@drawbridge/drawbridge-utils 0.0.125 → 0.0.127

package/dist/providers.cjs

@@ -221,7 +221,7 @@ var HOOKS = Object.freeze({
   ])
 });
 var HOOK_EFFECTS = Object.freeze(["enqueues", "events", "writes"]);
-var WRITE_OPERATIONS = Object.freeze(["create", "update"]);
+var WRITE_OPERATIONS = Object.freeze(["create", "delete", "update"]);
 var HOOK_PROPS = Object.freeze([
   "channel",
   "clientId",
@@ -815,6 +815,9 @@ var attentive_default2 = {
   title: "Attentive"
 };
 
+// lib/connections/providers/drawbridge.js
+var import_node_crypto2 = require("crypto");
+
 // lib/http.js
 var DEFAULT_TIMEOUT_MS = 15e3;
 var request = async ({
@@ -1007,14 +1010,14 @@ var contacts = {
 
 // lib/connections/icons/drawbridge.js
 var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="#BAEC5F"/>
+<rect width="500" height="500" fill="#0D1314"/>
 <g clip-path="url(#clip0_2115_2832)">
-<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.002 127.523L323.694 108.282L284.949 178.498V321.596L322.924 391.749L359.394 372.79L326.225 311.52V188.73L360.002 127.523Z" fill="#0D1314"/>
+<path d="M153.198 142.241L183.69 196.065V303.852L153 357.676L184.82 375.028L220.116 313.163V186.865L185.046 125L153.198 142.241Z" fill="#BAEC5F"/>
+<path d="M347.002 142.186L314.984 125.249L280.818 187.058V313.025L314.306 374.779L346.465 358.091L317.216 304.156V196.066L347.002 142.186Z" fill="#BAEC5F"/>
 </g>
 <defs>
 <clipPath id="clip0_2115_2832">
-<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
+<rect width="194" height="250" fill="white" transform="translate(153 125)"/>
 </clipPath>
 </defs>
 </svg>`;
@@ -1641,6 +1644,8 @@ var channels = {
 };
 
 // lib/connections/providers/drawbridge.js
+var STOP_KEYWORDS = ["STOP", "STOPALL", "UNSUBSCRIBE", "CANCEL", "END", "QUIT"];
+var START_KEYWORDS = ["START", "UNSTOP", "YES"];
 var interpolate = (template, data2) => {
   if (!template) return template;
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => (data2 == null ? void 0 : data2[key]) != null ? String(data2[key]) : "{{" + key + "}}");
@@ -1868,7 +1873,88 @@ var drawbridge_default2 = {
         };
       }
     },
-    inbound: false,
+    // INBOUND SMS to the platform number. Twilio's webhook, verified and
+    // processed HERE — the manifest owns its own inbound, the same as every
+    // other vendor, and the bespoke webhooks route + the handler that lived in
+    // sync's buffer table are gone.
+    inbound: {
+      // EVERY POST ON THIS CHANNEL IS AN INBOUND MESSAGE. Twilio sends no
+      // topic header — the registered url IS the topic.
+      event: () => "message.inbound",
+      // STOP AND START, AS DESCRIBED WRITES. A withdrawn number is withdrawn
+      // for everyone — organization : null is the platform floor canSend()
+      // reads on every send path. $setOnInsert + upsert so webhook replays
+      // and repeat STOPs collapse onto the unique { channel, address,
+      // organization } index instead of erroring.
+      process: ({ context }) => {
+        var _a, _b;
+        const keyword = String(((_a = context == null ? void 0 : context.data) == null ? void 0 : _a.Body) || "").trim().toUpperCase();
+        const address = toE164((_b = context == null ? void 0 : context.data) == null ? void 0 : _b.From);
+        if (!address) return { message: "Inbound SMS carried no usable sender number.", skipped: true };
+        if (STOP_KEYWORDS.includes(keyword)) {
+          return {
+            message: "STOP recorded \u2014 " + address + " is suppressed on SMS everywhere.",
+            request: { keyword },
+            writes: [{
+              collection: "suppression",
+              data: {
+                $setOnInsert: {
+                  address,
+                  channel: "sms",
+                  organization: null,
+                  reason: keyword,
+                  source: "stop"
+                }
+              },
+              operation: "update",
+              options: { upsert: true },
+              query: {
+                address,
+                channel: "sms",
+                organization: null
+              }
+            }]
+          };
+        }
+        if (START_KEYWORDS.includes(keyword)) {
+          return {
+            message: "START recorded \u2014 " + address + " can receive SMS again.",
+            request: { keyword },
+            writes: [{
+              collection: "suppression",
+              operation: "delete",
+              query: {
+                address,
+                channel: "sms",
+                organization: null
+              }
+            }]
+          };
+        }
+        return { message: "A real reply, not a keyword \u2014 nothing to record.", skipped: true };
+      },
+      receive: ({ payload }) => ({
+        data: payload,
+        provider: { id: (payload == null ? void 0 : payload.MessageSid) || null }
+      }),
+      // TWILIO'S SCHEME, from docs.twilio.com/usage/security: take the full
+      // registered url, sort the POST parameters alphabetically (Unix-style,
+      // case-sensitive), append each name and value with no delimiters, sign
+      // with HMAC-SHA1 keyed by the AuthToken, base64 — compared against
+      // X-Twilio-Signature. It signs the URL rather than the raw body, which
+      // is exactly why the shared body-HMAC verifier cannot cover it and this
+      // hook exists.
+      verify: ({ body, headers, secret, url }) => {
+        if (!secret) throw Object.assign(new Error("Missing webhook secret: TWILIO_AUTH_TOKEN"), { status: 500 });
+        const params = new URLSearchParams(String(body || ""));
+        const signed = url + [...params.keys()].sort().map((key) => key + params.get(key)).join("");
+        const expected = (0, import_node_crypto2.createHmac)("sha1", secret).update(signed).digest("base64");
+        const provided = String((headers == null ? void 0 : headers["x-twilio-signature"]) || "");
+        const matches = expected.length === provided.length && (0, import_node_crypto2.timingSafeEqual)(Buffer.from(expected), Buffer.from(provided));
+        if (!matches) throw Object.assign(new Error("Invalid Twilio signature"), { status: 401 });
+        return Object.fromEntries(params);
+      }
+    },
     lifecycle: false,
     resources: {
       audiences: false,
@@ -2047,6 +2133,18 @@ var drawbridge_default2 = {
     webhook: false
   },
   icon: drawbridge_default,
+  // WHERE TWILIO PUTS THINGS on an inbound request, and WHICH credential
+  // verifies it. `secret` names the drawbridge provider's smsToken — the route
+  // resolves the name to the stored value and hands it to verify.
+  inbound: {
+    headers: {
+      id: "i-twilio-idempotency-token",
+      signature: "x-twilio-signature"
+    },
+    signature: {
+      secret: "TWILIO_AUTH_TOKEN"
+    }
+  },
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
   // THE PLATFORM'S OWN SENDING CREDENTIALS — SendGrid, Twilio, and the internal
@@ -2679,7 +2777,7 @@ var klaviyo_default2 = {
 };
 
 // lib/connections/providers/mailchimp.js
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // lib/connections/icons/mailchimp.js
 var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
@@ -2711,7 +2809,7 @@ var api3 = async (path, { dc, fetcher = fetch, method = "GET", payload, token })
   }
   return response.json();
 };
-var subscriberHash = (email) => (0, import_node_crypto2.createHash)("md5").update(String(email).trim().toLowerCase()).digest("hex");
+var subscriberHash = (email) => (0, import_node_crypto3.createHash)("md5").update(String(email).trim().toLowerCase()).digest("hex");
 var mailchimp_default2 = {
   // OAUTH 2, authorization code. Every url below is quoted from
   // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
@@ -2998,7 +3096,7 @@ var mailchimp_default2 = {
 };
 
 // lib/connections/providers/shopify.js
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_nanoid2 = require("nanoid");
 
 // lib/connections/icons/shopify.js
@@ -3009,7 +3107,7 @@ var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 </svg>`;
 
 // lib/connections/inbound.js
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!secret) {
     throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
@@ -3018,10 +3116,10 @@ var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!provided) {
     throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
   }
-  const digest = (0, import_node_crypto3.createHmac)(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
+  const digest = (0, import_node_crypto4.createHmac)(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
   const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
   const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
-  if (digestBuffer.length !== providedBuffer.length || !(0, import_node_crypto3.timingSafeEqual)(digestBuffer, providedBuffer)) {
+  if (digestBuffer.length !== providedBuffer.length || !(0, import_node_crypto4.timingSafeEqual)(digestBuffer, providedBuffer)) {
     throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
   }
   return JSON.parse(body.toString());
@@ -3760,7 +3858,7 @@ var shopify_default2 = {
                 event: "shopify.register.webhooks"
               },
               name: "register",
-              options: { jobId: "connection.update.register." + workflow.connection + "." + (0, import_node_crypto4.randomUUID)() },
+              options: { jobId: "connection.update.register." + workflow.connection + "." + (0, import_node_crypto5.randomUUID)() },
               queue: "connection"
             }],
             message: (scopesMissing == null ? void 0 : scopesMissing.length) ? "Health check: ping ok, webhooks reconciled \u2014 connection errored, granted scopes are missing: " + scopesMissing.join(", ") + "." : refreshTokenRotated ? "Health check passed \u2014 refresh token rotated, ping ok, webhooks reconciled." : "Health check passed \u2014 ping ok, webhooks reconciled.",
@@ -4047,7 +4145,7 @@ var shopify_default2 = {
 };
 
 // lib/connections/providers/webhook.js
-var import_node_crypto5 = __toESM(require("crypto"), 1);
+var import_node_crypto6 = __toESM(require("crypto"), 1);
 
 // lib/safe-http.js
 var import_dns2 = __toESM(require("dns"), 1);
@@ -4279,7 +4377,7 @@ var webhook_default = {
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto5.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto6.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
         }
         const response = await send2({ body, headers: outgoing, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
@@ -4353,7 +4451,7 @@ var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
 );
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -4432,16 +4530,16 @@ var build = (manifest) => {
       );
     }
   }
-  if (implemented(manifest.hooks, "inbound.event") && !((_l = (_k = manifest.inbound) == null ? void 0 : _k.headers) == null ? void 0 : _l.event)) {
+  if (implemented(manifest.hooks, "inbound.event") && typeof ((_l = (_k = manifest.hooks) == null ? void 0 : _k.inbound) == null ? void 0 : _l.event) !== "function" && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.signature)) {
+  if (implemented(manifest.hooks, "inbound.verify") && !((_p = (_o = manifest.inbound) == null ? void 0 : _o.headers) == null ? void 0 : _p.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
     throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray((_o = manifest == null ? void 0 : manifest.content) == null ? void 0 : _o.guide) || !manifest.content.guide.length) {
+  if (!Array.isArray((_q = manifest == null ? void 0 : manifest.content) == null ? void 0 : _q.guide) || !manifest.content.guide.length) {
     throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
@@ -4453,8 +4551,8 @@ var build = (manifest) => {
   }
   for (const [domain, verbs] of Object.entries(HOOKS)) {
     for (const verb of verbs) {
-      const hook = (_q = (_p = manifest.hooks) == null ? void 0 : _p[domain]) == null ? void 0 : _q[verb];
-      if (((_r = manifest.hooks) == null ? void 0 : _r[domain]) === false) continue;
+      const hook = (_s = (_r = manifest.hooks) == null ? void 0 : _r[domain]) == null ? void 0 : _s[verb];
+      if (((_t = manifest.hooks) == null ? void 0 : _t[domain]) === false) continue;
       if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
         throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
       }
@@ -4642,9 +4740,10 @@ var saveProviderSettings = async ({ authenticated, clear, controller, settings,
     query: { slug }
   });
   const stored = (existing == null ? void 0 : existing.settings) ? decrypt(existing.settings) : {};
+  const pasted = (value) => typeof value === "string" ? value.trim().replace(/^['"]+|['"]+$/g, "") : value;
   const merged = mergeSettings({
     existing: stored,
-    incoming: Object.fromEntries(fields2.map((field2) => [field2.key, settings == null ? void 0 : settings[field2.key]]))
+    incoming: Object.fromEntries(fields2.map((field2) => [field2.key, pasted(settings == null ? void 0 : settings[field2.key])]))
   });
   for (const key of Array.isArray(clear) ? clear : []) {
     if (fields2.some((field2) => field2.key === key)) delete merged[key];

package/dist/providers.d.cts

@@ -191,6 +191,15 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 
 	const stored = existing?.settings ? decrypt( existing.settings ) : {};
 
+	// A CREDENTIAL ARRIVES BY PASTE, and a paste from a shell line or a password
+	// manager brings wrapping quotes and whitespace with it. One stray trailing
+	// `'` on a SendGrid key turned every sign-in email into a silent 401 — no
+	// legitimate credential begins or ends with a quote or a space, so stripping
+	// them here loses nothing and ends the failure mode for every field at once.
+	const pasted = ( value ) => typeof value === 'string'
+		? value.trim().replace( /^['"]+|['"]+$/g, '' )
+		: value;
+
 	// mergeSettings is the blank-keeps rule, already used for merchant
 	// connection settings in route/organization-connection.js — same behaviour,
 	// one implementation. The declared-field allowlist is the part that is ours:
@@ -198,7 +207,7 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 	// not declare reaching the document.
 	const merged = mergeSettings({
 		existing : stored,
-		incoming : Object.fromEntries( fields.map( ( field ) => [ field.key, settings?.[ field.key ] ] ) )
+		incoming : Object.fromEntries( fields.map( ( field ) => [ field.key, pasted( settings?.[ field.key ] ) ] ) )
 	});
 
 	// CLEARING IS EXPLICIT, because blank already means keep and the two cannot

package/dist/providers.d.ts

@@ -191,6 +191,15 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 
 	const stored = existing?.settings ? decrypt( existing.settings ) : {};
 
+	// A CREDENTIAL ARRIVES BY PASTE, and a paste from a shell line or a password
+	// manager brings wrapping quotes and whitespace with it. One stray trailing
+	// `'` on a SendGrid key turned every sign-in email into a silent 401 — no
+	// legitimate credential begins or ends with a quote or a space, so stripping
+	// them here loses nothing and ends the failure mode for every field at once.
+	const pasted = ( value ) => typeof value === 'string'
+		? value.trim().replace( /^['"]+|['"]+$/g, '' )
+		: value;
+
 	// mergeSettings is the blank-keeps rule, already used for merchant
 	// connection settings in route/organization-connection.js — same behaviour,
 	// one implementation. The declared-field allowlist is the part that is ours:
@@ -198,7 +207,7 @@ const saveProviderSettings = async ({ authenticated, clear, controller, settings
 	// not declare reaching the document.
 	const merged = mergeSettings({
 		existing : stored,
-		incoming : Object.fromEntries( fields.map( ( field ) => [ field.key, settings?.[ field.key ] ] ) )
+		incoming : Object.fromEntries( fields.map( ( field ) => [ field.key, pasted( settings?.[ field.key ] ) ] ) )
 	});
 
 	// CLEARING IS EXPLICIT, because blank already means keep and the two cannot

package/dist/providers.js

@@ -177,7 +177,7 @@ var HOOKS = Object.freeze({
   ])
 });
 var HOOK_EFFECTS = Object.freeze(["enqueues", "events", "writes"]);
-var WRITE_OPERATIONS = Object.freeze(["create", "update"]);
+var WRITE_OPERATIONS = Object.freeze(["create", "delete", "update"]);
 var HOOK_PROPS = Object.freeze([
   "channel",
   "clientId",
@@ -771,6 +771,9 @@ var attentive_default2 = {
   title: "Attentive"
 };
 
+// lib/connections/providers/drawbridge.js
+import { createHmac, timingSafeEqual } from "crypto";
+
 // lib/http.js
 var DEFAULT_TIMEOUT_MS = 15e3;
 var request = async ({
@@ -963,14 +966,14 @@ var contacts = {
 
 // lib/connections/icons/drawbridge.js
 var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="#BAEC5F"/>
+<rect width="500" height="500" fill="#0D1314"/>
 <g clip-path="url(#clip0_2115_2832)">
-<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.002 127.523L323.694 108.282L284.949 178.498V321.596L322.924 391.749L359.394 372.79L326.225 311.52V188.73L360.002 127.523Z" fill="#0D1314"/>
+<path d="M153.198 142.241L183.69 196.065V303.852L153 357.676L184.82 375.028L220.116 313.163V186.865L185.046 125L153.198 142.241Z" fill="#BAEC5F"/>
+<path d="M347.002 142.186L314.984 125.249L280.818 187.058V313.025L314.306 374.779L346.465 358.091L317.216 304.156V196.066L347.002 142.186Z" fill="#BAEC5F"/>
 </g>
 <defs>
 <clipPath id="clip0_2115_2832">
-<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
+<rect width="194" height="250" fill="white" transform="translate(153 125)"/>
 </clipPath>
 </defs>
 </svg>`;
@@ -1597,6 +1600,8 @@ var channels = {
 };
 
 // lib/connections/providers/drawbridge.js
+var STOP_KEYWORDS = ["STOP", "STOPALL", "UNSUBSCRIBE", "CANCEL", "END", "QUIT"];
+var START_KEYWORDS = ["START", "UNSTOP", "YES"];
 var interpolate = (template, data2) => {
   if (!template) return template;
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => (data2 == null ? void 0 : data2[key]) != null ? String(data2[key]) : "{{" + key + "}}");
@@ -1824,7 +1829,88 @@ var drawbridge_default2 = {
         };
       }
     },
-    inbound: false,
+    // INBOUND SMS to the platform number. Twilio's webhook, verified and
+    // processed HERE — the manifest owns its own inbound, the same as every
+    // other vendor, and the bespoke webhooks route + the handler that lived in
+    // sync's buffer table are gone.
+    inbound: {
+      // EVERY POST ON THIS CHANNEL IS AN INBOUND MESSAGE. Twilio sends no
+      // topic header — the registered url IS the topic.
+      event: () => "message.inbound",
+      // STOP AND START, AS DESCRIBED WRITES. A withdrawn number is withdrawn
+      // for everyone — organization : null is the platform floor canSend()
+      // reads on every send path. $setOnInsert + upsert so webhook replays
+      // and repeat STOPs collapse onto the unique { channel, address,
+      // organization } index instead of erroring.
+      process: ({ context }) => {
+        var _a, _b;
+        const keyword = String(((_a = context == null ? void 0 : context.data) == null ? void 0 : _a.Body) || "").trim().toUpperCase();
+        const address = toE164((_b = context == null ? void 0 : context.data) == null ? void 0 : _b.From);
+        if (!address) return { message: "Inbound SMS carried no usable sender number.", skipped: true };
+        if (STOP_KEYWORDS.includes(keyword)) {
+          return {
+            message: "STOP recorded \u2014 " + address + " is suppressed on SMS everywhere.",
+            request: { keyword },
+            writes: [{
+              collection: "suppression",
+              data: {
+                $setOnInsert: {
+                  address,
+                  channel: "sms",
+                  organization: null,
+                  reason: keyword,
+                  source: "stop"
+                }
+              },
+              operation: "update",
+              options: { upsert: true },
+              query: {
+                address,
+                channel: "sms",
+                organization: null
+              }
+            }]
+          };
+        }
+        if (START_KEYWORDS.includes(keyword)) {
+          return {
+            message: "START recorded \u2014 " + address + " can receive SMS again.",
+            request: { keyword },
+            writes: [{
+              collection: "suppression",
+              operation: "delete",
+              query: {
+                address,
+                channel: "sms",
+                organization: null
+              }
+            }]
+          };
+        }
+        return { message: "A real reply, not a keyword \u2014 nothing to record.", skipped: true };
+      },
+      receive: ({ payload }) => ({
+        data: payload,
+        provider: { id: (payload == null ? void 0 : payload.MessageSid) || null }
+      }),
+      // TWILIO'S SCHEME, from docs.twilio.com/usage/security: take the full
+      // registered url, sort the POST parameters alphabetically (Unix-style,
+      // case-sensitive), append each name and value with no delimiters, sign
+      // with HMAC-SHA1 keyed by the AuthToken, base64 — compared against
+      // X-Twilio-Signature. It signs the URL rather than the raw body, which
+      // is exactly why the shared body-HMAC verifier cannot cover it and this
+      // hook exists.
+      verify: ({ body, headers, secret, url }) => {
+        if (!secret) throw Object.assign(new Error("Missing webhook secret: TWILIO_AUTH_TOKEN"), { status: 500 });
+        const params = new URLSearchParams(String(body || ""));
+        const signed = url + [...params.keys()].sort().map((key) => key + params.get(key)).join("");
+        const expected = createHmac("sha1", secret).update(signed).digest("base64");
+        const provided = String((headers == null ? void 0 : headers["x-twilio-signature"]) || "");
+        const matches = expected.length === provided.length && timingSafeEqual(Buffer.from(expected), Buffer.from(provided));
+        if (!matches) throw Object.assign(new Error("Invalid Twilio signature"), { status: 401 });
+        return Object.fromEntries(params);
+      }
+    },
     lifecycle: false,
     resources: {
       audiences: false,
@@ -2003,6 +2089,18 @@ var drawbridge_default2 = {
     webhook: false
   },
   icon: drawbridge_default,
+  // WHERE TWILIO PUTS THINGS on an inbound request, and WHICH credential
+  // verifies it. `secret` names the drawbridge provider's smsToken — the route
+  // resolves the name to the stored value and hands it to verify.
+  inbound: {
+    headers: {
+      id: "i-twilio-idempotency-token",
+      signature: "x-twilio-signature"
+    },
+    signature: {
+      secret: "TWILIO_AUTH_TOKEN"
+    }
+  },
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
   // THE PLATFORM'S OWN SENDING CREDENTIALS — SendGrid, Twilio, and the internal
@@ -2965,7 +3063,7 @@ var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 </svg>`;
 
 // lib/connections/inbound.js
-import { createHmac, timingSafeEqual } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!secret) {
     throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
@@ -2974,10 +3072,10 @@ var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!provided) {
     throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
   }
-  const digest = createHmac(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
+  const digest = createHmac2(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
   const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
   const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
-  if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual(digestBuffer, providedBuffer)) {
+  if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual2(digestBuffer, providedBuffer)) {
     throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
   }
   return JSON.parse(body.toString());
@@ -4309,7 +4407,7 @@ var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
 );
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -4388,16 +4486,16 @@ var build = (manifest) => {
       );
     }
   }
-  if (implemented(manifest.hooks, "inbound.event") && !((_l = (_k = manifest.inbound) == null ? void 0 : _k.headers) == null ? void 0 : _l.event)) {
+  if (implemented(manifest.hooks, "inbound.event") && typeof ((_l = (_k = manifest.hooks) == null ? void 0 : _k.inbound) == null ? void 0 : _l.event) !== "function" && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.signature)) {
+  if (implemented(manifest.hooks, "inbound.verify") && !((_p = (_o = manifest.inbound) == null ? void 0 : _o.headers) == null ? void 0 : _p.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
     throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray((_o = manifest == null ? void 0 : manifest.content) == null ? void 0 : _o.guide) || !manifest.content.guide.length) {
+  if (!Array.isArray((_q = manifest == null ? void 0 : manifest.content) == null ? void 0 : _q.guide) || !manifest.content.guide.length) {
     throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
@@ -4409,8 +4507,8 @@ var build = (manifest) => {
   }
   for (const [domain, verbs] of Object.entries(HOOKS)) {
     for (const verb of verbs) {
-      const hook = (_q = (_p = manifest.hooks) == null ? void 0 : _p[domain]) == null ? void 0 : _q[verb];
-      if (((_r = manifest.hooks) == null ? void 0 : _r[domain]) === false) continue;
+      const hook = (_s = (_r = manifest.hooks) == null ? void 0 : _r[domain]) == null ? void 0 : _s[verb];
+      if (((_t = manifest.hooks) == null ? void 0 : _t[domain]) === false) continue;
       if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
         throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
       }
@@ -4598,9 +4696,10 @@ var saveProviderSettings = async ({ authenticated, clear, controller, settings,
     query: { slug }
   });
   const stored = (existing == null ? void 0 : existing.settings) ? decrypt(existing.settings) : {};
+  const pasted = (value) => typeof value === "string" ? value.trim().replace(/^['"]+|['"]+$/g, "") : value;
   const merged = mergeSettings({
     existing: stored,
-    incoming: Object.fromEntries(fields2.map((field2) => [field2.key, settings == null ? void 0 : settings[field2.key]]))
+    incoming: Object.fromEntries(fields2.map((field2) => [field2.key, pasted(settings == null ? void 0 : settings[field2.key])]))
   });
   for (const key of Array.isArray(clear) ? clear : []) {
     if (fields2.some((field2) => field2.key === key)) delete merged[key];

package/package.json

@@ -215,5 +215,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.125"
+  "version": "0.0.127"
 }