Add component identity to the /status self-report payload

README.md

@@ -318,7 +318,7 @@ Clears the singleton instance, allowing a new one to be created with different c
 A request carrying a valid, backend-minted challenge (`Authorization: Bearer <jwt>`, an ES256 token with `purpose: "status-probe"` and `aud` equal to the request origin) gets the live running config back:
 
 ```json
-{ "runtime": null, "sdkVersion": "v1.4.0", "enforcement": "enforce", "eventReporting": true }
+{ "runtime": null, "sdkVersion": "v1.4.0", "component": { "kind": "php-sdk", "version": "v1.4.0" }, "enforcement": "enforce", "eventReporting": true }
 ```
 
 Any other request (missing, malformed, expired, or wrong-audience challenge) gets a minimal `{"supertab": true}` with a `404` status. Both responses set `Cache-Control: no-store`. Challenge verification reuses the same platform JWKS the SDK already fetches for license tokens — no extra configuration.

src/SupertabConnect.php

@@ -483,6 +483,13 @@ private function handleStatusRequest(RequestContext $context, string $url): Resp
             body: (string) json_encode([
                 'runtime' => null,
                 'sdkVersion' => HttpClient::resolveVersion(),
+                // Self-describing component identity: the backend maps the kind
+                // to the right update registry (Packagist for php-sdk), instead
+                // of legacy-shimming a bare sdkVersion to ts-sdk/npm.
+                'component' => [
+                    'kind' => 'php-sdk',
+                    'version' => HttpClient::resolveVersion(),
+                ],
                 'enforcement' => $this->enforcement->value,
                 // Reflect whether events will actually be emitted, derived from
                 // the effective transport rather than the config flag: an

tests/SupertabConnectStatusTest.php

@@ -115,6 +115,23 @@ public function test_event_reporting_true_when_transport_injected_despite_flag_o
         $this->assertTrue($payload['eventReporting']);
     }
 
+    public function test_status_payload_carries_php_sdk_component_identity(): void
+    {
+        // The backend resolves the update registry per component kind
+        // (wordpress.org / npm / Packagist); without this field a PHP
+        // deployment is legacy-shimmed to ts-sdk and checked against npm.
+        $stc = new SupertabConnect(apiKey: 'test-key', httpClient: $this->jwksClient());
+
+        $result = $stc->handleRequest($this->statusContext($this->challenge()));
+
+        $this->assertInstanceOf(RespondResult::class, $result);
+        $payload = json_decode($result->body, true);
+        $this->assertSame(
+            ['kind' => 'php-sdk', 'version' => $payload['sdkVersion']],
+            $payload['component'],
+        );
+    }
+
     public function test_invalid_challenge_returns_404_minimal_body(): void
     {
         $stc = new SupertabConnect(apiKey: 'test-key', httpClient: $this->jwksClient());