spike: Merchant API v1 works but 7 'DW Real-Price Overrides' already exist (TK-00066/gmc-remediation owns this); override was tried+failed — do not rebuild; hand reorder lever + classification to TK-00066

d734ca36b1c3711651247fe1f6966020b079e35a · 2026-08-10 10:08:30 -0700 · Steve Abrams

Files touched

A inspect-overrides.mjs
A probe-merchant-api.mjs

Diff

commit d734ca36b1c3711651247fe1f6966020b079e35a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 10 10:08:30 2026 -0700

    spike: Merchant API v1 works but 7 'DW Real-Price Overrides' already exist (TK-00066/gmc-remediation owns this); override was tried+failed — do not rebuild; hand reorder lever + classification to TK-00066
---
 inspect-overrides.mjs  | 20 ++++++++++++++++++++
 probe-merchant-api.mjs | 24 ++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/inspect-overrides.mjs b/inspect-overrides.mjs
new file mode 100644
index 0000000..3bb29f0
--- /dev/null
+++ b/inspect-overrides.mjs
@@ -0,0 +1,20 @@
+import fs from 'node:fs'; import crypto from 'node:crypto';
+const HOME=process.env.HOME, ACCT='146735262';
+const SA_PATH=HOME+'/Projects/secrets-manager/gmc-sa-146735262.json';
+const b64=b=>Buffer.from(b).toString('base64').replace(/=/g,'').replace(/\+/g,'-').replace(/\//g,'_');
+const SA=JSON.parse(fs.readFileSync(SA_PATH,'utf8'));const now=Math.floor(Date.now()/1000);
+const si=b64(JSON.stringify({alg:'RS256',typ:'JWT'}))+'.'+b64(JSON.stringify({iss:SA.client_email,scope:'https://www.googleapis.com/auth/content',aud:'https://oauth2.googleapis.com/token',iat:now,exp:now+3600}));
+const s=crypto.createSign('RSA-SHA256');s.update(si);const jwt=si+'.'+b64(s.sign(SA.private_key));
+const tr=await fetch('https://oauth2.googleapis.com/token',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:new URLSearchParams({grant_type:'urn:ietf:params:oauth:grant-type:jwt-bearer',assertion:jwt})});
+const tok=(await tr.json()).access_token; const H={Authorization:`Bearer ${tok}`};
+const list=await (await fetch(`https://merchantapi.googleapis.com/datasources/v1/accounts/${ACCT}/dataSources`,{headers:H})).json();
+const rp=(list.dataSources||[]).filter(d=>/Real-Price/i.test(d.displayName||''));
+console.log(`${rp.length} "DW Real-Price Overrides" supplemental sources. Detail of first 2:`);
+for(const d of rp.slice(0,2)){
+  console.log('\n', JSON.stringify(d,null,1).slice(0,900));
+  const id=d.name.split('/').pop();
+  // fileUploads status
+  const fu=await fetch(`https://merchantapi.googleapis.com/datasources/v1/accounts/${ACCT}/dataSources/${id}/fileUploads/latest`,{headers:H});
+  const fj=await fu.json();
+  console.log('  latest fileUpload:',fu.status, JSON.stringify(fj).slice(0,300));
+}
diff --git a/probe-merchant-api.mjs b/probe-merchant-api.mjs
new file mode 100644
index 0000000..53bc064
--- /dev/null
+++ b/probe-merchant-api.mjs
@@ -0,0 +1,24 @@
+/** probe-merchant-api.mjs — READ-ONLY. Can the SA reach the newer Merchant API dataSources?
+ * If yes, a supplemental dataSource is the upload path for the 4,468 SUPP_FIXABLE. */
+import fs from 'node:fs'; import crypto from 'node:crypto';
+const HOME=process.env.HOME, ACCT='146735262';
+const SA_PATH=HOME+'/Projects/secrets-manager/gmc-sa-146735262.json';
+const b64=b=>Buffer.from(b).toString('base64').replace(/=/g,'').replace(/\+/g,'-').replace(/\//g,'_');
+const SA=JSON.parse(fs.readFileSync(SA_PATH,'utf8'));const now=Math.floor(Date.now()/1000);
+const si=b64(JSON.stringify({alg:'RS256',typ:'JWT'}))+'.'+b64(JSON.stringify({iss:SA.client_email,scope:'https://www.googleapis.com/auth/content',aud:'https://oauth2.googleapis.com/token',iat:now,exp:now+3600}));
+const s=crypto.createSign('RSA-SHA256');s.update(si);const jwt=si+'.'+b64(s.sign(SA.private_key));
+const tr=await fetch('https://oauth2.googleapis.com/token',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:new URLSearchParams({grant_type:'urn:ietf:params:oauth:grant-type:jwt-bearer',assertion:jwt})});
+const tok=(await tr.json()).access_token; const H={Authorization:`Bearer ${tok}`};
+// 1) list dataSources (Merchant API)
+const r=await fetch(`https://merchantapi.googleapis.com/datasources/v1/accounts/${ACCT}/dataSources`,{headers:H});
+const j=await r.json();
+console.log('dataSources.list HTTP',r.status);
+if(r.status===200){
+  const ds=j.dataSources||[];
+  console.log(`  ${ds.length} data sources:`);
+  for(const d of ds) console.log(`   - ${d.name?.split('/').pop()} "${d.displayName}" type=${Object.keys(d).find(k=>/Input|Source/i.test(k))||'?'} ${d.primaryProductDataSource?'PRIMARY':d.supplementalProductDataSource?'SUPPLEMENTAL':''}`);
+  console.log('\n=> Merchant API reachable. A SUPPLEMENTAL product dataSource can be created here to overlay excluded_destination on the $4.25 sample offers.');
+}else{
+  console.log('  body:',JSON.stringify(j).slice(0,400));
+  console.log('\n=> If 403/PERMISSION_DENIED: SA lacks Merchant API access (needs enable + role). If 404: account path differs. This is the blocker to resolve for the supplemental path.');
+}

← b93ed3f add reorder-canary re-sync recheck script (read-only efficac · back to Gmc 425 Supplemental Feed · lever1b: add read-only GMC verification (CA/GB currency-mism 7643942 →