAAC;YAC9B,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAC5B,CAAC,gBAAgB,EAAE,QAAQ,CAAC;YAC5B,CAAC,eAAe,EAAE,iBAAiB,CAAC;YACpC,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAClC,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,MAAM,EAAE,GAAG,EAAE;QACpB,IAAA,WAAE,EAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAChF,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,uEAAuE;YACvE,2BAA2B;YAC3B,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7E,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACrF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,IAAA,WAAE,EAAC,qBAAqB,EAAE,GAAG,EAAE;YAC7B,yEAAyE;YACzE,qCAAqC;YACrC,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,0EAA0E;YAC1E,mDAAmD;YACnD,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,UAAU,EAAE,GAAG,EAAE;QACxB,IAAA,WAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9F,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,IAAA,eAAM,EACJ,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CACxF,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5F,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,IAAA,eAAM,EAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxC,IAAA,eAAM,EAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,mCAAmC,EAAE,GAAG,EAAE;QACjD,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,IAAA,eAAM,EACJ,UAAU,CAAC;gBACT,GAAG,KAAK;gBACR,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE;oBACV,SAAS,EAAE,WAAW;oBACtB,KAAK,EAAE;wBACL,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE;wBAC1C,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;qBAC/C;iBACF;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE;gBACzC,QAAQ,EAAE,CAAC,iBAAiB,CAAC;aAC9B,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,IAAA,eAAM,EAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;YACjE,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;YACpD,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;QACnE,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,iFAAiF,EAAE,GAAG,EAAE;YACzF,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzF,sEAAsE;YACtE,qEAAqE;YACrE,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxF,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,GAAG,KAAK;gBACR,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;aAChF,CAAC,CAAA;YACF,IAAA,eAAM,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC/E,IAAA,eAAM,EACJ,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAC3E,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACjB,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAA;QAEjF,IAAA,WAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;YACxE,IAAA,eAAM,EACJ,UAAU,CAAC;gBACT,GAAG,KAAK;gBACR,QAAQ,EAAE;oBACR,iBAAiB;oBACjB,iCAAiC;oBACjC,2BAA2B;iBAC5B;gBACD,aAAa,EAAE,MAAM;aACtB,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;YACpF,uEAAuE;YACvE,qEAAqE;YACrE,0DAA0D;YAC1D,IAAA,eAAM,EACJ,UAAU,CAAC;gBACT,GAAG,KAAK;gBACR,QAAQ,EAAE,CAAC,wCAAwC,CAAC;gBACpD,aAAa,EAAE,MAAM;aACtB,CAAC,CACH,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,GAAG,KAAK;gBACR,QAAQ,EAAE,CAAC,iCAAiC,CAAC;gBAC7C,aAAa,EAAE,MAAM;aACtB,CAAC,CAAA;YACF,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC7D,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;QAEF,WAAE,CAAC,IAAI,CAAC;YACN,CAAC,eAAe,EAAE,wBAAwB,CAAC;YAC3C,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;YAClD,CAAC,eAAe,EAAE,iCAAiC,CAAC;YACpD,CAAC,gBAAgB,EAAE,iCAAiC,CAAC;SACtD,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YACtC,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CACzF,EAAE,CACH,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;YAC3E,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACxF,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;QACnE,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QAEF,WAAE,CAAC,IAAI,CAAC;YACN,CAAC,MAAM,EAAE,4BAA4B,CAAC;YACtC,CAAC,WAAW,EAAE,0BAA0B,CAAC;YACzC,CAAC,eAAe,EAAE,qBAAqB,CAAC;YACxC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;SACvC,CAAC,CAAC,6BAA6B,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;YACxD,wEAAwE;YACxE,yEAAyE;YACzE,IAAA,eAAM,EAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/webhooks.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=webhooks.spec.d.ts.map

package/dist/webhooks.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.spec.d.ts","sourceRoot":"","sources":["../src/webhooks.spec.ts"],"names":[],"mappings":""}

package/dist/webhooks.spec.js

@@ -1,74 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const node_crypto_1 = require("node:crypto");
-const vitest_1 = require("vitest");
-const webhooks_1 = require("./webhooks");
-/**
- * This function is the only thing standing between an app's webhook handler and
- * anyone on the internet who knows its URL. Every case below is a way that
- * boundary gets crossed by an implementation that "looks right".
- */
-const SECRET = 'whsec_test';
-const BODY = '{"event":"orders/create","data":{"id":"ord_1"}}';
-function sign(body, timestamp, secret = SECRET) {
-    const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(`${timestamp}.${body}`).digest('hex');
-    return `t=${timestamp},v1=${signature}`;
-}
-const NOW = 1_700_000_000_000;
-const now = () => NOW;
-const nowSeconds = Math.floor(NOW / 1000);
-(0, vitest_1.describe)('verifyWebhookSignature', () => {
-    (0, vitest_1.it)('accepts a correctly signed, fresh payload', () => {
-        (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, sign(BODY, nowSeconds), SECRET, { now })).toBe(true);
-    });
-    (0, vitest_1.it)('rejects a body that changed after signing', () => {
-        const header = sign(BODY, nowSeconds);
-        const tampered = BODY.replace('ord_1', 'ord_999');
-        (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(tampered, header, SECRET, { now })).toBe(false);
-    });
-    (0, vitest_1.it)('rejects a signature made with a different secret', () => {
-        const header = sign(BODY, nowSeconds, 'whsec_someone_elses');
-        (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, header, SECRET, { now })).toBe(false);
-    });
-    (0, vitest_1.describe)('replay', () => {
-        (0, vitest_1.it)('rejects a payload older than the tolerance', () => {
-            // Without this, a captured delivery verifies forever.
-            const header = sign(BODY, nowSeconds - 301);
-            (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, header, SECRET, { now })).toBe(false);
-        });
-        (0, vitest_1.it)('accepts one just inside the tolerance', () => {
-            const header = sign(BODY, nowSeconds - 299);
-            (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, header, SECRET, { now })).toBe(true);
-        });
-        (0, vitest_1.it)('rejects a timestamp in the future', () => {
-            // Not a clock problem to be generous about — a future timestamp means
-            // someone chose it.
-            const header = sign(BODY, nowSeconds + 301);
-            (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, header, SECRET, { now })).toBe(false);
-        });
-    });
-    (0, vitest_1.describe)('malformed input is rejected, never thrown on', () => {
-        // A handler that 500s on a malformed header tells an attacker their probe
-        // reached real code. Every one of these must simply be false.
-        const bad = [
-            ['missing header', null],
-            ['empty header', ''],
-            ['no timestamp', 'v1=abc'],
-            ['no signature', `t=${nowSeconds}`],
-            ['non-numeric timestamp', 't=not-a-number,v1=abc'],
-            ['garbage', 'nonsense'],
-        ];
-        vitest_1.it.each(bad)('rejects %s', (_label, header) => {
-            (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, header, SECRET, { now })).toBe(false);
-        });
-        (0, vitest_1.it)('rejects when no secret is configured', () => {
-            (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, sign(BODY, nowSeconds), '', { now })).toBe(false);
-        });
-    });
-    (0, vitest_1.it)('rejects a signature of the right shape but the wrong length', () => {
-        // Guards the constant-time compare: a length mismatch must return false,
-        // not throw, or the throw itself becomes the timing signal.
-        (0, vitest_1.expect)((0, webhooks_1.verifyWebhookSignature)(BODY, `t=${nowSeconds},v1=abc`, SECRET, { now })).toBe(false);
-    });
-});
-//# sourceMappingURL=webhooks.spec.js.map

package/dist/webhooks.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.spec.js","sourceRoot":"","sources":["../src/webhooks.spec.ts"],"names":[],"mappings":";;AAAA,6CAAwC;AAExC,mCAA6C;AAE7C,yCAAmD;AAEnD;;;;GAIG;AAEH,MAAM,MAAM,GAAG,YAAY,CAAA;AAC3B,MAAM,IAAI,GAAG,iDAAiD,CAAA;AAE9D,SAAS,IAAI,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAM,GAAG,MAAM;IAC5D,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3F,OAAO,KAAK,SAAS,OAAO,SAAS,EAAE,CAAA;AACzC,CAAC;AAED,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAA;AACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AAEzC,IAAA,iBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACjD,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAA;QAC5D,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,IAAA,WAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,sDAAsD;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;YAC3C,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3E,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;YAC3C,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,sEAAsE;YACtE,oBAAoB;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;YAC3C,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,iBAAQ,EAAC,8CAA8C,EAAE,GAAG,EAAE;QAC5D,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,GAAG,GAAG;YACV,CAAC,gBAAgB,EAAE,IAAI,CAAC;YACxB,CAAC,cAAc,EAAE,EAAE,CAAC;YACpB,CAAC,cAAc,EAAE,QAAQ,CAAC;YAC1B,CAAC,cAAc,EAAE,KAAK,UAAU,EAAE,CAAC;YACnC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;YAClD,CAAC,SAAS,EAAE,UAAU,CAAC;SACf,CAAA;QAEV,WAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5C,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3E,CAAC,CAAC,CAAA;QAEF,IAAA,WAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,yEAAyE;QACzE,4DAA4D;QAC5D,IAAA,eAAM,EAAC,IAAA,iCAAsB,EAAC,IAAI,EAAE,KAAK,UAAU,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}