From acaafb862b22481ded8812acb2a3fe408899e0e5 Mon Sep 17 00:00:00 2001
From: Tom Stark <tomasstark@pm.me>
Date: Tue, 14 Jul 2026 06:16:18 +0200
Subject: [PATCH] feat: add component identity to the /status self-report
 payload

---
 README.md                           |  2 +-
 src/SupertabConnect.php             |  7 +++++++
 tests/SupertabConnectStatusTest.php | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 62445cd..851ac41 100644
--- a/README.md
+++ b/README.md
@@ -318,7 +318,7 @@ Clears the singleton instance, allowing a new one to be created with different c
 A request carrying a valid, backend-minted challenge (`Authorization: Bearer <jwt>`, an ES256 token with `purpose: "status-probe"` and `aud` equal to the request origin) gets the live running config back:
 
 ```json
-{ "runtime": null, "sdkVersion": "v1.4.0", "enforcement": "enforce", "eventReporting": true }
+{ "runtime": null, "sdkVersion": "v1.4.0", "component": { "kind": "php-sdk", "version": "v1.4.0" }, "enforcement": "enforce", "eventReporting": true }
 ```
 
 Any other request (missing, malformed, expired, or wrong-audience challenge) gets a minimal `{"supertab": true}` with a `404` status. Both responses set `Cache-Control: no-store`. Challenge verification reuses the same platform JWKS the SDK already fetches for license tokens — no extra configuration.
diff --git a/src/SupertabConnect.php b/src/SupertabConnect.php
index 2002f8a..2fd1cc3 100644
--- a/src/SupertabConnect.php
+++ b/src/SupertabConnect.php
@@ -483,6 +483,13 @@ private function handleStatusRequest(RequestContext $context, string $url): Resp
             body: (string) json_encode([
                 'runtime' => null,
                 'sdkVersion' => HttpClient::resolveVersion(),
+                // Self-describing component identity: the backend maps the kind
+                // to the right update registry (Packagist for php-sdk), instead
+                // of legacy-shimming a bare sdkVersion to ts-sdk/npm.
+                'component' => [
+                    'kind' => 'php-sdk',
+                    'version' => HttpClient::resolveVersion(),
+                ],
                 'enforcement' => $this->enforcement->value,
                 // Reflect whether events will actually be emitted, derived from
                 // the effective transport rather than the config flag: an
diff --git a/tests/SupertabConnectStatusTest.php b/tests/SupertabConnectStatusTest.php
index 89e5988..48d7d0f 100644
--- a/tests/SupertabConnectStatusTest.php
+++ b/tests/SupertabConnectStatusTest.php
@@ -115,6 +115,23 @@ public function test_event_reporting_true_when_transport_injected_despite_flag_o
         $this->assertTrue($payload['eventReporting']);
     }
 
+    public function test_status_payload_carries_php_sdk_component_identity(): void
+    {
+        // The backend resolves the update registry per component kind
+        // (wordpress.org / npm / Packagist); without this field a PHP
+        // deployment is legacy-shimmed to ts-sdk and checked against npm.
+        $stc = new SupertabConnect(apiKey: 'test-key', httpClient: $this->jwksClient());
+
+        $result = $stc->handleRequest($this->statusContext($this->challenge()));
+
+        $this->assertInstanceOf(RespondResult::class, $result);
+        $payload = json_decode($result->body, true);
+        $this->assertSame(
+            ['kind' => 'php-sdk', 'version' => $payload['sdkVersion']],
+            $payload['component'],
+        );
+    }
+
     public function test_invalid_challenge_returns_404_minimal_body(): void
     {
         $stc = new SupertabConnect(apiKey: 'test-key', httpClient: $this->jwksClient());