hermoso 0.1.461 → 0.1.463

package/README.md

@@ -5,7 +5,7 @@ scripts. Research the ads already winning in a market, generate image & video ad
 composited in, copy + CTA included), publish them to your own social channels, and build & manage the ad
 campaigns behind them, all over [MCP](https://modelcontextprotocol.io) tools, a CLI, or installable Claude skills.
 
-**1037 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
+**1090 tools.** `tools/list` is always the authoritative set; `hermoso_capabilities` (free) returns the live model
 catalog with exact per-render credit costs plus the full capability map.
 
 **No markup on models.** Stop overpaying markups on AI models. Plans: [hermoso.ai/pricing](https://hermoso.ai/pricing).
@@ -242,7 +242,7 @@ block entirely if you signed in above; it is there for CI, where the process can
 
 Then ask your agent: *“Generate an image ad with Hermoso.”*
 
-### What the 1037 tools cover
+### What the 1090 tools cover
 
 **Ad spy / research** — `find_competitors`, `competitor_teardown`, `pull_competitor_ads`, `research_ads`; the
 Meta / Google / LinkedIn ad libraries (`search_meta_ads`, `search_google_ads`, `search_linkedin_ads`); organic

package/mcp/client.mjs

@@ -423,7 +423,10 @@ export async function connectedProviders() {
     const connectLink = typeof r?.connectLink === 'string' && r.connectLink.includes('{provider}') ? r.connectLink : '';
     // withheld: tools the server does not offer right now (roster-scope.mjs toolWithheldByServer). Absent = none.
     const withheld = new Set((Array.isArray(r?.withheld) ? r.withheld : []).filter((n) => typeof n === 'string' && n));
-    return { connected: new Set(list.filter((p) => typeof p === 'string' && p)), readOk: true, offered, gated, connectLink, withheld };
+    // shopifyStore (2026-10-27): true/false when the server could tell whether this account has a Shopify store;
+    // anything else is null = unknown, which holds nothing back (roster-scope.mjs toolHeldForNoShopifyStore).
+    const shopifyStore = r?.shopifyStore === true ? true : r?.shopifyStore === false ? false : null;
+    return { connected: new Set(list.filter((p) => typeof p === 'string' && p)), readOk: true, offered, gated, connectLink, withheld, shopifyStore };
   } catch { return { connected: new Set(), readOk: false }; }
 }
 // Upload raw file BYTES to /api/upload (150MB, persists → returns {url,kind,bytes}). Overrides the JSON content-type so

package/mcp/openai-extensions.mjs

@@ -1274,7 +1274,7 @@ const PROVIDER_INFO = {
   openai_ads: ['ChatGPT Ads', 'ads'], apple_ads: ['Apple Ads', 'ads'], applovin_ads: ['AppLovin Ads', 'ads'],
   google_drive: ['Google Drive, Sheets and Docs', 'data'], onedrive: ['OneDrive', 'data'], google_analytics: ['Google Analytics', 'data'],
   search_console: ['Google Search Console', 'data'], merchant_center: ['Google Merchant Center', 'data'], slack: ['Slack', 'data'],
-  shopify: ['Shopify', 'data'], stripe: ['Stripe', 'data'], hubspot: ['HubSpot', 'data'], notion: ['Notion', 'data'],
+  shopify: ['Shopify', 'data'], stripe: ['Stripe', 'data'], hubspot: ['HubSpot', 'data'], notion: ['Notion', 'data'], canva: ['Canva', 'data'],
 };
 export const providerInfo = (p) => {
   const hit = PROVIDER_INFO[p];

package/mcp/roster-scope.mjs

@@ -101,6 +101,8 @@ export const TOOL_PROVIDER_RULES = [
   [/vercel/, 'vercel'],
   // Notion (2026-10-25): the user's OWN Notion workspace, offered only to a workspace that connected it.
   [/notion/, 'notion'],
+  // Canva (2026-10-27): the user's OWN Canva, offered only to a workspace that connected it.
+  [/canva/, 'canva'],
   // ── posting-only channels ──
   [/youtube/, 'youtube'],
   [/google_business|business_location|^list_business_(categories|attributes)$|^business_google_updated$/, 'google_business'],
@@ -170,7 +172,20 @@ export const metaAlternativeNote = (name) => INSTAGRAM_LOGIN_TOOLS.has(String(na
 // creator marketplace trio while META_CREATOR_MARKETPLACE_SCOPE is off). ONE server flag decides it, so flipping the
 // env var lights every surface back up with no code change. Absent or unreadable = nothing withheld (fail open, like
 // every other read of this set); a withheld tool is held like a connector-gated one and answered as 'unavailable'.
-export function toolWithheldByServer(name, conn) { return !!(conn && conn.withheld instanceof Set && conn.withheld.has(String(name || ''))); }
+// ── SHOPIFY IS AN ACCOUNT TYPE, NOT A CONNECTOR (2026-10-27) ────────────────────────────────────────────────────────
+// The Shopify tools (list_shopify_products, publish_to_shopify_product, the marketing-activity tools) work only for an
+// account created by installing Hermoso from the Shopify App Store: the store is derived server-side from the verified
+// account and there is no "connect Shopify" tile. So they cannot ride TOOL_PROVIDER_RULES — every provider there must
+// be a CONNECTOR_INFO key (property 3), and "connect it under Settings ▸ Connectors" would be a dead end. Instead the
+// same /api/connectors/providers read answers `shopifyStore`: true (this account has a live store), false (it does not,
+// or Shopify is off on this deployment), or absent when the server could not tell. ONLY a definite false holds them
+// back — an unreadable answer keeps them, like every other read of this set (property 1). Held, they are answered by
+// their own reason ('shopify_store'), never as "not available in Hermoso yet".
+export const SHOPIFY_STORE_TOOL_RE = /shopify/;
+export const toolNeedsShopifyStore = (name) => SHOPIFY_STORE_TOOL_RE.test(String(name || ''));
+export function toolHeldForNoShopifyStore(name, conn) { return !!(conn && conn.shopifyStore === false && toolNeedsShopifyStore(name)); }
+export const SHOPIFY_STORE_NOTE = 'works only for a Shopify store that installed Hermoso from the Shopify App Store, and this account has no linked store. An existing Hermoso account cannot be linked to a store from here; a merchant who did install it opens Hermoso once from their Shopify admin (Apps \u2192 Hermoso).';
+export function toolWithheldByServer(name, conn) { return !!(conn && ((conn.withheld instanceof Set && conn.withheld.has(String(name || ''))) || toolHeldForNoShopifyStore(name, conn))); }
 export function toolHeldBackByConnectors(name, conn) {
   if (toolWithheldByServer(name, conn)) return true;              // the server says this capability is not offered now
   if (!conn || !conn.readOk) return false;                       // property 1 — fail OPEN on an unreadable store