sdk: release 0.9.4

Author: Krablante

API_COVERAGE.md

@@ -103,24 +103,24 @@ These routes were confirmed live during the 2026-03-07 recon sweep:
 | `/listings?limit=5&min_ref_qty=20&type=buy_now&min_price=500` | `GET` | implemented | browser UI + live | current homepage-highlight feed shape; exposed via `listings.getListings(getHomepageFeedParams("top_deals"))` and `workflows.getPublicMarketFeeds()` |
 | `/listings?limit=5&sort_by=most_recent&min_ref_qty=20&type=buy_now&min_price=500` | `GET` | implemented | browser UI + live | current homepage `Newest Items` feed shape; exposed via `listings.getListings(getHomepageFeedParams("newest"))` and `workflows.getPublicMarketFeeds()` |
 | `/listings?limit=5&sort_by=most_recent&filter=unique&min_ref_qty=20&type=buy_now&min_price=500` | `GET` | implemented | browser UI + live | current homepage `Unique Items` feed shape; exposed via `listings.getListings(getHomepageFeedParams("unique"))` and `workflows.getPublicMarketFeeds()` |
-| `/listings?filter=sticker_combos` | `GET` | discovered | live + browser UI + auth API | UI label `Sticker Combos`; requires auth; current live probes return sticker-heavy rows |
-| `/listings?filter=unique` | `GET` | discovered | live + browser UI + auth API | UI label `Unique Items`; requires auth |
+| `/listings?filter=sticker_combos` | `GET` | implemented | live + browser UI + auth API | UI label `Sticker Combos`; requires auth; current SDK exposes this through the typed `filter` param on `listings.getListings()` |
+| `/listings?filter=unique` | `GET` | implemented | live + browser UI + auth API | UI label `Unique Items`; current SDK exposes this through the typed `filter` param on `listings.getListings()` |
 | `/listings/{auction_id}/bids` | `GET` | implemented | live | returns bid array for auction listings; empty array when no bids |
 | `/buy-orders/item` | `GET` | implemented | browser bundle + live | inspect-link oriented route using query params `{ url:<inspectLink>, limit }`; live happy-path returned an array like `[{ expression, qty, price }]` |
 | `/buy-orders/matching-items/floatdb` | `POST` | discovered | browser bundle + live invalid probe | route exists but currently demands float-expression semantics; plain `market_hash_name` returned `condition and rules are required for an expression` |
-| `/trades/{id}/cannot-deliver` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; likely seller-side failure path, not executed happy-path due risk |
-| `/trades/{id}/dispute` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; not exercised on a real trade |
-| `/trades/{id}/received` | `POST` | discovered | browser bundle + live | real pending buyer-side trade returned `400 missing steam offer ID`; route and state gating are clear, but no successful live sample yet |
+| `/trades/{id}/cannot-deliver` | `POST` | implemented | browser bundle + live invalid probe | frontend-confirmed no-body payload; SDK exposes `account.cannotDeliverTrade()` as a low-level, seller-side failure helper |
+| `/trades/{id}/dispute` | `POST` | implemented | browser bundle + live invalid probe | frontend-confirmed no-body payload; SDK exposes `account.disputeTrade()` conservatively as a low-level dispute helper |
+| `/trades/{id}/received` | `POST` | implemented | browser bundle + live | frontend-confirmed no-body payload; real pending buyer-side trade returned `400 missing steam offer ID`, so the SDK keeps `account.markTradeReceived()` intentionally low-level and state-gated |
 | `/trades/bulk/received` | `POST` | implemented | browser bundle + live | bundle-confirmed buyer flow using `{ trade_ids }`; invalid `trade_ids:["0"]` returned `400 invalid trade ids specified`, and a real pending buyer-side trade returned `400 missing steam offer ID` until a Steam offer exists |
-| `/trades/{id}/rollback` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; semantics still unmapped |
-| `/trades/{id}/manual-verification` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; semantics still unmapped |
-| `/trades/{id}/rollback-verify` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; semantics still unmapped |
+| `/trades/{id}/rollback` | `POST` | implemented | browser bundle + live invalid probe | frontend-confirmed no-body payload; SDK exposes `account.rollbackTrade()` conservatively because the happy-path remains trade-state-specific |
+| `/trades/{id}/manual-verification` | `POST` | implemented | browser bundle + live invalid probe | frontend-confirmed no-body payload; SDK exposes `account.manualVerifyTrade()` as a low-level helper |
+| `/trades/{id}/rollback-verify` | `POST` | implemented | browser bundle + live invalid probe | frontend-confirmed no-body payload; SDK exposes `account.verifyTradeRollback()` as a low-level helper |
 | `/trades/{id}/report-error` | `POST` | discovered | browser bundle + live invalid probe | invalid `id=0` returned `500 record not found`; likely support/reporting path |
 | `/trades/notary` | `POST` | discovered | browser bundle + live invalid probe | empty payload returned `400 payload is required`; exact contract still unmapped |
-| `/me/verify-sms` | `POST` | discovered | live + public wrapper source | invalid phone number returned Twilio validation error |
-| `/trades/steam-status/new-offer` | `POST` | implemented | live + public wrapper source | low-level Steam sync route keyed by string-form `{ offer_id }`; safe live probes returned `200 {"message":"successfully updated offer state"}` even for `"0"`, but business side effects remain partially unmapped |
+| `/me/verify-email` | `POST` | implemented | browser bundle + live invalid probe | invalid `email=not-an-email` returned `400 invalid email format`; SDK exposes `account.verifyEmail()` as a low-level request/confirm helper |
+| `/me/verify-sms` | `POST` | implemented | browser bundle + live invalid probe | invalid `phone_number=abc` returned `400 twilio: Invalid phone number: abc`; SDK exposes `account.verifySms()` as a low-level request/confirm helper |
+| `/trades/steam-status/new-offer` | `POST` | implemented | live + browser bundle | low-level Steam sync route keyed by `{ offer_id }`, with the current frontend also sending optional `{ given_asset_ids, received_asset_ids }`; safe live probes returned `200 {"message":"successfully updated offer state"}` even for `"0"` |
 | `/trades/steam-status/offer` | `POST` | implemented | live + public wrapper source | low-level Steam sync route accepting `{ sent_offers }` and optional `{ trade_id }`; safe live probes returned `200 {"message":"successfully updated offer state"}`, while empty-array syncs produced no observed trade-state change |
-| `/me` with `trade_url` PATCH field | `PATCH` | discovered | live + public wrapper source | invalid payload returned `missing partner id or token in trade url`, confirming field-level validation for `trade_url` |
 ## Likely Stale Or Wrapper-Only Routes
 
 These routes appeared in public wrappers, but live probing on 2026-03-07 did not confirm them:

CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on Keep a Changelog.
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-03-11
+
+### Added
+
+1. low-level trade lifecycle helpers for the browser-confirmed single-trade routes: `account.cannotDeliverTrade()`, `account.disputeTrade()`, `account.markTradeReceived()`, `account.rollbackTrade()`, `account.manualVerifyTrade()`, and `account.verifyTradeRollback()`
+2. low-level account verification helpers `account.verifyEmail()` and `account.verifySms()` based on current frontend payload shapes plus live invalid-payload validation
+3. a public Vercel-ready docs site under `website/`, including the synced repository Markdown hub, search, sitemap, robots, and the refined dark-gold documentation shell
+
+### Changed
+
+1. widened `CsfloatTradeSteamStatusNewOfferRequest` and `account.syncSteamNewOffer()` to support the current frontend's optional `given_asset_ids` / `received_asset_ids` annotation payload
+2. reconciled stale coverage rows so `filter=sticker_combos`, `filter=unique`, and `PATCH /me` with `trade_url` are no longer left as discovered-only when the SDK already supports them
+3. promoted the browser-confirmed low-level trade lifecycle routes from discovered-only to implemented while keeping their docs explicitly conservative and state-gated
+4. widened response typing again after a slow live shape-audit pass: notifications now expose `latest_notification_id`, inspect-linked buy-order lookups can surface `market_hash_name`, and listing/trade keychain payloads can carry `highlight_reel`
+5. strengthened `audit:shapes` with slower default pacing, explicit skip support for state-driven routes, token-helper coverage, and better inspect-link selection for `buy-orders/item` / checker probes
+6. expanded the package docs and docs-site content so the runtime surface, write payloads, stability notes, and low-level account/trade helpers stay synchronized in one source of truth
+7. refined the docs-site UI with a calmer landing page, better sidebar collapse behavior, custom scrollbar styling, and a wide-screen max-width cap for large displays
+
 ## [0.9.3] - 2026-03-10
 
 ### Changed

README.md

@@ -19,7 +19,7 @@ The project is intentionally conservative about claims. Anything called `impleme
 
 > The goal is simple: be the SDK you reach for first if you want serious CSFloat automation instead of a thin wrapper.
 >
-> Install from npm: [`csfloat-node-sdk@0.9.3`](https://www.npmjs.com/package/csfloat-node-sdk)
+> Install from npm: [`csfloat-node-sdk@0.9.4`](https://www.npmjs.com/package/csfloat-node-sdk)
 
 ## Documentation
 
@@ -81,8 +81,9 @@ This SDK is optimized for:
 
 - live-confirmed offer flows: create, counter, cancel, decline, history, plus a low-level `acceptOffer()` helper for the browser-observed accept route
 - live-confirmed purchase flows: direct `buyNow`, buy-order create/update/delete, seller-side `acceptSale`
-- state-gated trade lifecycle helpers, including seller-side `acceptSale()` and buyer-side `markTradesReceived()`
-- low-level trade sync helpers for the browser-observed Steam status routes: `syncSteamNewOffer()` and `syncSteamOffers()`
+- state-gated trade lifecycle helpers, including seller-side `acceptSale()`, buyer-side `markTradesReceived()`, and low-level single-trade helpers such as `markTradeReceived()`, `cannotDeliverTrade()`, and `rollbackTrade()`
+- low-level trade sync helpers for the browser-observed Steam status routes: `syncSteamNewOffer()` and `syncSteamOffers()`, with optional asset-annotation payloads on the new-offer route
+- low-level account verification helpers for `verifyEmail()` and `verifySms()`
 - live-confirmed buy-order insight flows: inspect-based lookup and similar-order discovery
 - live-confirmed buy-order expression workflows via `account.createBuyOrder({ expression, ... })`, `account.getSimilarBuyOrders({ expression }, ...)`, and composable builder helpers
 - workflow-first helpers via `sdk.workflows` for public feed snapshots, account workspace snapshots, and single-skin buy-order insights
@@ -123,7 +124,7 @@ See [API_COVERAGE.md](./API_COVERAGE.md) for the endpoint-by-endpoint support ma
 | Area | Status | Methods |
 |---|---|---|
 | Meta | implemented | `meta.getSchema()`, `meta.getSchemaBrowse()`, `meta.getItemExampleScreenshot()`, `meta.inspectItem()`, `meta.getExchangeRates()`, `meta.getApp()`, `meta.getLocation()`, `meta.getNotary()` |
-| Account | implemented | `account.getMe()`, `account.getTrades()`, `account.getTrade()`, `account.getTradeBuyerDetails()`, `account.syncSteamNewOffer()`, `account.syncSteamOffers()`, `account.acceptTrades()`, `account.markTradesReceived()`, `account.acceptTrade()`, `account.acceptSale()`, `account.cancelTrades()`, `account.cancelTrade()`, `account.cancelSale()`, `account.getOffers()`, `account.createOffer()`, `account.getOffer()`, `account.acceptOffer()`, `account.getOfferHistory()`, `account.counterOffer()`, `account.cancelOffer()`, `account.declineOffer()`, `account.getWatchlist()`, `account.iterateWatchlist()`, `account.getOffersTimeline()`, `account.getNotifications()`, `account.getTransactions()`, `account.exportTransactions()`, `account.getAccountStanding()`, `account.getBuyOrders()`, `account.getBuyOrdersForInspect()`, `account.getSimilarBuyOrders()`, `account.createBuyOrder()`, `account.updateBuyOrder()`, `account.deleteBuyOrder()`, `account.getAutoBids()`, `account.deleteAutoBid()`, `account.createRecommenderToken()`, `account.createNotaryToken()`, `account.createGsInspectToken()`, `account.getMaxWithdrawable()`, `account.getPendingDeposits()`, `account.getPendingWithdrawals()`, `account.deletePendingWithdrawal()`, `account.getExtensionStatus()`, `account.getMobileStatus()`, `account.updateMe()`, `account.setOffersEnabled()`, `account.setStallPublic()`, `account.setAway()`, `account.setMaxOfferDiscount()`, `account.updateTradeUrl()`, `account.updateBackground()`, `account.updateUsername()`, `account.markNotificationsRead()`, `account.setMobileStatus()` |
+| Account | implemented | `account.getMe()`, `account.getTrades()`, `account.getTrade()`, `account.getTradeBuyerDetails()`, `account.cannotDeliverTrade()`, `account.disputeTrade()`, `account.syncSteamNewOffer()`, `account.syncSteamOffers()`, `account.acceptTrades()`, `account.markTradesReceived()`, `account.markTradeReceived()`, `account.acceptTrade()`, `account.acceptSale()`, `account.cancelTrades()`, `account.cancelTrade()`, `account.cancelSale()`, `account.rollbackTrade()`, `account.manualVerifyTrade()`, `account.verifyTradeRollback()`, `account.getOffers()`, `account.createOffer()`, `account.getOffer()`, `account.acceptOffer()`, `account.getOfferHistory()`, `account.counterOffer()`, `account.cancelOffer()`, `account.declineOffer()`, `account.getWatchlist()`, `account.iterateWatchlist()`, `account.getOffersTimeline()`, `account.getNotifications()`, `account.getTransactions()`, `account.exportTransactions()`, `account.getAccountStanding()`, `account.getBuyOrders()`, `account.getBuyOrdersForInspect()`, `account.getSimilarBuyOrders()`, `account.createBuyOrder()`, `account.updateBuyOrder()`, `account.deleteBuyOrder()`, `account.getAutoBids()`, `account.deleteAutoBid()`, `account.createRecommenderToken()`, `account.createNotaryToken()`, `account.createGsInspectToken()`, `account.getMaxWithdrawable()`, `account.getPendingDeposits()`, `account.getPendingWithdrawals()`, `account.deletePendingWithdrawal()`, `account.getExtensionStatus()`, `account.getMobileStatus()`, `account.verifyEmail()`, `account.verifySms()`, `account.updateMe()`, `account.setOffersEnabled()`, `account.setStallPublic()`, `account.setAway()`, `account.setMaxOfferDiscount()`, `account.updateTradeUrl()`, `account.updateBackground()`, `account.updateUsername()`, `account.markNotificationsRead()`, `account.setMobileStatus()` |
 | Inventory | implemented | `inventory.getInventory()` |
 | Public users | implemented | `users.getUser()` |
 | User stall | implemented | `stall.getStall()`, `stall.iterateStall()` |
@@ -839,6 +840,12 @@ Run the deeper response-shape audit when you want raw payload samples and unione
 ENV_FILE=/path/to/.env npm run audit:shapes
 ```
 
+The shape audit now defaults to conservative pacing and also supports:
+
+- `SHAPE_AUDIT_DELAY_MS`
+- `SHAPE_AUDIT_RETRY_DELAY_MS`
+- `SHAPE_AUDIT_INCLUDE_TOKEN_HELPERS=0`
+
 To let the shape audit create and remove a temporary low-price buy order so non-empty `buy_orders` fields can be observed:
 
 ```bash