@drawbridge/drawbridge-utils 0.0.118 → 0.0.121

package/dist/providers.js

@@ -176,6 +176,53 @@ var HOOKS = Object.freeze({
     "promotions"
   ])
 });
+var HOOK_EFFECTS = Object.freeze(["enqueues", "events", "writes"]);
+var WRITE_OPERATIONS = Object.freeze(["create", "update"]);
+var HOOK_PROPS = Object.freeze([
+  "channel",
+  "clientId",
+  "clientSecret",
+  "connection",
+  "contact",
+  "context",
+  "cursor",
+  "declaration",
+  "doc",
+  "email",
+  "event",
+  "headers",
+  "id",
+  "lead",
+  "limit",
+  "manifest",
+  "payload",
+  "scope",
+  "search",
+  "secret",
+  "settings",
+  "sort",
+  "step",
+  "suppressed",
+  "token",
+  "tokens",
+  "workflow"
+]);
+var HOOK_OPTIONS = Object.freeze([
+  "adminToken",
+  "canSend",
+  "chunkSize",
+  "dispatch",
+  "fetcher",
+  "logger",
+  "mintId",
+  "read",
+  "reconcileScopes",
+  "request",
+  "resolveContact",
+  "resolveSettings",
+  "rotateToken",
+  "shopify"
+]);
 var STEPS = Object.freeze({
   "commerce.code.issue": "Issue discount code",
   "commerce.customer.insert": "Create customer",
@@ -357,13 +404,16 @@ var attentive_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 <path d="M166.04 261.805C180.228 259.107 195.528 261.893 207.581 269.971C218.512 277.079 226.908 288.136 230.604 300.657C234.835 314.103 233.614 329.124 227.485 341.788C220.097 356.875 205.782 368.543 189.317 372.089C173.957 375.652 157.089 372.386 144.304 363.103C132.971 355.295 124.912 342.989 121.891 329.581C118.943 316.636 120.725 302.656 127.002 290.938C134.699 275.951 149.503 264.933 166.046 261.811" fill="#1E1C1C"/>
 </svg>`;
 
-// lib/connections/attentive.js
+// lib/connections/providers/attentive.js
 var attentive_default2 = {
   auth: {
     oauth: {
-      // NAMES of the env vars holding OUR app's client — set at registration,
-      // never before. No `headers` on the client: Attentive takes credentials
-      // as form fields, which is the runner's default.
+      // NAMES of the credentials holding OUR app's client — keys into the map
+      // the provider collection answers, entered on the admin screen at
+      // registration, never before. (The names are the env vars they once
+      // were; the vocabulary stayed when the storage moved.) No `headers` on
+      // the client: Attentive takes credentials as form fields, which is the
+      // runner's default.
       client: {
         id: "ATTENTIVE_OAUTH_CLIENT_ID",
         secret: "ATTENTIVE_OAUTH_CLIENT_SECRET"
@@ -468,7 +518,7 @@ var attentive_default2 = {
       // show a picker quietly missing most of a real account. The response's
       // only identifier is `externalId`, so an entry without one cannot be
       // stored and is dropped.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, token }) => {
+      audiences: async ({ cursor, limit = 100, search, token }, { fetcher = fetch } = {}) => {
         const query = new URLSearchParams({
           limit: String(Math.min(limit, 1e3)),
           ...cursor && { cursor },
@@ -584,10 +634,11 @@ var request = async ({
 // lib/hubspot.js
 var HUBSPOT_BASE = "https://api.hubapi.com";
 var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  if (!token) throw new Error("HubSpot access token missing \u2014 pass token (the drawbridge provider's hubspotToken)");
   return (fetcher || request)({
     body,
     headers: {
-      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+      "Authorization": "Bearer " + token
     },
     method,
     query,
@@ -689,16 +740,15 @@ var contacts = {
   // FORGET A CONTACT, by id or by email. Account deletion — the caller had
   // to search then remove, which is one round trip it should not have to
   // know about.
-  remove: async ({ email, fetcher, id, token }) => {
-    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-    if (!key) return;
-    const contact = id || await lookup({ email, fetcher, token: key });
+  remove: async ({ email, id, token }, { fetcher } = {}) => {
+    if (!token) return;
+    const contact = id || await lookup({ email, fetcher, token });
     if (!contact) return;
     return hubspotRequest({
       fetcher,
       method: "DELETE",
       path: "/crm/v3/objects/contacts/" + contact,
-      token: key
+      token
     });
   },
   // Connect an account to its contact by email, creating it if absent, and
@@ -707,24 +757,23 @@ var contacts = {
   // no delete-old-then-create-new.
   //
   // Prefer the cached hubspotId; fall back to a search; create last.
-  sync: async ({ doc, fetcher, token }) => {
+  sync: async ({ doc, token }, { fetcher } = {}) => {
     var _a, _b;
-    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-    if (!key) return;
+    if (!token) return;
     if (doc == null ? void 0 : doc.hubspotId) {
       try {
-        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token })) == null ? void 0 : _a.id;
       } catch (error) {
         if ((error == null ? void 0 : error.status) !== 404) throw error;
       }
     }
-    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token });
     return (_b = await send({
       doc,
       fetcher,
       method: existing ? "PATCH" : "POST",
       path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
-      token: key
+      token
     })) == null ? void 0 : _b.id;
   }
 };
@@ -1180,6 +1229,36 @@ var plans = {
     conversion: 0.5
   }
 };
+var resolvePlan = (subscription) => {
+  var _a, _b;
+  const custom = subscription == null ? void 0 : subscription.custom;
+  if (!custom) return plans[subscription == null ? void 0 : subscription.plan] ?? free;
+  return {
+    // Reusing all.features / all.limits is what keeps a custom plan the same
+    // SHAPE as a catalog one: the base feature grants every plan carries, the
+    // campaign limits that are always infinite, and members defaulting to
+    // infinite when a deal does not name it.
+    conversion: custom.conversion ?? free.conversion,
+    custom: true,
+    // A custom plan is a negotiated PAID deal, so it carries the paid-tier
+    // baseline whether or not the deal thought to name it. Today that is the
+    // sending domain: every catalog paid tier grants it, and a custom plan
+    // silently lacking it would be a support ticket, not a pricing decision.
+    features: all.features([organization.networking.key, ...((_a = custom.features) == null ? void 0 : _a.granted) || []]),
+    limits: all.limits(((_b = custom.limits) == null ? void 0 : _b.organization) || {}),
+    // A custom plan stores its overage BARE on `custom.overages` — a different
+    // shape from the catalog's nested one. Number() so a deal stored as a string
+    // still resolves to cents-per-action; an unnamed overage stays undefined
+    // (it bills nothing) rather than becoming NaN.
+    actionCents: custom.overages == null ? void 0 : Number(custom.overages),
+    overages: { actions: custom.overages },
+    title: custom.title || "Custom"
+  };
+};
+var conversionRate = (subscription) => {
+  var _a;
+  return ((_a = resolvePlan(subscription)) == null ? void 0 : _a.conversion) ?? free.conversion;
+};
 
 // lib/transactions.js
 import { currentTraceId } from "@drawbridge/drawbridge-telemetry";
@@ -1334,7 +1413,36 @@ var channels = {
   }
 };
 
-// lib/connections/drawbridge.js
+// lib/connections/providers/drawbridge.js
+var interpolate = (template, data2) => {
+  if (!template) return template;
+  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => (data2 == null ? void 0 : data2[key]) != null ? String(data2[key]) : "{{" + key + "}}");
+};
+var teamRecipients = async ({ memberIds = [], organization: organization2, read }) => {
+  const org = await read.get({ collection: "organization", query: { id: organization2 } });
+  const owner = (org == null ? void 0 : org.owner) ? await read.get({ collection: "user", query: { id: org.owner } }) : null;
+  const members = memberIds.length ? await read.aggregate({
+    collection: "member",
+    pipeline: [
+      {
+        $match: {
+          id: { $in: memberIds },
+          organization: organization2,
+          status: "accepted"
+        }
+      }
+    ]
+  }) : [];
+  const seen = /* @__PURE__ */ new Set();
+  return [owner, ...members].filter((member) => {
+    if (!(member == null ? void 0 : member.id) || !(member == null ? void 0 : member.email)) return false;
+    const address = member.email.toLowerCase();
+    if (seen.has(address)) return false;
+    seen.add(address);
+    return true;
+  });
+};
+var queueNotification = (data2) => ({ collection: "notification", data: data2, operation: "create" });
 var drawbridge_default2 = {
   auth: {
     type: "none"
@@ -1352,10 +1460,15 @@ var drawbridge_default2 = {
   exclusive: false,
   fields: [],
   group: "developer",
-  // EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
-  // suppression collection and the queues; segment sync needs the streams. A
-  // published package carrying those makes every consumer carry them, which is
-  // the reason `{}` exists as an answer.
+  // THE BODIES LIVE HERE, beside the declarations that name them. They used to
+  // live in drawbridge-sync because they touch the database, the queues and the
+  // sockets — and a published package cannot carry a controller.
+  //
+  // It does not have to. A hook is a function, so everything it needs is PASSED
+  // IN: `read` for the reads, `canSend` for the opt-out floor, `resolveContact`
+  // for the one write whose RESULT the hook has to count. Everything else a hook
+  // wants done it DESCRIBES — `writes`, `enqueues`, `events` — and the shell
+  // performs it. See lib/connections/contract.js for that shape.
   hooks: {
     auth: {
       // Nothing to connect, revoke, probe or re-scope.
@@ -1376,13 +1489,157 @@ var drawbridge_default2 = {
     // accounts DRAWBRIDGE holds rather than ones a merchant connects.
     contacts,
     email: {
-      digest: {},
-      // To organization members. NEVER suppressed and never billed: an
-      // entrant's opt-out must not silence an alert to staff, and staff mail is
-      // not a metered send.
-      notify: {},
-      // To a lead. Suppression applies and the send is billed.
-      send: {}
+      // A PERIODIC SUMMARY to the team, on a schedule trigger rather than per
+      // lead.
+      //
+      // The count is the point: `email.notify` tells the owner one lead arrived
+      // and dampens a spike to one message per bucket, which is deliberately not
+      // a count. This is where "you got 43 entries this week" comes from.
+      digest: async ({ context, step, workflow }, { read } = {}) => {
+        var _a, _b, _c, _d;
+        const days = { day: 1, month: 30, week: 7 }[(_a = workflow == null ? void 0 : workflow.trigger) == null ? void 0 : _a.event] || 7;
+        const since = new Date(Date.now() - days * 24 * 60 * 60 * 1e3);
+        const campaign = ((_c = (_b = workflow == null ? void 0 : workflow.trigger) == null ? void 0 : _b.filters) == null ? void 0 : _c.campaign) || null;
+        const [counted] = await read.aggregate({
+          collection: "lead",
+          pipeline: [
+            {
+              $match: {
+                createdAt: { $gte: since },
+                organization: workflow.organization,
+                ...campaign && { campaigns: { $in: [campaign] } }
+              }
+            },
+            { $count: "count" }
+          ]
+        });
+        const count = Number((counted == null ? void 0 : counted.count) || 0);
+        const request2 = { campaign, count, days };
+        if (!count) return { message: "No new leads in the period \u2014 digest skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const recipients = await teamRecipients({
+          memberIds: ((_d = step.settings) == null ? void 0 : _d.members) || [],
+          organization: workflow.organization,
+          read
+        });
+        const values = { ...context, count };
+        return {
+          message: "Digest of " + count + " new lead(s) queued for " + recipients.length + " recipient(s).",
+          request: request2,
+          response: { count, notified: recipients.length },
+          writes: recipients.map((member) => {
+            var _a2, _b2;
+            return queueNotification({
+              audience: "member",
+              message: interpolate((_a2 = step.settings) == null ? void 0 : _a2.message, values),
+              organization: workflow.organization,
+              send: { type: "email", email: member.email },
+              title: interpolate((_b2 = step.settings) == null ? void 0 : _b2.subject, values),
+              workflow: workflow.id
+            });
+          })
+        };
+      },
+      // To the organization's OWN PEOPLE. Never suppressed, never
+      // subscription-gated, no unsubscribe footer — telling an org's staff about
+      // their own leads is not commercial mail to a stranger.
+      //
+      // FREE, permanently. The lead that triggered this run already consumed the
+      // billable action, and `members` is a list — billing here would turn one
+      // lead into five more charges and the org would be paying to read its own
+      // mail. The declaration prices it at zero; the shell bills nothing for
+      // zero.
+      notify: async ({ context, step, workflow }, { read } = {}) => {
+        var _a;
+        const memberIds = ((_a = step.settings) == null ? void 0 : _a.members) || [];
+        const request2 = { members: memberIds.length };
+        const recipients = await teamRecipients({ memberIds, organization: workflow.organization, read });
+        if (!recipients.length) {
+          return {
+            message: "No owner or accepted member with an email address \u2014 team notification skipped.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const bucket = Math.floor(Date.now() / (15 * 60 * 1e3));
+        return {
+          message: "Team notification queued for " + recipients.length + " recipient(s).",
+          request: request2,
+          response: { notified: recipients.length },
+          writes: recipients.map((member) => {
+            var _a2, _b;
+            return {
+              ...queueNotification({
+                audience: "member",
+                // Per workflow, recipient AND bucket, so one recipient's damper
+                // can never swallow another's mail and a later bucket is never
+                // mistaken for a duplicate of an earlier one.
+                key: "team.notify." + workflow.id + "." + member.id + "." + bucket,
+                message: interpolate((_a2 = step.settings) == null ? void 0 : _a2.message, context),
+                organization: workflow.organization,
+                send: { type: "email", email: member.email },
+                title: interpolate((_b = step.settings) == null ? void 0 : _b.subject, context),
+                workflow: workflow.id
+              }),
+              // E11000 IS THE DAMPER WORKING: this recipient has already been
+              // told within the bucket. Declared per write rather than assumed by
+              // the shell, because on every other write here a duplicate key is a
+              // real failure.
+              ignoreDuplicate: true
+            };
+          })
+        };
+      },
+      // Drawbridge sends lead-facing email itself — no merchant provider gates
+      // it.
+      //
+      // This QUEUES rather than sends: queue/notification.js owns delivery, the
+      // unsubscribe token and the CAN-SPAM footer. The step's job is to say who
+      // and what, correctly, and to refuse early when it must not send at all.
+      send: async ({ context, step, workflow }, { canSend, read } = {}) => {
+        var _a, _b;
+        const to = context == null ? void 0 : context.email;
+        if (!to) throw new Error("No email address on context (context.email is required)");
+        const request2 = { to };
+        const { ok: sendable } = await canSend({ channel: "email", to });
+        if (!sendable) return { message: "Recipient has opted out \u2014 skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const organization2 = await read.get({ collection: "organization", query: { id: workflow.organization } });
+        const subscription = (organization2 == null ? void 0 : organization2.subscription) ? await read.get({ collection: "subscription", query: { id: organization2.subscription } }) : null;
+        if ((subscription == null ? void 0 : subscription.status) !== "active") {
+          return {
+            message: "Organization has no active subscription \u2014 workflow-step email skipped.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        return {
+          message: "Email queued for delivery to " + to + ".",
+          request: request2,
+          response: { queued: true },
+          // NO `connection` FIELD, deliberately: the platform sends this.
+          // `audience : 'lead'` states what the queue would otherwise infer from
+          // shape.
+          //
+          // `campaign` is not decoration. queue/notification.js mints the
+          // unsubscribe token with it, so it decides whether opting out is
+          // scoped to this campaign or the whole organization, and it names the
+          // campaign in the footer. Sending without it silently broadens every
+          // opt-out to the entire organization.
+          writes: [
+            queueNotification({
+              audience: "lead",
+              campaign: (context == null ? void 0 : context.campaign) || null,
+              lead: (context == null ? void 0 : context.lead) || null,
+              message: interpolate((_a = step.settings) == null ? void 0 : _a.message, context),
+              organization: workflow.organization,
+              send: { type: "email", email: to },
+              title: interpolate((_b = step.settings) == null ? void 0 : _b.subject, context),
+              workflow: workflow.id
+            })
+          ]
+        };
+      }
     },
     inbound: false,
     lifecycle: false,
@@ -1392,8 +1649,174 @@ var drawbridge_default2 = {
       products: false,
       promotions: false
     },
-    segment: { sync: {} },
-    sms: { send: {} },
+    segment: {
+      // RECALCULATE SEGMENT MEMBERSHIP. The one FAN-OUT hook: it evaluates every
+      // contact in an organization against every segment, which is too much for
+      // one job, so it returns chunks and the shell defers completion.
+      //
+      // Returning `chunks` is the only thing that makes it different. The
+      // declaration, the guards, the step document and the price are the shell's,
+      // exactly as they are for a step that finishes in one go.
+      sync: async ({ context, step }, { chunkSize, logger: logger2, read, resolveContact } = {}) => {
+        var _a, _b, _c;
+        if (!chunkSize) throw new Error("segment.sync needs chunkSize from the shell");
+        const organization2 = context == null ? void 0 : context.organization;
+        const configured = (_a = step == null ? void 0 : step.settings) == null ? void 0 : _a.segment;
+        const request2 = { organization: organization2 || null, segmentId: configured || null };
+        const release = (ids, status = "active") => {
+          const released = (ids || []).filter(Boolean);
+          return {
+            events: organization2 ? released.map((id) => ({
+              event: "organization.segments",
+              payload: { id, status },
+              room: "organization." + organization2
+            })) : [],
+            writes: released.map((id) => ({
+              collection: "segment",
+              data: { $set: { status } },
+              operation: "update",
+              query: { id }
+            }))
+          };
+        };
+        if (!organization2) {
+          return {
+            ...release([configured]),
+            message: "Trigger data missing organization id \u2014 cannot sync segments.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const segments = await read.aggregate({
+          collection: "segment",
+          pipeline: [{ $match: configured ? { id: configured, organization: organization2 } : { organization: organization2 } }]
+        });
+        if (!segments.length) {
+          return {
+            ...release([configured]),
+            message: "No segments matched the request \u2014 nothing to sync.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const segmentIds = segments.map((entry) => entry.id);
+        try {
+          let backfilled = 0;
+          if (segments.some((entry) => entry.system)) {
+            const contacted = await read.aggregate({
+              collection: "contact",
+              pipeline: [
+                { $match: { organization: organization2 } },
+                { $project: { _id: 0, leads: 1 } },
+                { $unwind: "$leads" },
+                { $group: { _id: null, ids: { $addToSet: "$leads" } } }
+              ]
+            });
+            const uncontacted = await read.aggregate({
+              collection: "lead",
+              pipeline: [
+                { $match: { id: { $nin: ((_b = contacted[0]) == null ? void 0 : _b.ids) || [] }, organization: organization2 } },
+                { $project: { _id: 0, id: 1 } }
+              ]
+            });
+            for (const lead of uncontacted) {
+              try {
+                await resolveContact({ leadId: lead.id });
+                backfilled += 1;
+              } catch (error) {
+                if (error.code !== 11e3) throw error;
+              }
+            }
+            (_c = logger2 == null ? void 0 : logger2.info) == null ? void 0 : _c.call(logger2, "segment.sync.backfill", { backfilled, organization: organization2, uncontacted: uncontacted.length });
+          }
+          const contacts2 = await read.aggregate({
+            collection: "contact",
+            pipeline: [
+              { $match: { organization: organization2 } },
+              { $project: { _id: 0, id: 1 } },
+              { $sort: { id: 1 } }
+            ]
+          });
+          if (!contacts2.length) {
+            return {
+              ...release(segmentIds),
+              message: "Organization has no contacts to evaluate against segments.",
+              request: request2,
+              response: { skipped: true },
+              skipped: true
+            };
+          }
+          const contactIds = contacts2.map((contact) => contact.id);
+          const org = await read.get({ collection: "organization", query: { id: organization2 } });
+          const chunks = [];
+          for (let index = 0; index < contactIds.length; index += chunkSize) {
+            chunks.push({
+              contactIds: contactIds.slice(index, index + chunkSize),
+              organization: organization2,
+              segments: segmentIds,
+              // A BACKFILL IS NOT BILLABLE. It creates the contacts this run
+              // then evaluates, so charging for it would bill an organization
+              // for work its own history made necessary.
+              usage: (context == null ? void 0 : context.billable) === true && backfilled === 0 ? (org == null ? void 0 : org.usage) || null : null
+            });
+          }
+          return {
+            chunks,
+            ...configured && { extra: { segment: configured } },
+            message: "Queued " + contactIds.length + " contacts across " + chunks.length + " chunks for segment evaluation.",
+            queue: "segment",
+            request: { ...request2, segments: segmentIds },
+            response: { chunks: chunks.length, contacts: contactIds.length, segments: segments.length }
+          };
+        } catch (error) {
+          throw Object.assign(error, release(segmentIds, "error"));
+        }
+      }
+    },
+    sms: {
+      // SMS TO A LEAD, through the merchant's own Twilio connection.
+      //
+      // WITHDRAWN from the builder — twilio went, and a connection-gated step
+      // with no connection to gate on could only ever render permanently
+      // disabled. Stored workflows still carry it, so it still runs.
+      //
+      // It looks its own connection up rather than relying on the shell, because
+      // the step is declared by the PRIVATE drawbridge connection (which has
+      // none) while the credential belongs to twilio (which has no manifest).
+      // Platform SMS will remove that split the way it did for email.
+      send: async ({ context, step, workflow }, { canSend, read } = {}) => {
+        var _a, _b, _c;
+        const to = (_a = context == null ? void 0 : context.phone) == null ? void 0 : _a.number;
+        if (!to) throw new Error("No phone number on context (context.phone.number is required)");
+        const request2 = { to };
+        const connection2 = await read.get({
+          collection: "connection",
+          query: { organization: workflow.organization, slug: "twilio", status: "active" }
+        });
+        if (!connection2) return { message: "No active Twilio SMS connection \u2014 workflow-step SMS skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const { ok: sendable } = await canSend({ channel: "sms", to: context.phone });
+        if (!sendable) return { message: "Recipient has opted out \u2014 skipped.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          message: "SMS queued for delivery to " + to + " via twilio.",
+          request: request2,
+          response: { provider: "twilio", queued: true },
+          // QUEUES rather than sends: queue/notification.js owns delivery, the
+          // carrier opt-out line and the segment count this is billed on.
+          writes: [
+            queueNotification({
+              connection: connection2.id,
+              message: interpolate((_b = step.settings) == null ? void 0 : _b.message, context),
+              organization: workflow.organization,
+              send: { phone: { number: to }, type: "phone" },
+              title: interpolate((_c = step.settings) == null ? void 0 : _c.subject, context),
+              workflow: workflow.id
+            })
+          ]
+        };
+      }
+    },
     webhook: false
   },
   icon: drawbridge_default,
@@ -1435,11 +1858,11 @@ var drawbridge_default2 = {
         key: "Email \u2014 Digest",
         queue: "notification",
         settings: {
-          // The organization OWNER is always a recipient, resolved in sync,
-          // so this is additional recipients rather than the list. It cannot
-          // be required: the members endpoint is owner-gated and the owner is
-          // not a member document, so a solo merchant has nothing to pick and
-          // could never save the step.
+          // The organization OWNER is always a recipient, resolved by the
+          // hook, so this is additional recipients rather than the list. It
+          // cannot be required: the members endpoint is owner-gated and the
+          // owner is not a member document, so a solo merchant has nothing to
+          // pick and could never save the step.
           members: { of: "string", type: "array" },
           message: { required: true, type: "string" },
           subject: { required: true, type: "string" }
@@ -1539,7 +1962,7 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
-// lib/connections/klaviyo.js
+// lib/connections/providers/klaviyo.js
 var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
     ...payload && { body: JSON.stringify(payload) },
@@ -1576,7 +1999,8 @@ var klaviyo_default2 = {
   // differently, and it says so in hooks.auth.token rather than as a flag here.
   auth: {
     oauth: {
-      // NAMES the env vars holding OUR application's client. One identity,
+      // NAMES the credentials holding OUR application's client — keys into
+      // the stored provider credentials, not env vars. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's
       // data.
@@ -1716,7 +2140,7 @@ var klaviyo_default2 = {
       // renders an empty "Klaviyo account" field, because the merchant is
       // never asked which account they connected — the consent already
       // decided it, and asking again would be a question we can answer.
-      connect: async ({ fetcher, tokens }) => {
+      connect: async ({ tokens }, { fetcher } = {}) => {
         var _a, _b, _c;
         const body = await api("/accounts", { fetcher, token: tokens.accessToken });
         const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
@@ -1731,7 +2155,7 @@ var klaviyo_default2 = {
       //
       // Basic auth with our client, exactly like the token exchange — the
       // token being revoked is the subject, not the credential.
-      disconnect: async ({ clientId, clientSecret, fetcher = fetch, manifest, settings }) => {
+      disconnect: async ({ clientId, clientSecret, manifest, settings }, { fetcher = fetch } = {}) => {
         const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
         if (!token) return { revoked: false };
         const response = await fetcher(manifest.auth.oauth.urls.revoke, {
@@ -1754,7 +2178,7 @@ var klaviyo_default2 = {
       // the refresh token is the only thing that asks Klaviyo.
       //
       // It also keeps the grant warm against the 90-day idle window above.
-      probe: async ({ clientId, clientSecret, fetcher, manifest, settings }) => {
+      probe: async ({ clientId, clientSecret, manifest, settings }, { fetcher } = {}) => {
         const token = await accessToken({
           clientId,
           clientSecret,
@@ -1784,12 +2208,11 @@ var klaviyo_default2 = {
     // the store's.
     commerce: false,
     // The verb the contacts.sync step points at. It does the work — including
-    // writing the profile id back onto the lead — and returns what happened.
     contacts: {
       // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
       // different thing from deleting the profile.
       remove: false,
-      sync: async ({ contact, fetcher, lead, settings, suppressed, token }) => {
+      sync: async ({ contact, lead, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c;
         const list = settings == null ? void 0 : settings.list;
         if (!list) return { message: "No Klaviyo list is chosen for this connection.", skipped: true };
@@ -1881,7 +2304,7 @@ var klaviyo_default2 = {
       // it, so one call quietly returns the first ten lists and an account
       // with more shows a picker missing the one they wanted, with nothing to
       // indicate anything was cut.
-      audiences: async ({ cursor, fetcher, limit = 100, search, token }) => {
+      audiences: async ({ cursor, limit = 100, search, token }, { fetcher } = {}) => {
         var _a, _b;
         const audiences = [];
         let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
@@ -1993,7 +2416,7 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 <path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
 </svg>`;
 
-// lib/connections/mailchimp.js
+// lib/connections/providers/mailchimp.js
 var base = (dc) => {
   if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
   return "https://" + dc + ".api.mailchimp.com/3.0";
@@ -2082,7 +2505,7 @@ var mailchimp_default2 = {
       // The header here is `OAuth <token>`, not Bearer — that is specific to
       // the metadata endpoint. Marketing API calls take Bearer; see the
       // audiences hook.
-      connect: async ({ fetcher = fetch, tokens }) => {
+      connect: async ({ tokens }, { fetcher = fetch } = {}) => {
         const response = await fetcher("https://login.mailchimp.com/oauth2/metadata", {
           headers: {
             authorization: "OAuth " + (tokens == null ? void 0 : tokens.accessToken)
@@ -2134,7 +2557,7 @@ var mailchimp_default2 = {
       // successful — the same silent truncation Klaviyo has, at a different
       // number. Paged against total_items so an account past a thousand still
       // resolves.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
+      audiences: async ({ cursor, limit = 100, search, settings, token }, { fetcher = fetch } = {}) => {
         const dc = settings == null ? void 0 : settings.dc;
         const count = Math.min(limit, 1e3);
         const offset = Number(cursor || 0);
@@ -2213,6 +2636,10 @@ var mailchimp_default2 = {
   title: "Mailchimp"
 };
 
+// lib/connections/providers/shopify.js
+import { randomUUID } from "crypto";
+import { customAlphabet as customAlphabet2 } from "nanoid";
+
 // lib/connections/icons/shopify.js
 var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="white"/>
@@ -2223,12 +2650,15 @@ var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 
 // lib/connections/inbound.js
 import { createHmac, timingSafeEqual } from "crypto";
-var verifySignature = ({ body, descriptor, headers }) => {
+var verifySignature = ({ body, descriptor, headers, secret }) => {
+  if (!secret) {
+    throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
+  }
   const provided = headers[descriptor.headers.signature];
   if (!provided) {
     throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
   }
-  const digest = createHmac(descriptor.signature.algorithm, process.env[descriptor.signature.secret]).update(body).digest(descriptor.signature.encoding);
+  const digest = createHmac(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
   const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
   const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
   if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual(digestBuffer, providedBuffer)) {
@@ -2238,7 +2668,72 @@ var verifySignature = ({ body, descriptor, headers }) => {
 };
 var readEventHeader = ({ descriptor, headers }) => headers[descriptor.headers.event];
 
-// lib/connections/shopify.js
+// lib/email.js
+var GMAIL_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
+var toCanonicalEmail = (value) => {
+  if (!value || typeof value !== "string") return null;
+  const email = value.trim().toLowerCase();
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return null;
+  let local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  const plus = local.indexOf("+");
+  if (plus > 0) local = local.slice(0, plus);
+  if (GMAIL_DOMAINS.has(domain)) local = local.replaceAll(".", "");
+  if (!local) return null;
+  return local + "@" + domain;
+};
+
+// lib/phone.js
+import { AsYouType, parsePhoneNumberFromString, isValidPhoneNumber } from "libphonenumber-js";
+var toE164 = (value, country) => {
+  if (!value) return null;
+  try {
+    const parsed = parsePhoneNumberFromString(String(value), country);
+    return parsed ? parsed.number : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/connections/providers/shopify.js
+var toLine = ({
+  price,
+  product_id: productId,
+  quantity,
+  title,
+  variant_id: variantId,
+  variant_title: variantTitle
+}) => ({
+  price: parseFloat(price) || 0,
+  productId: productId ? "gid://shopify/Product/" + productId : null,
+  quantity: quantity || 1,
+  title: title || null,
+  variantId: variantId ? "gid://shopify/ProductVariant/" + variantId : null,
+  variantTitle: variantTitle || null
+});
+var attributeLineItems = (lineItems = []) => lineItems.reduce(
+  (acc, item) => {
+    const attrs = (item.properties || []).reduce(
+      (map, { name, value }) => {
+        map[name] = value;
+        return map;
+      },
+      {}
+    );
+    if (!attrs["_drwbrdg_ca"]) return acc;
+    if (!Object.keys(acc.attrMap).length) acc.attrMap = attrs;
+    const line = toLine(item);
+    acc.attributedGross += line.price * line.quantity;
+    acc.attributedLines.push(line);
+    return acc;
+  },
+  { attrMap: {}, attributedGross: 0, attributedLines: [] }
+);
+var generateDiscountCode = customAlphabet2("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
+var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
+var OAUTH_ERROR_SOURCE = "oauth";
+var OAUTH_GRANT_REVOKED_CODES = ["application_cannot_be_found", "invalid_grant"];
 var inbound = {
   headers: {
     event: "x-shopify-topic",
@@ -2355,20 +2850,476 @@ var shopify_default2 = {
       //
       // `shopify` is injected for the same reason it is everywhere else — this
       // package cannot import @drawbridge/shopify, which depends on it.
-      scopes: ({ scope, shopify }) => scope ? shopify.oauth.missingScopes(scope) : null,
+      scopes: ({ scope }, { shopify } = {}) => scope ? shopify.oauth.missingScopes(scope) : null,
       // Shopify's install grant is exchanged inside its own app flow, not
       // through the shared OAuth runner.
       token: false
     },
-    // Implemented in drawbridge-sync, which owns the attribution and the
-    // controllers it needs. Declared here so the steps below can point at them:
-    // a step naming a hook the vendor does not implement is a workflow that
-    // accepts the step and then silently does nothing.
+    // THE VENDOR'S OWN WORK, here in full. Every body describes its writes,
+    // enqueues and events for the shell to perform — see contract.js — and
+    // everything it needs arrives as an argument: `read` (the controller's
+    // read methods, nothing that writes), `shopify` (the SDK, injected because
+    // this package cannot import what depends on it), `adminToken` (minted by
+    // the shell, which persists rotations), `mintId` (so one described write
+    // can reference another), `dispatch` (the caller's own coordinator table,
+    // for the hooks that are dispatches).
     commerce: {
-      code: {},
-      customer: {},
-      order: {},
-      product: {}
+      // MINT A DISCOUNT CODE against the merchant's chosen discount, mapped to
+      // one lead — which is what lets an order that redeems it be attributed
+      // back.
+      code: async ({ connection: connection2, context, step }, { adminToken, shopify } = {}) => {
+        var _a;
+        const discount = (_a = step.settings) == null ? void 0 : _a.discount;
+        const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection2.shop };
+        if (!(context == null ? void 0 : context.email)) return { message: "Lead email is missing.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(context == null ? void 0 : context.lead)) return { message: "Lead id is missing.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(discount == null ? void 0 : discount.id)) return { message: "Discount is not configured on this step.", request: request2, response: { skipped: true }, skipped: true };
+        const adminAccessToken = await adminToken();
+        if (!context.shopifyCustomerId) {
+          const customer = await shopify.admin.getOrCreateCustomer({ adminAccessToken, domain: connection2.shop, email: context.email });
+          if (!(customer == null ? void 0 : customer.id)) return { message: "Shopify did not return a customer id \u2014 create/lookup failed.", request: request2, response: { skipped: true }, skipped: true };
+        }
+        const discountCode = await shopify.admin.createDiscountCode({
+          adminAccessToken,
+          code: "DB-" + generateDiscountCode(),
+          discountId: discount.id,
+          domain: connection2.shop
+        });
+        if (!discountCode) return { message: "Shopify did not return a discount code \u2014 create failed.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          context: {
+            shopifyDiscountCode: discountCode.code,
+            shopifyDiscountId: String(discountCode.id)
+          },
+          message: "Discount code created and linked to lead.",
+          request: request2,
+          response: { code: discountCode.code, id: String(discountCode.id) },
+          // bypassDocumentValidation because these are vendor ids on a
+          // Drawbridge document the schema does not declare — the
+          // canonical-identity work resolves it properly.
+          writes: [{
+            collection: "lead",
+            data: {
+              $set: {
+                shopifyDiscountCode: discountCode.code,
+                shopifyDiscountId: String(discountCode.id)
+              }
+            },
+            operation: "update",
+            options: { bypassDocumentValidation: true },
+            query: { id: context.lead }
+          }]
+        };
+      },
+      // CREATE THE BUYER AT THE STORE, so an order can be attributed to them.
+      //
+      // IDEMPOTENT THREE WAYS, because this runs on every entry and a duplicate
+      // customer at the store is a support ticket: the context may already
+      // carry the id from an earlier step, the lead may already be linked from
+      // an earlier run, and Shopify's own get-or-create settles the rest.
+      customer: async ({ connection: connection2, context }, { adminToken, read, shopify } = {}) => {
+        const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection2.shop };
+        if (!(context == null ? void 0 : context.email)) return { message: "Lead email is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(context == null ? void 0 : context.lead)) return { message: "Lead id is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
+        if (context.shopifyCustomerId) {
+          return {
+            context: { shopifyCustomerId: context.shopifyCustomerId },
+            message: "Trigger data already includes a Shopify customer id \u2014 reusing.",
+            request: request2,
+            response: { shopifyCustomerId: context.shopifyCustomerId },
+            // Reusing an id is not a creation, so it does not bill.
+            skipped: true
+          };
+        }
+        const lead = await read.get({ collection: "lead", query: { id: context.lead } });
+        if (lead == null ? void 0 : lead.shopifyCustomerId) {
+          return {
+            context: { shopifyCustomerId: lead.shopifyCustomerId },
+            message: "Lead already has a Shopify customer id \u2014 reusing.",
+            request: request2,
+            response: { shopifyCustomerId: lead.shopifyCustomerId },
+            skipped: true
+          };
+        }
+        const adminAccessToken = await adminToken();
+        const parts = ((lead == null ? void 0 : lead.name) || "").trim().split(/\s+/).filter(Boolean);
+        const customer = await shopify.admin.getOrCreateCustomer({
+          adminAccessToken,
+          domain: connection2.shop,
+          email: context.email,
+          firstName: parts.length ? parts[0] : null,
+          lastName: parts.length > 1 ? parts.slice(1).join(" ") : null,
+          source: "drawbridge"
+        });
+        if (!(customer == null ? void 0 : customer.id)) return { message: "Shopify did not return a customer id \u2014 create/lookup failed.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          context: { shopifyCustomerId: customer.id },
+          message: "Shopify customer created/linked to lead.",
+          request: request2,
+          response: { shopifyCustomerId: customer.id },
+          // The hook's own result, described beside the call that produced it.
+          writes: [{
+            collection: "lead",
+            data: { $set: { shopifyCustomerId: customer.id } },
+            operation: "update",
+            options: { bypassDocumentValidation: true },
+            query: { id: context.lead }
+          }]
+        };
+      },
+      // AN ORDER ARRIVED AT THE STORE. The largest hook in the family, because
+      // attribution genuinely is: an order can reach Drawbridge two ways and
+      // they bill differently.
+      //
+      //   CONVERSION — a `_drwbrdg_ca` line-item property, injected at
+      //                add-to-cart. Causal: the campaign produced the sale, so
+      //                it carries a fee.
+      //   REDEMPTION — a DB- discount code matched to a lead. Associative: we
+      //                cannot claim we caused the purchase, so it is fee-free.
+      //
+      // Both can be true, and an order already recorded as a conversion can
+      // later have a redemption backfilled onto it — `backfill` below.
+      //
+      // IDEMPOTENT THROUGH THE RETRY, one layer up: two deliveries of the same
+      // order race, the loser's transaction hits a duplicate key, the step
+      // fails and BullMQ redelivers — and the re-run's read at the top finds
+      // what the winner wrote and skips instead of double-billing a merchant
+      // for one purchase. The hook used to loop for this itself; describing
+      // the writes moved the retry to the queue, with the same guarantee.
+      order: async ({ connection: connection2, context }, { logger: logger2, mintId, read } = {}) => {
+        var _a, _b, _c, _d, _e, _f;
+        const {
+          advertisement,
+          created_at: createdAt,
+          currency,
+          customer: orderCustomer,
+          email,
+          id: orderId,
+          line_items: lineItems = [],
+          organization: organization2,
+          phone
+        } = context || {};
+        const request2 = { orderId: orderId ? String(orderId) : null, organization: organization2 };
+        const [existingOrder, existingRedemption] = await Promise.all([
+          read.get({ collection: "order", query: { "provider.id": String(orderId), "provider.slug": "shopify" } }),
+          read.get({ collection: "redemption", query: { "provider.id": String(orderId), "provider.slug": "shopify" } })
+        ]);
+        if (existingRedemption) {
+          return {
+            message: "Order/redemption already recorded \u2014 skipping duplicate.",
+            request: request2,
+            response: {
+              existingOrderId: (existingOrder == null ? void 0 : existingOrder.id) || null,
+              existingRedemptionId: existingRedemption.id,
+              skipped: true
+            },
+            skipped: true
+          };
+        }
+        const backfill = !!existingOrder;
+        const { attrMap, attributedGross, attributedLines } = attributeLineItems(lineItems);
+        const campaign = attrMap["_drwbrdg_ca"] || null;
+        const discountCodes = Array.isArray(context == null ? void 0 : context.discount_codes) ? context.discount_codes : [];
+        const codes = [...new Set(discountCodes.map((dc) => dc == null ? void 0 : dc.code).filter(Boolean))];
+        const matchedLeads = codes.length ? await read.aggregate({
+          collection: "lead",
+          pipeline: [{ $match: { organization: organization2, shopifyDiscountCode: { $in: codes } } }]
+        }) : [];
+        const codeToLead = {};
+        for (const found of matchedLeads) {
+          if (found.shopifyDiscountCode) codeToLead[found.shopifyDiscountCode] = found;
+        }
+        const matchedDiscounts = discountCodes.filter((dc) => (dc == null ? void 0 : dc.code) && codeToLead[dc.code]).map((dc) => ({
+          amount: parseFloat(dc.amount) || 0,
+          code: dc.code,
+          id: codeToLead[dc.code].shopifyDiscountId || null
+        }));
+        const matchedLead = matchedDiscounts.length ? codeToLead[matchedDiscounts[0].code] : null;
+        const discount = matchedDiscounts.length ? {
+          amount: matchedDiscounts.reduce((sum, entry) => sum + entry.amount, 0),
+          codes: matchedDiscounts
+        } : null;
+        const matchedCodes = new Set(matchedDiscounts.map((entry) => entry.code));
+        const unmatched = codes.filter((code2) => code2.startsWith("DB-") && !matchedCodes.has(code2));
+        if (unmatched.length) {
+          (_a = logger2 == null ? void 0 : logger2.warn) == null ? void 0 : _a.call(logger2, "shopify.order.discount.unmatched", {
+            campaign: campaign || null,
+            codes: JSON.stringify(unmatched),
+            isConversion: !!campaign,
+            orderId: String(orderId),
+            organization: organization2
+          });
+        }
+        if (!campaign && !discount || backfill && !discount) {
+          return {
+            message: backfill ? "Order already recorded and no Drawbridge discount code matched \u2014 nothing to backfill." : "Order has no Drawbridge attribution \u2014 not recording.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        let advertisementId = null;
+        let affiliateId = null;
+        let campaignOrganization = organization2;
+        let gross = 0;
+        let leadId = null;
+        let lines = [];
+        let orderCampaign = null;
+        let pageId = null;
+        const isConversion = !!campaign;
+        const customerPhone = toE164((orderCustomer == null ? void 0 : orderCustomer.phone) || phone) || null;
+        const matchPhones = [...new Set([
+          customerPhone,
+          toE164((_b = context == null ? void 0 : context.billing_address) == null ? void 0 : _b.phone),
+          toE164((_c = context == null ? void 0 : context.shipping_address) == null ? void 0 : _c.phone)
+        ].filter(Boolean))];
+        if (isConversion) {
+          const campaignDoc = await read.get({ collection: "campaign", query: { id: campaign } });
+          if (!campaignDoc || campaignDoc.organization !== organization2) {
+            return {
+              message: "Order carried a campaign attribution that does not belong to this store \u2014 not recording.",
+              request: request2,
+              response: { skipped: true },
+              skipped: true
+            };
+          }
+          advertisementId = attrMap["_drwbrdg_ad"] || advertisement || null;
+          affiliateId = attrMap["_drwbrdg_af"] || null;
+          campaignOrganization = campaignDoc.organization;
+          gross = attributedGross;
+          lines = attributedLines;
+          orderCampaign = campaign;
+          pageId = attrMap["_drwbrdg_pg"] || null;
+          const identifiers = [];
+          const canonicalEmail = toCanonicalEmail(email);
+          if (email) identifiers.push({ email: email.toLowerCase() });
+          if (canonicalEmail) identifiers.push({ "canonical.email.value": canonicalEmail });
+          if (matchPhones.length) identifiers.push({ "phone.number": { $in: matchPhones } });
+          if (matchPhones.length) identifiers.push({ "canonical.phone.value": { $in: matchPhones } });
+          if (identifiers.length) {
+            const lead = await read.get({
+              collection: "lead",
+              query: {
+                campaigns: { $in: [campaign] },
+                organization: campaignOrganization,
+                $or: identifiers
+              }
+            });
+            leadId = (lead == null ? void 0 : lead.id) || null;
+            if (!leadId) {
+              const orgLead = await read.get({
+                collection: "lead",
+                query: { organization: campaignOrganization, $or: identifiers }
+              });
+              leadId = (orgLead == null ? void 0 : orgLead.id) || null;
+            }
+          }
+        } else {
+          leadId = matchedLead.id;
+          orderCampaign = (matchedLead.campaigns || []).length === 1 ? matchedLead.campaigns[0] : null;
+          gross = lineItems.reduce((sum, item) => {
+            const line = toLine(item);
+            return sum + line.price * line.quantity;
+          }, 0);
+          lines = lineItems.map(toLine);
+        }
+        const org = await read.get({ collection: "organization", query: { id: campaignOrganization } });
+        let rate = 0;
+        if (isConversion) {
+          const subscription = await read.get({ collection: "subscription", query: { id: org == null ? void 0 : org.subscription } });
+          rate = conversionRate(subscription);
+        }
+        const fee = isConversion ? Math.round(gross * rate) / 100 : 0;
+        const net2 = Math.round((gross - fee) * 100) / 100;
+        const currencyCode = (currency || "usd").toLowerCase();
+        const purchasedAt = new Date(createdAt || Date.now());
+        const customer = orderCustomer || email || phone ? {
+          acceptsMarketing: ((_d = orderCustomer == null ? void 0 : orderCustomer.email_marketing_consent) == null ? void 0 : _d.state) ? orderCustomer.email_marketing_consent.state === "subscribed" : typeof (orderCustomer == null ? void 0 : orderCustomer.accepts_marketing) === "boolean" ? orderCustomer.accepts_marketing : null,
+          email: (orderCustomer == null ? void 0 : orderCustomer.email) || email || null,
+          firstName: (orderCustomer == null ? void 0 : orderCustomer.first_name) || null,
+          id: (orderCustomer == null ? void 0 : orderCustomer.id) ? String(orderCustomer.id) : null,
+          lastName: (orderCustomer == null ? void 0 : orderCustomer.last_name) || null,
+          phone: customerPhone
+        } : null;
+        const source = (connection2 == null ? void 0 : connection2.source) ? { domain: connection2.source.domain, id: connection2.source.id } : void 0;
+        const orderDocId = (existingOrder == null ? void 0 : existingOrder.id) || (isConversion && !backfill ? mintId() : null);
+        const writes = [];
+        if (isConversion && !backfill) {
+          writes.push({
+            collection: "order",
+            data: {
+              advertisement: advertisementId,
+              affiliate: affiliateId,
+              campaign: orderCampaign,
+              currency: currencyCode,
+              customer,
+              discount,
+              fee,
+              gross,
+              id: orderDocId,
+              lead: leadId,
+              lines,
+              net: net2,
+              organization: campaignOrganization,
+              page: pageId,
+              provider: { id: String(orderId), slug: "shopify" },
+              purchasedAt,
+              rate,
+              source,
+              status: "completed"
+            },
+            operation: "create"
+          });
+          if (org == null ? void 0 : org.usage) {
+            writes.push({
+              collection: "usage",
+              data: { $inc: { "totals.revenue": gross } },
+              operation: "update",
+              query: { id: org.usage }
+            });
+          }
+          if (leadId) {
+            writes.push({
+              collection: "lead",
+              data: { $inc: { "totals.orders": 1 } },
+              operation: "update",
+              options: { bypassDocumentValidation: true },
+              query: { id: leadId }
+            });
+          }
+        }
+        if (discount) {
+          writes.push({
+            collection: "redemption",
+            data: {
+              advertisement: advertisementId,
+              affiliate: affiliateId,
+              campaign: orderCampaign,
+              code: ((_e = matchedDiscounts[0]) == null ? void 0 : _e.code) || null,
+              currency: currencyCode,
+              customer,
+              discount,
+              gross,
+              lead: leadId,
+              order: orderDocId,
+              organization: campaignOrganization,
+              page: pageId,
+              provider: { id: String(orderId), slug: "shopify" },
+              purchasedAt,
+              source,
+              status: "completed"
+            },
+            operation: "create"
+          });
+          if (org == null ? void 0 : org.usage) {
+            writes.push({
+              collection: "usage",
+              data: { $inc: { "totals.redemptions": 1 } },
+              operation: "update",
+              query: { id: org.usage }
+            });
+          }
+          if (leadId) {
+            writes.push({
+              collection: "lead",
+              data: { $inc: { "totals.redemptions": 1 } },
+              operation: "update",
+              options: { bypassDocumentValidation: true },
+              query: { id: leadId }
+            });
+          }
+        }
+        const enqueues = (org == null ? void 0 : org.billingProvider) === "shopify" && fee > 0 && ((_f = connection2 == null ? void 0 : connection2.source) == null ? void 0 : _f.id) && !backfill ? [{
+          data: {
+            idempotencyKey: String(orderId),
+            orderDocId,
+            orderId: String(orderId),
+            rate,
+            shopId: connection2.source.id,
+            // The App Events API returns no event id, so one is generated
+            // here — the event handle plus the order id — and sent as the
+            // event's `reference`. queue/usage.js stamps the same id onto
+            // the order as billed.transaction.
+            transaction: "drawbridge-orders." + orderId,
+            value: Math.round(fee * 100)
+          },
+          name: "billing",
+          options: { jobId: "shopify.usage." + orderId },
+          queue: "usage"
+        }] : [];
+        return {
+          enqueues,
+          message: backfill ? "Redemption backfilled for an already-recorded order." : isConversion ? "Order recorded." : "Discount redemption recorded (fee-free).",
+          request: request2,
+          response: {
+            campaign: orderCampaign,
+            currency: currencyCode,
+            discount,
+            fee,
+            gross,
+            lead: leadId,
+            lines: lines.length,
+            net: net2,
+            orderId: String(orderId)
+          },
+          // ONE TRANSACTION. The order, the redemption and both totals
+          // counters land together or not at all — a half-written attribution
+          // is revenue counted twice or not at all, and neither is
+          // recoverable by hand.
+          transaction: writes.length > 0,
+          writes
+        };
+      },
+      // A PRODUCT CHANGED AT THE STORE. Upserts the product row and hands it to
+      // the product pipeline; the actual field sync happens there.
+      //
+      // The shell has already refused a missing or inactive Shopify connection,
+      // so what is left is the two things only this hook can know are wrong.
+      product: async ({ connection: connection2, context, workflow }, { mintId } = {}) => {
+        const request2 = {
+          numericId: (context == null ? void 0 : context.id) || null,
+          organizationId: workflow.organization,
+          title: (context == null ? void 0 : context.title) || null
+        };
+        if (!(context == null ? void 0 : context.id)) return { message: "Skipped \u2014 product webhook payload had no id.", request: request2, response: { skipped: true }, skipped: true };
+        if (!connection2.shop) return { message: "Skipped \u2014 Shopify connection is missing shop domain.", request: request2, response: { skipped: true }, skipped: true };
+        const providerId = "gid://shopify/Product/" + context.id;
+        const productId = mintId();
+        return {
+          enqueues: [{
+            data: { product: productId, providerId, shop: connection2.shop },
+            name: "workflow",
+            options: { jobId: "product.workflow.shopify." + providerId + "." + Date.now() },
+            queue: "product.shopify"
+          }],
+          message: "Product sync queued from Shopify webhook.",
+          request: request2,
+          response: { productId, providerId, title: (context == null ? void 0 : context.title) || null },
+          // KEYED ON PROVIDER + SHOP, so the same product in two stores stays
+          // two rows. `connections` accumulates rather than replaces: one
+          // store can be linked to several organizations, and each keeps its
+          // own claim on the row.
+          writes: [{
+            collection: "product",
+            data: {
+              $addToSet: { connections: connection2.id },
+              $setOnInsert: {
+                id: productId,
+                provider: { id: providerId, slug: "shopify" },
+                "source.id": connection2.id,
+                status: "active"
+              }
+            },
+            operation: "update",
+            options: { upsert: true },
+            query: {
+              "provider.id": providerId,
+              "provider.slug": "shopify",
+              "source.domain": connection2.shop
+            }
+          }]
+        };
+      }
     },
     contacts: { remove: false, sync: false },
     // verify and event lean entirely on the shared HMAC helper — Shopify's
@@ -2386,7 +3337,16 @@ var shopify_default2 = {
     sms: false,
     inbound: {
       event: (args) => readEventHeader({ ...args, descriptor: inbound }),
-      process: {},
+      // One hook over the whole topic table, because that is what this
+      // manifest declares: Shopify processes its own buffered events. The
+      // topic rides in on the context rather than being a second hook name per
+      // topic; the caller's handler table arrives as a prop.
+      process: async ({ context }, { dispatch } = {}) => {
+        const key = "shopify." + (context == null ? void 0 : context.topic);
+        const handled = await dispatch({ data: context == null ? void 0 : context.data, handler: key });
+        if (!handled) return { message: "No handler for " + key, skipped: true };
+        return { message: "Processed " + key, request: { topic: context == null ? void 0 : context.topic } };
+      },
       receive: ({ channel, event, headers, payload }) => {
         if (channel === "compliance" && !COMPLIANCE_TOPICS.has(event)) {
           throw Object.assign(new Error("Unrecognized compliance topic: " + event), { status: 401 });
@@ -2402,7 +3362,107 @@ var shopify_default2 = {
       },
       verify: (args) => verifySignature({ ...args, descriptor: inbound })
     },
-    lifecycle: { cleanup: {}, health: {}, register: {}, rehydrate: {} },
+    lifecycle: {
+      // DISPATCHES INTO THE CALLER'S OWN COORDINATORS. These three are
+      // declarations made true: the work is queue orchestration over
+      // Drawbridge's own collections, which is coordinator work and stays in
+      // the repo that owns the queues. The hook receives the dispatch table as
+      // a prop and picks the entry, so the manifest owns the SEAM — asking
+      // Shopify whether it handles its own lifecycle now gets a real function
+      // instead of `unimplemented` while the work happened anyway.
+      cleanup: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "cleanup" });
+        return { message: "Ran shopify lifecycle.cleanup", request: context || null };
+      },
+      // KEEP STORE ACCESS WORKING. Not a webhook monitor, despite the name the
+      // step once carried — webhooks are declarative, declared in the app's
+      // toml and applied by Shopify to every install, so nothing here registers
+      // or checks them.
+      //
+      // It rotates the refresh token before its window closes, proves the
+      // access token still works, reconciles the scopes the store granted
+      // against the ones the app now needs, and queues a webhook
+      // reconciliation.
+      health: async ({ connection: connection2, workflow }, { adminToken, read, reconcileScopes, resolveSettings, rotateToken, shopify } = {}) => {
+        const request2 = {
+          connectionId: workflow.connection,
+          organizationId: workflow.organization,
+          shop: connection2.shop
+        };
+        const refreshTokenAtStart = (await resolveSettings()).refreshToken || null;
+        try {
+          const adminAccessToken = await adminToken();
+          const settings = await resolveSettings();
+          const refreshTokenExpiresAt = settings.refreshTokenExpiresAt;
+          const needsRotation = refreshTokenExpiresAt && new Date(refreshTokenExpiresAt) < new Date(Date.now() + REFRESH_TOKEN_FRESHNESS_BUFFER_MS);
+          let refreshTokenRotated = false;
+          if (needsRotation) {
+            await rotateToken();
+            refreshTokenRotated = true;
+          }
+          await shopify.oauth.ping({ adminAccessToken, domain: connection2.shop });
+          const scopesMissing = await reconcileScopes({ shop: connection2.shop });
+          return {
+            enqueues: [{
+              data: {
+                data: {
+                  connectionId: workflow.connection,
+                  organizationId: workflow.organization
+                },
+                event: "shopify.register.webhooks"
+              },
+              name: "register",
+              options: { jobId: "connection.update.register." + workflow.connection + "." + randomUUID() },
+              queue: "connection"
+            }],
+            message: (scopesMissing == null ? void 0 : scopesMissing.length) ? "Health check: ping ok, webhooks reconciled \u2014 connection errored, granted scopes are missing: " + scopesMissing.join(", ") + "." : refreshTokenRotated ? "Health check passed \u2014 refresh token rotated, ping ok, webhooks reconciled." : "Health check passed \u2014 ping ok, webhooks reconciled.",
+            request: request2,
+            response: {
+              pingedAt: /* @__PURE__ */ new Date(),
+              refreshTokenExpiresAt: refreshTokenExpiresAt || null,
+              refreshTokenRotated,
+              scopesMissing,
+              webhookReconciliationQueued: true
+            }
+          };
+        } catch (error) {
+          if (OAUTH_GRANT_REVOKED_CODES.includes(error.code)) {
+            const current = await read.get({ collection: "connection", query: { id: connection2.id } });
+            const refreshTokenStored = current ? (await resolveSettings(current)).refreshToken || null : null;
+            const rotated = error.code === "invalid_grant" && refreshTokenStored !== refreshTokenAtStart;
+            if (current && !rotated) {
+              const others = (current.errors || []).filter((entry) => entry.source !== OAUTH_ERROR_SOURCE);
+              error.writes = [{
+                collection: "connection",
+                data: {
+                  $set: {
+                    errors: [
+                      ...others,
+                      {
+                        message: "Shopify disconnected this store. Open the Drawbridge app in your Shopify admin to reconnect.",
+                        source: OAUTH_ERROR_SOURCE
+                      }
+                    ],
+                    status: "error"
+                  }
+                },
+                operation: "update",
+                query: { id: connection2.id }
+              }];
+            }
+          }
+          throw error;
+        }
+      },
+      register: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "register" });
+        return { message: "Ran shopify lifecycle.register", request: context || null };
+      },
+      rehydrate: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "rehydrate" });
+        return { message: "Ran shopify lifecycle.rehydrate", request: context || null };
+      }
+    },
     resources: {
       audiences: false,
       // Shopify has no separate price resource — a price belongs to a product
@@ -2422,7 +3482,7 @@ var shopify_default2 = {
       // credential is the caller's job because it is Drawbridge's job: the
       // admin token refreshes and writes itself back, which is service work,
       // not vendor work.
-      products: async ({ cursor, limit = 100, search, settings, shopify, sort }) => {
+      products: async ({ cursor, limit = 100, search, settings, sort }, { shopify } = {}) => {
         var _a, _b, _c, _d;
         const products = await shopify.storefront.getProducts({
           cursor,
@@ -2442,7 +3502,7 @@ var shopify_default2 = {
           }
         };
       },
-      promotions: async ({ cursor, limit = 100, search, settings, shopify }) => {
+      promotions: async ({ cursor, limit = 100, search, settings }, { shopify } = {}) => {
         var _a, _b;
         const discounts = await shopify.admin.getDiscounts({
           adminAccessToken: settings == null ? void 0 : settings.adminAccessToken,
@@ -2521,9 +3581,6 @@ var shopify_default2 = {
   // workflow document, and those strings cannot be renamed without a backfill.
   //
   // EVERY LEAF IS A FUNCTION so a step can read the merchant's own connection.
-  // The bodies these point at still live in drawbridge-sync; moving them is the
-  // next unit, and commerce.order.record is the one that decides whether the
-  // shape holds — 569 lines and 15 controller calls.
   steps: {
     commerce: {
       code: {
@@ -2628,7 +3685,7 @@ var shopify_default2 = {
   title: "Shopify"
 };
 
-// lib/connections/webhook.js
+// lib/connections/providers/webhook.js
 import crypto from "crypto";
 
 // lib/safe-http.js
@@ -2766,7 +3823,7 @@ var safeRequest = async ({
   }
 };
 
-// lib/connections/webhook.js
+// lib/connections/providers/webhook.js
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -2853,11 +3910,10 @@ var webhook_default = {
     // That is the rule the whole split runs on: a hook lives in sync only if it
     // needs Drawbridge's own database, sockets or queues. This one does not.
     webhook: {
-      send: async ({ context, controller, request: send2 = safeRequest, settings, step }) => {
+      send: async ({ context, lead, settings, step }, { request: send2 = safeRequest } = {}) => {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
-        const lead = (context == null ? void 0 : context.lead) ? await controller.get({ collection: "lead", query: { id: context.lead } }) : null;
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
@@ -3214,19 +4270,24 @@ var isLive = (slug, settings) => {
 };
 var mask = (value) => {
   if (!value) return null;
-  if (String(value).length < 12) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+  if (String(value).length < 16) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
   return String(value).slice(0, 3) + "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" + String(value).slice(-4);
 };
-var cacheKey = (slug) => ["provider", slug];
-var providerSettings = async ({ cache, controller, slug }) => {
-  const read = async () => controller.get({
+var providerMemo = /* @__PURE__ */ new Map();
+var MEMO_TTL_MS = 60 * 1e3;
+var clearProviderMemo = () => providerMemo.clear();
+var providerSettings = async ({ controller, slug }) => {
+  const memoized = providerMemo.get(slug);
+  if (memoized && Date.now() - memoized.at < MEMO_TTL_MS) return memoized.value;
+  const row = await controller.get({
     collection: "provider",
     query: { slug }
   });
-  const row = cache ? await cache.use(cacheKey(slug), read, 30) : await read();
-  return (row == null ? void 0 : row.settings) ? decrypt(row.settings) : {};
+  const value = (row == null ? void 0 : row.settings) ? decrypt(row.settings) : {};
+  providerMemo.set(slug, { at: Date.now(), value });
+  return value;
 };
-var saveProviderSettings = async ({ authenticated, cache, clear, controller, settings, slug }) => {
+var saveProviderSettings = async ({ authenticated, clear, controller, settings, slug }) => {
   const fields2 = providerFields(slug);
   if (!fields2.length) return null;
   const existing = await controller.get({
@@ -3254,37 +4315,35 @@ var saveProviderSettings = async ({ authenticated, cache, clear, controller, set
     },
     query: { slug }
   });
-  await cache.delete(cacheKey(slug));
+  providerMemo.delete(slug);
   return result;
 };
 var providerEnvNames = () => new Set(
   providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.env).filter(Boolean)
 );
-var providerCredentials = async ({ cache, controller }) => {
+var providerCredentials = async ({ controller }) => {
   const credentials2 = {};
   for (const slug of providerSlugs()) {
-    const settings = await providerSettings({ cache, controller, slug });
-    for (const field2 of providerFields(slug)) {
-      const value = settings == null ? void 0 : settings[field2.key];
-      if (field2.env && value) credentials2[field2.env] = value;
+    try {
+      const settings = await providerSettings({ controller, slug });
+      for (const field2 of providerFields(slug)) {
+        const value = settings == null ? void 0 : settings[field2.key];
+        if (field2.env && value) credentials2[field2.env] = value;
+      }
+    } catch {
+      continue;
     }
   }
   return credentials2;
 };
-var hydrateEnvironment = async ({ cache, controller, env = process.env }) => {
-  const credentials2 = await providerCredentials({ cache, controller });
-  for (const name of providerEnvNames()) delete env[name];
-  Object.assign(env, credentials2);
-  return Object.keys(credentials2).sort();
-};
 export {
-  cacheKey,
-  hydrateEnvironment,
+  clearProviderMemo,
   isLive,
   mask,
   providerCredentials,
   providerEnvNames,
   providerFields,
+  providerMemo,
   providerSettings,
   providerSlugs,
   saveProviderSettings