@drawbridge/drawbridge-agents 0.1.61 → 0.1.63

package/conventions/cross-repo-contracts.md

@@ -42,6 +42,20 @@ skill) so it stops living only in tribal memory.
   granted keys — that string is data, never rename it without a migration.)
 - Cascade cleanup of dependent rows belongs in a sync change-stream listener, not inline in the
   API route that triggered the delete (see `cascade-cleanup.md`).
+- **A product is owned through `product.organizations[]`, never through a connection** (utils ↔
+  api ↔ sync). `$addToSet` in utils' Shopify `commerce.product` write and api's campaign/ad
+  attach routes; `$pull` in ONE place — sync `stream/organization.js`, on organization delete.
+  Disconnect (`queue/connection.js`) pulls `connections[]` only, so a disconnected or hook-less
+  provider still lists its products by owner (api `route/organization-product.js`). Orphan
+  deletion (`lib/orphan-products.js`) needs ALL of: no organizations, no `campaign.products[]`
+  or `advertisement.product` ref, and no `order.lines[].productId` naming it — orders survive the
+  org cascade on purpose (dev lost three orders' products before the order lookup existed).
+  `order.lines[].product` is the product DOCUMENT, resolved by the utils order hook on
+  `provider.id` + `provider.slug` + `source.domain`; the raw `productId` is provider-scoped and
+  never a join key on its own. Deploy the api (validator) BEFORE sync/utils consumers write
+  either field — `additionalProperties:false` rejects the unknown key — and never backfill on
+  dev under a validator not yet on `develop`: the next api deploy reverts it and every
+  backfilled doc 121s.
 - A collection with no `queue/<collection>.js` handler is watched but its events are **silently
   dropped**. Adding a reactive collection means wiring `stream/index.js`, `lib/queue.js`, and
   `queue/index.js` together.
@@ -77,8 +91,12 @@ skill) so it stops living only in tribal memory.
   api registers the number's SmsUrl at twilio connect (`lib/twilio.js`) and `scripts.js
   registerTwilioWebhooks` backfills — a deployed webhooks route with unregistered numbers hears
   nothing, silently.
-- **`audience` picks the FROM-address; `intent` picks the opt-out machinery** (utils ↔ sync ↔
-  api). `resolveEmailSender` (sync `queue/notification.js`) resolves verified `identity` row →
+- **`audience` picks the FROM-address; `intent` picks the unsubscribe plumbing — and NOTHING
+  passes the suppression gate** (utils ↔ sync ↔ api). Every suppression source blocks every
+  lead-facing send, the winner claim included: api's draw route refuses up front ("Disqualify
+  this draw and draw again"), sync's `canSend` takes no intent (decided 2026-09-23, reversing
+  the 09-02 pass-through; a `$ne : 'unsubscribe'` anywhere on that path is the regression).
+  `resolveEmailSender` (sync `queue/notification.js`) resolves verified `identity` row →
   `subAddress( leadSender, organization.shortId )` for lead-facing mail → `accountSender` for
   member and platform mail. The tag is `shortId`, never `subdomain` — a rename and a custom-plan
   downgrade both rewrite subdomain, and the from-address is frozen into delivered mail; api's
@@ -519,6 +537,15 @@ api's identity/organization routes); the merged keys keep the old names. Reading
 `providerSettings({ slug : 'drawbridge' })` anywhere finds no row — it was split on dev
 2026-09-08 and prod is seeded per-vendor. Detail: `drawbridge-docs/reference/providers.md`.
 
+- **A step is switched off by the vendors IT declares, not by every vendor its manifest names
+  (utils ↔ sync, since utils 0.0.204).** A step declaration may carry `vendors : [ … ]`, a subset
+  of its manifest's list (build() refuses a slug the manifest does not name); sync's
+  `attempt()` reads that list into `vendorsEnabled({ slug, vendors })` and only falls back to the
+  manifest's whole list when the step declares none. `drawbridge` names sendgrid, twilio,
+  hubspot and brightdata; its email steps declare sendgrid, sms twilio, segment.sync none. Add a
+  drawbridge step without `vendors` and any one of the four switched off refuses it — HubSpot
+  off on dev refused every email send for two days (2026-09-21 to 23).
+
 - **The embedded app's install paths ARE `INSTALL_ENDPOINTS`** (utils `lib/connections/contract.js`
   ↔ drawbridge-shopify-app `app/drawbridge.server.ts`). The api's `POST /connection/:vendor/*`
   allows exactly those thirteen and 404s anything else; shopify-app does not depend on utils, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawbridge/drawbridge-agents",
-  "version": "0.1.61",
+  "version": "0.1.63",
   "description": "Shared agent-instruction content (rules, code style, conventions) for the drawbridge-* monorepo.",
   "license": "UNLICENSED",
   "publishConfig": {