@drawbridge/drawbridge-utils 0.0.128 → 0.0.130

package/dist/oauth/server.cjs

@@ -29,6 +29,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/oauth/server.js
 var server_exports = {};
 __export(server_exports, {
+  ROTATION_GRACE_MS: () => ROTATION_GRACE_MS,
   createClient: () => createClient,
   createOAuthModel: () => createOAuthModel,
   createOAuthServer: () => createOAuthServer
@@ -147,6 +148,7 @@ var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
 var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
+var ROTATION_GRACE_MS = 60 * 1e3;
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
@@ -328,12 +330,16 @@ var createOAuthModel = ({ controller }) => ({
     const record = await controller.get({
       collection: "token",
       query: {
-        revoked: false,
         tokenHash,
         type: tokenTypes.refresh
       }
     });
     if (!record) return false;
+    if (record.revoked) {
+      const rotatedAt = record.rotatedAt ? new Date(record.rotatedAt).getTime() : null;
+      if (!rotatedAt || Date.now() - rotatedAt > ROTATION_GRACE_MS) return false;
+    }
+    ;
     return {
       client: { id: record.client },
       refreshToken,
@@ -345,6 +351,15 @@ var createOAuthModel = ({ controller }) => ({
   revokeToken: async (token) => {
     const rawToken = token.refreshToken ?? token.accessToken;
     const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          rotatedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { revoked: { $ne: true }, tokenHash }
+    });
     await controller.update({
       collection: "token",
       data: {
@@ -443,6 +458,7 @@ var createClient = async ({
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ROTATION_GRACE_MS,
   createClient,
   createOAuthModel,
   createOAuthServer

package/dist/oauth/server.d.cts

@@ -34,6 +34,11 @@ import 'crypto';
 // ever need to, store `grants` on the oauth doc and read it here.
 const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
+// How long a just-rotated refresh token keeps answering (see getRefreshToken).
+// Long enough for the parallel requests of one navigation to all land; short
+// enough that a stolen token replayed later is refused like any other.
+const ROTATION_GRACE_MS = 60 * 1000;
+
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
@@ -258,7 +263,6 @@ const createOAuthModel = ({ controller }) => ({
 		const record = await controller.get({
 			collection : 'token',
 			query : {
-				revoked : false,
 				tokenHash,
 				type : tokenTypes.refresh
 			}
@@ -266,6 +270,25 @@ const createOAuthModel = ({ controller }) => ({
 
 		if( ! record ) return false;
 
+		// ROTATION GRACE. Refresh tokens are single-use, and the dashboard's
+		// middleware refreshes on whichever request arrives first — Next fires
+		// several in parallel, so the losers present a token the winner just
+		// consumed. For a short window a JUST-ROTATED token still answers,
+		// so a race mints an extra pair instead of ending the session.
+		//
+		// `rotatedAt` is written ONCE, on the transition into revoked (see
+		// revokeToken) — a replay inside the window cannot refresh it, so the
+		// window closes sixty seconds after the first rotation no matter how
+		// often the old token is replayed. A token revoked WITHOUT rotatedAt
+		// was killed on purpose — signout, an admin, a deleted client — and
+		// gets no grace: those revocations must be absolute.
+		if( record.revoked ){
+
+			const rotatedAt = record.rotatedAt ? new Date( record.rotatedAt ).getTime() : null;
+
+			if( ! rotatedAt || ( Date.now() - rotatedAt ) > ROTATION_GRACE_MS ) return false;
+
+		}
 		return {
 			client : { id : record.client },
 			refreshToken,
@@ -281,6 +304,20 @@ const createOAuthModel = ({ controller }) => ({
 		const rawToken = token.refreshToken ?? token.accessToken;
 		const tokenHash = hashToken( rawToken );
 
+		// rotatedAt marks that this revocation IS a rotation — the only kind
+		// getRefreshToken graces. Guarded on the transition (revoked $ne true)
+		// so a grace-window replay re-revoking the same row cannot move the
+		// stamp and hold the window open.
+		await controller.update({
+			collection : 'token',
+			data : {
+				$set : {
+					rotatedAt : new Date()
+				}
+			},
+			query : { revoked : { $ne : true }, tokenHash }
+		});
+
 		await controller.update({
 			collection : 'token',
 			data : {
@@ -411,4 +448,4 @@ const createClient = async ({
 
 };
 
-export { createClient, createOAuthModel, createOAuthServer };
+export { ROTATION_GRACE_MS, createClient, createOAuthModel, createOAuthServer };

package/dist/oauth/server.d.ts

@@ -34,6 +34,11 @@ import 'crypto';
 // ever need to, store `grants` on the oauth doc and read it here.
 const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
+// How long a just-rotated refresh token keeps answering (see getRefreshToken).
+// Long enough for the parallel requests of one navigation to all land; short
+// enough that a stolen token replayed later is refused like any other.
+const ROTATION_GRACE_MS = 60 * 1000;
+
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
@@ -258,7 +263,6 @@ const createOAuthModel = ({ controller }) => ({
 		const record = await controller.get({
 			collection : 'token',
 			query : {
-				revoked : false,
 				tokenHash,
 				type : tokenTypes.refresh
 			}
@@ -266,6 +270,25 @@ const createOAuthModel = ({ controller }) => ({
 
 		if( ! record ) return false;
 
+		// ROTATION GRACE. Refresh tokens are single-use, and the dashboard's
+		// middleware refreshes on whichever request arrives first — Next fires
+		// several in parallel, so the losers present a token the winner just
+		// consumed. For a short window a JUST-ROTATED token still answers,
+		// so a race mints an extra pair instead of ending the session.
+		//
+		// `rotatedAt` is written ONCE, on the transition into revoked (see
+		// revokeToken) — a replay inside the window cannot refresh it, so the
+		// window closes sixty seconds after the first rotation no matter how
+		// often the old token is replayed. A token revoked WITHOUT rotatedAt
+		// was killed on purpose — signout, an admin, a deleted client — and
+		// gets no grace: those revocations must be absolute.
+		if( record.revoked ){
+
+			const rotatedAt = record.rotatedAt ? new Date( record.rotatedAt ).getTime() : null;
+
+			if( ! rotatedAt || ( Date.now() - rotatedAt ) > ROTATION_GRACE_MS ) return false;
+
+		}
 		return {
 			client : { id : record.client },
 			refreshToken,
@@ -281,6 +304,20 @@ const createOAuthModel = ({ controller }) => ({
 		const rawToken = token.refreshToken ?? token.accessToken;
 		const tokenHash = hashToken( rawToken );
 
+		// rotatedAt marks that this revocation IS a rotation — the only kind
+		// getRefreshToken graces. Guarded on the transition (revoked $ne true)
+		// so a grace-window replay re-revoking the same row cannot move the
+		// stamp and hold the window open.
+		await controller.update({
+			collection : 'token',
+			data : {
+				$set : {
+					rotatedAt : new Date()
+				}
+			},
+			query : { revoked : { $ne : true }, tokenHash }
+		});
+
 		await controller.update({
 			collection : 'token',
 			data : {
@@ -411,4 +448,4 @@ const createClient = async ({
 
 };
 
-export { createClient, createOAuthModel, createOAuthServer };
+export { ROTATION_GRACE_MS, createClient, createOAuthModel, createOAuthServer };

package/dist/oauth/server.js

@@ -112,6 +112,7 @@ var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
 var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
+var ROTATION_GRACE_MS = 60 * 1e3;
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
@@ -293,12 +294,16 @@ var createOAuthModel = ({ controller }) => ({
     const record = await controller.get({
       collection: "token",
       query: {
-        revoked: false,
         tokenHash,
         type: tokenTypes.refresh
       }
     });
     if (!record) return false;
+    if (record.revoked) {
+      const rotatedAt = record.rotatedAt ? new Date(record.rotatedAt).getTime() : null;
+      if (!rotatedAt || Date.now() - rotatedAt > ROTATION_GRACE_MS) return false;
+    }
+    ;
     return {
       client: { id: record.client },
       refreshToken,
@@ -310,6 +315,15 @@ var createOAuthModel = ({ controller }) => ({
   revokeToken: async (token) => {
     const rawToken = token.refreshToken ?? token.accessToken;
     const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          rotatedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { revoked: { $ne: true }, tokenHash }
+    });
     await controller.update({
       collection: "token",
       data: {
@@ -407,6 +421,7 @@ var createClient = async ({
   };
 };
 export {
+  ROTATION_GRACE_MS,
   createClient,
   createOAuthModel,
   createOAuthServer

package/dist/pricing.cjs

@@ -40,6 +40,7 @@ __export(pricing_exports, {
   channels: () => channels,
   conversionRate: () => conversionRate,
   free: () => free,
+  numbers: () => numbers,
   plans: () => plans,
   resolvePlan: () => resolvePlan,
   scrape: () => scrape,
@@ -883,6 +884,11 @@ var channels = {
     includedInAllowance: false
   }
 };
+var numbers = {
+  sms: {
+    monthlyCents: 1500
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LOCAL_FLAT_CENTS,
@@ -896,6 +902,7 @@ var channels = {
   channels,
   conversionRate,
   free,
+  numbers,
   plans,
   resolvePlan,
   scrape,

package/dist/pricing.d.cts

@@ -189,4 +189,20 @@ const channels = {
 	}
 };
 
-export { channels, sending };
+// The dedicated SMS number — a RECURRING SUBSCRIPTION ITEM, not an action:
+// the carrier bills for holding the number whether or not it sends, so it
+// joins the organization's subscription as its own line and leaves when the
+// number is released. CENTS per month, like every stored money value.
+//
+// $15 was DECIDED in the platform-sender pricing session (2026-08-30): it
+// covers the worst case of number rental (~$1-2) + carrier campaign fees
+// (~$2-15) + amortized A2P registration, in line with what SMS platforms
+// charge for a dedicated number. Changing it is this one line plus the
+// matching Stripe Price.
+const numbers = {
+	sms : {
+		monthlyCents : 1500
+	}
+};
+
+export { channels, numbers, sending };

package/dist/pricing.d.ts

@@ -189,4 +189,20 @@ const channels = {
 	}
 };
 
-export { channels, sending };
+// The dedicated SMS number — a RECURRING SUBSCRIPTION ITEM, not an action:
+// the carrier bills for holding the number whether or not it sends, so it
+// joins the organization's subscription as its own line and leaves when the
+// number is released. CENTS per month, like every stored money value.
+//
+// $15 was DECIDED in the platform-sender pricing session (2026-08-30): it
+// covers the worst case of number rental (~$1-2) + carrier campaign fees
+// (~$2-15) + amortized A2P registration, in line with what SMS platforms
+// charge for a dedicated number. Changing it is this one line plus the
+// matching Stripe Price.
+const numbers = {
+	sms : {
+		monthlyCents : 1500
+	}
+};
+
+export { channels, numbers, sending };

package/dist/pricing.js

@@ -833,6 +833,11 @@ var channels = {
     includedInAllowance: false
   }
 };
+var numbers = {
+  sms: {
+    monthlyCents: 1500
+  }
+};
 export {
   LOCAL_FLAT_CENTS,
   MARKUP,
@@ -845,6 +850,7 @@ export {
   channels,
   conversionRate,
   free,
+  numbers,
   plans,
   resolvePlan,
   scrape,

package/dist/twilio.cjs

@@ -113,8 +113,9 @@ var twilio = {
   //          body: PhoneNumber (E.164), SmsUrl, SmsMethod
   //   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
   // Basic auth throughout, like Messages.
-  searchNumbers: async ({ accountSid, areaCode, authToken, country = "US", limit = 10, request: request2 = request }) => {
+  searchNumbers: async ({ accountSid, areaCode, authToken, contains, country = "US", cursor, limit = 10, request: request2 = request }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");
+    const [page, token] = String(cursor || "").split("~");
     const result = await request2({
       method: "GET",
       url: "https://api.twilio.com/2010-04-01/Accounts/" + accountSid + "/AvailablePhoneNumbers/" + country + "/Local.json",
@@ -124,14 +125,24 @@ var twilio = {
       query: {
         SmsEnabled: true,
         PageSize: limit,
-        ...areaCode && { AreaCode: areaCode }
+        ...areaCode && { AreaCode: areaCode },
+        // `Contains` is the vendor's matching-pattern filter — digits
+        // match anywhere in the number, so one search box serves "my
+        // area code" and "ends in 7777" alike.
+        ...contains && { Contains: contains },
+        ...token && { Page: page, PageToken: token }
       }
     });
-    return ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({
-      friendly: entry.friendly_name,
-      locality: entry.locality || entry.region || null,
-      number: entry.phone_number
-    }));
+    const nextQuery = (result == null ? void 0 : result.next_page_uri) ? new URLSearchParams(String(result.next_page_uri).split("?")[1] || "") : null;
+    const nextToken = nextQuery == null ? void 0 : nextQuery.get("PageToken");
+    return {
+      cursor: nextToken ? (nextQuery.get("Page") || "") + "~" + nextToken : null,
+      items: ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({
+        friendly: entry.friendly_name,
+        locality: entry.locality || entry.region || null,
+        number: entry.phone_number
+      }))
+    };
   },
   purchaseNumber: async ({ accountSid, authToken, number, request: request2 = request, smsUrl }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");

package/dist/twilio.d.cts

@@ -77,10 +77,16 @@ const twilio = {
 	//   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
 	// Basic auth throughout, like Messages.
 
-	searchNumbers : async ({ accountSid, areaCode, authToken, country = 'US', limit = 10, request: request$1 = request }) => {
+	searchNumbers : async ({ accountSid, areaCode, authToken, contains, country = 'US', cursor, limit = 10, request: request$1 = request }) => {
 
 		if( ! accountSid || ! authToken ) throw new Error( 'Twilio credentials missing — accountSid, authToken' );
 
+		// The vendor pages with Page + PageToken and answers next_page_uri
+		// (AvailablePhoneNumbers resource docs). Ours is one opaque cursor —
+		// `<Page>~<PageToken>` — so the caller never learns the vendor's two
+		// halves and cannot recombine them wrong.
+		const [ page, token ] = String( cursor || '' ).split( '~' );
+
 		const result = await request$1({
 			method : 'GET',
 			url : 'https://api.twilio.com/2010-04-01/Accounts/' + accountSid + '/AvailablePhoneNumbers/' + country + '/Local.json',
@@ -90,16 +96,30 @@ const twilio = {
 			query : {
 				SmsEnabled : true,
 				PageSize : limit,
-				...( areaCode && { AreaCode : areaCode } )
+				...( areaCode && { AreaCode : areaCode } ),
+				// `Contains` is the vendor's matching-pattern filter — digits
+				// match anywhere in the number, so one search box serves "my
+				// area code" and "ends in 7777" alike.
+				...( contains && { Contains : contains } ),
+				...( token && { Page : page, PageToken : token } )
 			}
 		});
 
+		const nextQuery = result?.next_page_uri
+			? new URLSearchParams( String( result.next_page_uri ).split( '?' )[ 1 ] || '' )
+			: null;
+
+		const nextToken = nextQuery?.get( 'PageToken' );
+
 		// The caller-facing shape is ours; the vendor's field names stay here.
-		return ( result?.available_phone_numbers || [] ).map( ( entry ) => ({
-			friendly : entry.friendly_name,
-			locality : entry.locality || entry.region || null,
-			number : entry.phone_number
-		}) );
+		return {
+			cursor : nextToken ? ( nextQuery.get( 'Page' ) || '' ) + '~' + nextToken : null,
+			items : ( result?.available_phone_numbers || [] ).map( ( entry ) => ({
+				friendly : entry.friendly_name,
+				locality : entry.locality || entry.region || null,
+				number : entry.phone_number
+			}) )
+		};
 
 	},
 

package/dist/twilio.d.ts

@@ -77,10 +77,16 @@ const twilio = {
 	//   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
 	// Basic auth throughout, like Messages.
 
-	searchNumbers : async ({ accountSid, areaCode, authToken, country = 'US', limit = 10, request: request$1 = request }) => {
+	searchNumbers : async ({ accountSid, areaCode, authToken, contains, country = 'US', cursor, limit = 10, request: request$1 = request }) => {
 
 		if( ! accountSid || ! authToken ) throw new Error( 'Twilio credentials missing — accountSid, authToken' );
 
+		// The vendor pages with Page + PageToken and answers next_page_uri
+		// (AvailablePhoneNumbers resource docs). Ours is one opaque cursor —
+		// `<Page>~<PageToken>` — so the caller never learns the vendor's two
+		// halves and cannot recombine them wrong.
+		const [ page, token ] = String( cursor || '' ).split( '~' );
+
 		const result = await request$1({
 			method : 'GET',
 			url : 'https://api.twilio.com/2010-04-01/Accounts/' + accountSid + '/AvailablePhoneNumbers/' + country + '/Local.json',
@@ -90,16 +96,30 @@ const twilio = {
 			query : {
 				SmsEnabled : true,
 				PageSize : limit,
-				...( areaCode && { AreaCode : areaCode } )
+				...( areaCode && { AreaCode : areaCode } ),
+				// `Contains` is the vendor's matching-pattern filter — digits
+				// match anywhere in the number, so one search box serves "my
+				// area code" and "ends in 7777" alike.
+				...( contains && { Contains : contains } ),
+				...( token && { Page : page, PageToken : token } )
 			}
 		});
 
+		const nextQuery = result?.next_page_uri
+			? new URLSearchParams( String( result.next_page_uri ).split( '?' )[ 1 ] || '' )
+			: null;
+
+		const nextToken = nextQuery?.get( 'PageToken' );
+
 		// The caller-facing shape is ours; the vendor's field names stay here.
-		return ( result?.available_phone_numbers || [] ).map( ( entry ) => ({
-			friendly : entry.friendly_name,
-			locality : entry.locality || entry.region || null,
-			number : entry.phone_number
-		}) );
+		return {
+			cursor : nextToken ? ( nextQuery.get( 'Page' ) || '' ) + '~' + nextToken : null,
+			items : ( result?.available_phone_numbers || [] ).map( ( entry ) => ({
+				friendly : entry.friendly_name,
+				locality : entry.locality || entry.region || null,
+				number : entry.phone_number
+			}) )
+		};
 
 	},
 

package/dist/twilio.js

@@ -88,8 +88,9 @@ var twilio = {
   //          body: PhoneNumber (E.164), SmsUrl, SmsMethod
   //   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
   // Basic auth throughout, like Messages.
-  searchNumbers: async ({ accountSid, areaCode, authToken, country = "US", limit = 10, request: request2 = request }) => {
+  searchNumbers: async ({ accountSid, areaCode, authToken, contains, country = "US", cursor, limit = 10, request: request2 = request }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");
+    const [page, token] = String(cursor || "").split("~");
     const result = await request2({
       method: "GET",
       url: "https://api.twilio.com/2010-04-01/Accounts/" + accountSid + "/AvailablePhoneNumbers/" + country + "/Local.json",
@@ -99,14 +100,24 @@ var twilio = {
       query: {
         SmsEnabled: true,
         PageSize: limit,
-        ...areaCode && { AreaCode: areaCode }
+        ...areaCode && { AreaCode: areaCode },
+        // `Contains` is the vendor's matching-pattern filter — digits
+        // match anywhere in the number, so one search box serves "my
+        // area code" and "ends in 7777" alike.
+        ...contains && { Contains: contains },
+        ...token && { Page: page, PageToken: token }
       }
     });
-    return ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({
-      friendly: entry.friendly_name,
-      locality: entry.locality || entry.region || null,
-      number: entry.phone_number
-    }));
+    const nextQuery = (result == null ? void 0 : result.next_page_uri) ? new URLSearchParams(String(result.next_page_uri).split("?")[1] || "") : null;
+    const nextToken = nextQuery == null ? void 0 : nextQuery.get("PageToken");
+    return {
+      cursor: nextToken ? (nextQuery.get("Page") || "") + "~" + nextToken : null,
+      items: ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({
+        friendly: entry.friendly_name,
+        locality: entry.locality || entry.region || null,
+        number: entry.phone_number
+      }))
+    };
   },
   purchaseNumber: async ({ accountSid, authToken, number, request: request2 = request, smsUrl }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");

package/package.json

@@ -215,5 +215,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.128"
+  "version": "0.0.130"
 }