@drawbridge/drawbridge-utils 0.0.121 → 0.0.125

package/dist/providers.d.cts

@@ -1,7 +1,9 @@
-import { mergeSettings } from './connections/index.cjs';
+import { connections, mergeSettings } from './connections/index.cjs';
 import { decrypt, encrypt } from './encrypt.cjs';
 import './connections/oauth.cjs';
 import 'node:crypto';
+import './phone.cjs';
+import 'libphonenumber-js';
 import './http.cjs';
 import './pricing.cjs';
 import './plans.cjs';
@@ -16,8 +18,6 @@ import './billing.cjs';
 import './transactions.cjs';
 import '@drawbridge/drawbridge-telemetry';
 import './email.cjs';
-import './phone.cjs';
-import 'libphonenumber-js';
 import './safe-http.cjs';
 import 'dns';
 import 'node:http';
@@ -42,60 +42,41 @@ import './token.cjs';
 // the others have already rotated away.
 
 
-// WHAT AN ADMIN TYPES IN, per vendor.
+// WHAT AN ADMIN TYPES IN, per vendor — READ FROM THE MANIFESTS.
 //
-// `redact` marks a secret: never returned by the api, and blank on save means
-// keep the stored value. `required` drives the live check. `input` picks the
-// form control.
+// This was a table here, duplicating what every vendor file already knew. A
+// vendor's credentials and its `requires` name the same things, and keeping
+// them in two files meant a manifest could require a name that no admin screen
+// offered to fill — the exact shape of "declared in one place, entered in
+// another" these manifests exist to close.
 //
-// These move onto the manifests themselves as `provider : { fields }` in the
-// follow-up plan, at which point providerFields() delegates to the manifest and
-// this constant goes. It is one table for now because a vendor's credentials and
-// its manifest are declared in the same package either way.
-const FIELDS = {
-	attentive : [
-		{ input : 'text', key : 'clientId', env : 'ATTENTIVE_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'ATTENTIVE_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	drawbridge : [
-		{ input : 'email', key : 'accountSender', env : 'SENDGRID_FROM_ADDRESS', label : 'Account sender', message : 'Verification codes and security alerts send from here.', required : true },
-		{ input : 'password', key : 'apiKey', env : 'SENDGRID_API_KEY', label : 'SendGrid API key', redact : true, required : true },
-		// NOT required. The CRM sync is best-effort internal tooling and no-ops
-		// without a token — requiring it would make the whole drawbridge provider
-		// read not-live over something no merchant ever sees.
-		{ input : 'password', key : 'hubspotToken', env : 'HUBSPOT_ACCESS_TOKEN', label : 'HubSpot access token', message : 'Drawbridge\'s own CRM portal. Internal — no merchant sees this.', redact : true },
-		// Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-		// either. Unset, it degrades to the account sender rather than
-		// refusing to start.
-		{ input : 'email', key : 'leadSender', env : 'SENDGRID_SEND_FROM_ADDRESS', label : 'Lead sender', message : 'The default for lead-facing mail when a merchant has not verified their own domain.' },
-		{ input : 'text', key : 'smsFrom', env : 'TWILIO_ACCOUNT_FROM', label : 'SMS number', required : true },
-		{ input : 'password', key : 'smsSid', env : 'TWILIO_ACCOUNT_SID', label : 'Twilio account SID', redact : true, required : true },
-		{ input : 'password', key : 'smsToken', env : 'TWILIO_AUTH_TOKEN', label : 'Twilio auth token', redact : true, required : true }
-	],
-	klaviyo : [
-		{ input : 'text', key : 'clientId', env : 'KLAVIYO_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'KLAVIYO_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	mailchimp : [
-		{ input : 'text', key : 'clientId', env : 'MAILCHIMP_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'MAILCHIMP_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	shopify : [
-		{ input : 'text', key : 'apiKey', env : 'SHOPIFY_API_KEY', label : 'API key', required : true },
-		{ input : 'password', key : 'apiSecret', env : 'SHOPIFY_API_SECRET', label : 'API secret', redact : true, required : true },
-		{ input : 'text', key : 'appHandle', env : 'SHOPIFY_APP_HANDLE', label : 'App handle', required : true },
-		{ input : 'text', key : 'listingUrl', env : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true }
-	]
-};
-
-// Object.hasOwn, not `FIELDS[ slug ] ||` — a bare property read walks the
-// prototype chain, and FIELDS[ 'constructor' ] is a function whose .length is
-// 1, so the route's "does this vendor exist" guard passed for it and reached
+// Each field's `credential` is the NAME the rest of the system asks for that
+// value by. It is not an environment variable and there is no fallback to one:
+// the names simply began life as env vars and were kept as the vocabulary, so
+// `requires` and auth.oauth.client did not have to change when the storage
+// moved into the database.
+//
+// So the declaration lives on the manifest as `provider : { fields }`, build()
+// checks its shape at import, and this module is now only the reading, memoizing
+// and encrypting around it.
+//
+// Object.hasOwn, not `connections[ slug ] ||` — a bare property read walks the
+// prototype chain, and connections[ 'constructor' ] is a function whose .length
+// is 1, so the route's "does this vendor exist" guard passed for it and reached
 // the database before throwing.
-const providerFields = ( slug ) => Object.hasOwn( FIELDS, slug ) ? FIELDS[ slug ] : [];
+const providerFields = ( slug ) => (
+	Object.hasOwn( connections, slug ) ? ( connections[ slug ].provider?.fields || [] ) : []
+);
 
 // The vendors an admin can configure, in a stable order.
-const providerSlugs = () => Object.keys( FIELDS ).sort();
+//
+// DERIVED FROM WHO DECLARES A PROVIDER BLOCK, not from the catalog: `webhook` is
+// a connection with no vendor behind it — nothing to authenticate against and
+// nothing to type — so it must not appear on a screen whose whole purpose is
+// entering credentials.
+const providerSlugs = () => Object.keys( connections )
+	.filter( ( slug ) => connections[ slug ].provider )
+	.sort();
 
 // LIVE IS DERIVED, never stored. A stored flag is a second thing to keep in
 // sync and goes stale the moment a row is edited by hand.
@@ -270,17 +251,16 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 const providerEnvNames = () => new Set(
 	providerSlugs()
 		.flatMap( ( slug ) => providerFields( slug ) )
-		.map( ( field ) => field.env )
+		.map( ( field ) => field.credential )
 		.filter( Boolean )
 );
 
-// EVERY STORED CREDENTIAL, SHAPED LIKE AN ENVIRONMENT.
+// EVERY STORED CREDENTIAL, KEYED BY ITS NAME.
 //
-// Keyed by the env var each field replaces, because that is the shape the
-// manifests already speak: `requires` names env vars, and auth.oauth.client
-// names them too. Handing availableConnections this map instead of process.env
-// is the whole switch — the package does not change, and 137 call sites in this
-// repo keep reading a plain synchronous object.
+// Keyed by each field's `credential`, because that is the vocabulary the
+// manifests already speak: `requires` names credentials, and auth.oauth.client
+// names them too. Handing availableConnections this map is what makes stored
+// credentials answer the question the manifests were already asking.
 //
 // A field with no value is OMITTED rather than set empty, so `requires` sees
 // the same absence it would for an unset variable.
@@ -307,7 +287,7 @@ const providerCredentials = async ({ controller }) => {
 
 				const value = settings?.[ field.key ];
 
-				if( field.env && value ) credentials[ field.env ] = value;
+				if( field.credential && value ) credentials[ field.credential ] = value;
 
 			}
 

package/dist/providers.d.ts

@@ -1,7 +1,9 @@
-import { mergeSettings } from './connections/index.js';
+import { connections, mergeSettings } from './connections/index.js';
 import { decrypt, encrypt } from './encrypt.js';
 import './connections/oauth.js';
 import 'node:crypto';
+import './phone.js';
+import 'libphonenumber-js';
 import './http.js';
 import './pricing.js';
 import './plans.js';
@@ -16,8 +18,6 @@ import './billing.js';
 import './transactions.js';
 import '@drawbridge/drawbridge-telemetry';
 import './email.js';
-import './phone.js';
-import 'libphonenumber-js';
 import './safe-http.js';
 import 'dns';
 import 'node:http';
@@ -42,60 +42,41 @@ import './token.js';
 // the others have already rotated away.
 
 
-// WHAT AN ADMIN TYPES IN, per vendor.
+// WHAT AN ADMIN TYPES IN, per vendor — READ FROM THE MANIFESTS.
 //
-// `redact` marks a secret: never returned by the api, and blank on save means
-// keep the stored value. `required` drives the live check. `input` picks the
-// form control.
+// This was a table here, duplicating what every vendor file already knew. A
+// vendor's credentials and its `requires` name the same things, and keeping
+// them in two files meant a manifest could require a name that no admin screen
+// offered to fill — the exact shape of "declared in one place, entered in
+// another" these manifests exist to close.
 //
-// These move onto the manifests themselves as `provider : { fields }` in the
-// follow-up plan, at which point providerFields() delegates to the manifest and
-// this constant goes. It is one table for now because a vendor's credentials and
-// its manifest are declared in the same package either way.
-const FIELDS = {
-	attentive : [
-		{ input : 'text', key : 'clientId', env : 'ATTENTIVE_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'ATTENTIVE_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	drawbridge : [
-		{ input : 'email', key : 'accountSender', env : 'SENDGRID_FROM_ADDRESS', label : 'Account sender', message : 'Verification codes and security alerts send from here.', required : true },
-		{ input : 'password', key : 'apiKey', env : 'SENDGRID_API_KEY', label : 'SendGrid API key', redact : true, required : true },
-		// NOT required. The CRM sync is best-effort internal tooling and no-ops
-		// without a token — requiring it would make the whole drawbridge provider
-		// read not-live over something no merchant ever sees.
-		{ input : 'password', key : 'hubspotToken', env : 'HUBSPOT_ACCESS_TOKEN', label : 'HubSpot access token', message : 'Drawbridge\'s own CRM portal. Internal — no merchant sees this.', redact : true },
-		// Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-		// either. Unset, it degrades to the account sender rather than
-		// refusing to start.
-		{ input : 'email', key : 'leadSender', env : 'SENDGRID_SEND_FROM_ADDRESS', label : 'Lead sender', message : 'The default for lead-facing mail when a merchant has not verified their own domain.' },
-		{ input : 'text', key : 'smsFrom', env : 'TWILIO_ACCOUNT_FROM', label : 'SMS number', required : true },
-		{ input : 'password', key : 'smsSid', env : 'TWILIO_ACCOUNT_SID', label : 'Twilio account SID', redact : true, required : true },
-		{ input : 'password', key : 'smsToken', env : 'TWILIO_AUTH_TOKEN', label : 'Twilio auth token', redact : true, required : true }
-	],
-	klaviyo : [
-		{ input : 'text', key : 'clientId', env : 'KLAVIYO_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'KLAVIYO_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	mailchimp : [
-		{ input : 'text', key : 'clientId', env : 'MAILCHIMP_OAUTH_CLIENT_ID', label : 'Client ID', required : true },
-		{ input : 'password', key : 'clientSecret', env : 'MAILCHIMP_OAUTH_CLIENT_SECRET', label : 'Client secret', redact : true, required : true }
-	],
-	shopify : [
-		{ input : 'text', key : 'apiKey', env : 'SHOPIFY_API_KEY', label : 'API key', required : true },
-		{ input : 'password', key : 'apiSecret', env : 'SHOPIFY_API_SECRET', label : 'API secret', redact : true, required : true },
-		{ input : 'text', key : 'appHandle', env : 'SHOPIFY_APP_HANDLE', label : 'App handle', required : true },
-		{ input : 'text', key : 'listingUrl', env : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true }
-	]
-};
-
-// Object.hasOwn, not `FIELDS[ slug ] ||` — a bare property read walks the
-// prototype chain, and FIELDS[ 'constructor' ] is a function whose .length is
-// 1, so the route's "does this vendor exist" guard passed for it and reached
+// Each field's `credential` is the NAME the rest of the system asks for that
+// value by. It is not an environment variable and there is no fallback to one:
+// the names simply began life as env vars and were kept as the vocabulary, so
+// `requires` and auth.oauth.client did not have to change when the storage
+// moved into the database.
+//
+// So the declaration lives on the manifest as `provider : { fields }`, build()
+// checks its shape at import, and this module is now only the reading, memoizing
+// and encrypting around it.
+//
+// Object.hasOwn, not `connections[ slug ] ||` — a bare property read walks the
+// prototype chain, and connections[ 'constructor' ] is a function whose .length
+// is 1, so the route's "does this vendor exist" guard passed for it and reached
 // the database before throwing.
-const providerFields = ( slug ) => Object.hasOwn( FIELDS, slug ) ? FIELDS[ slug ] : [];
+const providerFields = ( slug ) => (
+	Object.hasOwn( connections, slug ) ? ( connections[ slug ].provider?.fields || [] ) : []
+);
 
 // The vendors an admin can configure, in a stable order.
-const providerSlugs = () => Object.keys( FIELDS ).sort();
+//
+// DERIVED FROM WHO DECLARES A PROVIDER BLOCK, not from the catalog: `webhook` is
+// a connection with no vendor behind it — nothing to authenticate against and
+// nothing to type — so it must not appear on a screen whose whole purpose is
+// entering credentials.
+const providerSlugs = () => Object.keys( connections )
+	.filter( ( slug ) => connections[ slug ].provider )
+	.sort();
 
 // LIVE IS DERIVED, never stored. A stored flag is a second thing to keep in
 // sync and goes stale the moment a row is edited by hand.
@@ -270,17 +251,16 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 const providerEnvNames = () => new Set(
 	providerSlugs()
 		.flatMap( ( slug ) => providerFields( slug ) )
-		.map( ( field ) => field.env )
+		.map( ( field ) => field.credential )
 		.filter( Boolean )
 );
 
-// EVERY STORED CREDENTIAL, SHAPED LIKE AN ENVIRONMENT.
+// EVERY STORED CREDENTIAL, KEYED BY ITS NAME.
 //
-// Keyed by the env var each field replaces, because that is the shape the
-// manifests already speak: `requires` names env vars, and auth.oauth.client
-// names them too. Handing availableConnections this map instead of process.env
-// is the whole switch — the package does not change, and 137 call sites in this
-// repo keep reading a plain synchronous object.
+// Keyed by each field's `credential`, because that is the vocabulary the
+// manifests already speak: `requires` names credentials, and auth.oauth.client
+// names them too. Handing availableConnections this map is what makes stored
+// credentials answer the question the manifests were already asking.
 //
 // A field with no value is OMITTED rather than set empty, so `requires` sees
 // the same absence it would for an unset variable.
@@ -307,7 +287,7 @@ const providerCredentials = async ({ controller }) => {
 
 				const value = settings?.[ field.key ];
 
-				if( field.env && value ) credentials[ field.env ] = value;
+				if( field.credential && value ) credentials[ field.credential ] = value;
 
 			}