@drawbridge/drawbridge-utils 0.0.143 → 0.0.145

package/dist/connections/index.cjs

@@ -3366,6 +3366,26 @@ var toCanonicalEmail = (value) => {
   return local + "@" + domain;
 };
 
+// lib/encrypt.js
+var import_crypto = __toESM(require("crypto"), 1);
+var ALGORITHM = "aes-256-gcm";
+var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
+var decrypt = (value) => {
+  if (typeof value !== "string") return value;
+  const [ivHex, tagHex, dataHex] = value.split(":");
+  const decipher = import_crypto.default.createDecipheriv(
+    ALGORITHM,
+    getKey(),
+    Buffer.from(ivHex, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  const result = Buffer.concat([
+    decipher.update(Buffer.from(dataHex, "hex")),
+    decipher.final()
+  ]);
+  return JSON.parse(result.toString("utf8"));
+};
+
 // lib/slugify.js
 var import_slugify = __toESM(require("slugify"), 1);
 var slugify = (value, nochars = false) => {
@@ -3420,6 +3440,8 @@ var generateDiscountCode = (0, import_nanoid2.customAlphabet)("0123456789ABCDEFG
 var ORDER_EVENT_HANDLE = slugify("drawbridge-orders");
 var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
 var OAUTH_ERROR_SOURCE = "oauth";
+var BILLING_ERROR_SOURCE = "billing";
+var BILLING_ERROR_MESSAGE = "Order billing isn't set up for this store \u2014 reselect and approve the plan from the Shopify connection page.";
 var OAUTH_GRANT_REVOKED_CODES = ["application_cannot_be_found", "invalid_grant"];
 var inbound = {
   headers: {
@@ -3940,6 +3962,9 @@ var shopify_default2 = {
           }
         }
         const billable = (org == null ? void 0 : org.billingProvider) === "shopify" && fee > 0 && !backfill;
+        const providerRow = billable ? await read.get({ collection: "provider", query: { slug: "shopify" } }) : null;
+        const { orderEventHandle } = (providerRow == null ? void 0 : providerRow.settings) ? decrypt(providerRow.settings) : {};
+        const handle = typeof orderEventHandle === "string" && slugify(orderEventHandle) || ORDER_EVENT_HANDLE;
         if (billable && !((_f = connection2 == null ? void 0 : connection2.source) == null ? void 0 : _f.id)) {
           (_g = logger2 == null ? void 0 : logger2.error) == null ? void 0 : _g.call(logger2, new Error(
             "shopify.usage.billing.skipped on order " + orderId + ": " + Math.round(fee * 100) + " cents not billed \u2014 connection " + (connection2 == null ? void 0 : connection2.id) + " has no source.id"
@@ -3958,7 +3983,7 @@ var shopify_default2 = {
             // verify it against the transaction prefix and refuse a
             // drifted pair — idempotency keys are permanent, so a
             // mistraceable event can never be resent under its own key.
-            handle: ORDER_EVENT_HANDLE,
+            handle,
             idempotencyKey: String(orderId),
             orderDocId,
             orderId: String(orderId),
@@ -3968,7 +3993,7 @@ var shopify_default2 = {
             // here — the event handle plus the order id — and sent as the
             // event's `reference`. queue/usage.js stamps the same id onto
             // the order as billed.transaction.
-            transaction: ORDER_EVENT_HANDLE + "." + orderId,
+            transaction: handle + "." + orderId,
             value: Math.round(fee * 100)
           },
           name: "billing",
@@ -4173,6 +4198,46 @@ var shopify_default2 = {
               query: { id: connection2.id }
             });
           }
+          const hasBillingIssue = (connection2.errors || []).some((entry) => entry.source === BILLING_ERROR_SOURCE);
+          if (metered === null && !hasBillingIssue) {
+            writes.push({
+              collection: "connection",
+              data: {
+                $push: {
+                  errors: {
+                    message: BILLING_ERROR_MESSAGE,
+                    source: BILLING_ERROR_SOURCE
+                  }
+                }
+              },
+              operation: "update",
+              query: { id: connection2.id }
+            });
+          }
+          if (typeof metered === "string" && hasBillingIssue) {
+            writes.push({
+              collection: "connection",
+              data: {
+                $pull: {
+                  errors: { source: BILLING_ERROR_SOURCE }
+                }
+              },
+              operation: "update",
+              query: { id: connection2.id }
+            });
+            writes.push({
+              collection: "connection",
+              data: {
+                $set: { status: "active" }
+              },
+              operation: "update",
+              query: {
+                id: connection2.id,
+                status: "error",
+                "errors.0": { $exists: false }
+              }
+            });
+          }
           return {
             writes,
             enqueues: [{
@@ -4337,7 +4402,15 @@ var shopify_default2 = {
       { input: "text", key: "apiKey", credential: "SHOPIFY_API_KEY", label: "API key", required: true },
       { input: "password", key: "apiSecret", credential: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
       { input: "text", key: "appHandle", credential: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
-      { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
+      { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true },
+      // The usage meter's event handle, when the plan config's meter ever
+      // changes: stored value overrides the built-in default
+      // (events.order.handle) at the mint point, and `format : 'slug'`
+      // normalizes it on save — a handle can carry no spaces or capitals,
+      // and classification against it is case-sensitive. Optional: empty
+      // means the default, and the sender still refuses any handle that
+      // disagrees with the transaction it minted.
+      { format: "slug", input: "text", key: "orderEventHandle", label: "Order event handle", required: false, setting: true }
     ]
   },
   // A pre-launch integration: it only surfaces once the App Store listing
@@ -4355,9 +4428,18 @@ var shopify_default2 = {
   // there is nothing further to choose. `shop` absent means the install did not
   // finish, which is a credential problem rather than a setup one, so the
   // stored status already says so.
-  // Nothing to add — no setting can make this connection unusable, so the
-  // credential's own verdict stands.
-  status: (data2) => data2 == null ? void 0 : data2.status,
+  //
+  // ONE presentation downgrade: an ACTIVE store whose approval carries no
+  // usage meter (source.metered explicitly null) PRESENTS as error, so the
+  // connections list shows the red state and the merchant knows to click in
+  // — where the Fix-order-billing card and the billing Issue explain the
+  // click. The STORED status stays active on purpose: serving and tracking
+  // gate on it, and the orders recorded while the merchant fixes the plan
+  // are the ones billed afterward.
+  status: (data2) => {
+    var _a;
+    return (data2 == null ? void 0 : data2.status) === "active" && ((_a = data2 == null ? void 0 : data2.source) == null ? void 0 : _a.metered) === null ? "error" : data2 == null ? void 0 : data2.status;
+  },
   // Step types name the CAPABILITY, not this vendor. A second store platform
   // implements the same four commerce steps, and the connection on the step
   // says which store it runs against — so a merchant sees one "Create
@@ -4479,8 +4561,9 @@ var shopify_default2 = {
       ...(data2 == null ? void 0 : data2.status) === "pending" ? [
         {
           action: "billing",
-          message: "Approve the Drawbridge plan to activate this connection. You'll confirm the pricing on Shopify, then everything else happens here.",
-          title: "Approve your plan"
+          message: "Approve the Drawbridge plan to activate this connection. You'll be asked to select a plan on Shopify, then everything else happens here.",
+          title: "Approve your plan",
+          type: "warning"
         }
       ] : [],
       // The store's ACTIVE approval carries no usage component — stamped by
@@ -4493,8 +4576,9 @@ var shopify_default2 = {
       ...(data2 == null ? void 0 : data2.status) === "active" && ((_a = data2 == null ? void 0 : data2.source) == null ? void 0 : _a.metered) === null ? [
         {
           action: "billing",
-          message: "Order billing isn't set up for this store, so campaign-attributed orders aren't being charged. Approve the updated plan to fix it \u2014 one click here, one confirmation on Shopify.",
-          title: "Fix order billing"
+          message: "Order billing isn't set up for this store, so campaign-attributed orders aren't being charged. You'll need to reselect your plan on Shopify and approve it to fix this.",
+          title: "Fix order billing",
+          type: "error"
         }
       ] : []
     ];
@@ -5100,6 +5184,11 @@ var publicConnectionKeys = Object.freeze([
   "settings",
   "shop",
   "slug",
+  // Vendor identity plus the metered billing stamp — domain, id, label,
+  // metered — no credentials live here (those are the encrypted settings
+  // blob). The status and tasks hooks pivot on source.metered, so stripping
+  // it here left the presented status blind to the one state it must show.
+  "source",
   "status",
   "tasks",
   "title",

package/dist/connections/index.d.cts

@@ -7,6 +7,7 @@ import { channels } from '../pricing.cjs';
 import { customAlphabet } from 'nanoid';
 import { toCanonicalEmail } from '../email.cjs';
 import { conversionRate } from '../plans.cjs';
+import { decrypt } from '../encrypt.cjs';
 import { slugify } from '../slugify.cjs';
 import { safeRequest } from '../safe-http.cjs';
 import 'libphonenumber-js';
@@ -19,6 +20,8 @@ import '../index.cjs';
 import 'currency-codes';
 import '../color.cjs';
 import 'tinycolor2';
+import 'crypto';
+import '../token.cjs';
 import 'slugify';
 import 'dns';
 import 'node:http';
@@ -3869,6 +3872,13 @@ const REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1000;
 
 const OAUTH_ERROR_SOURCE = 'oauth';
 
+// The billing Issue a probed-unmetered store carries in its connection
+// errors, written and cleared beside the source.metered stamp (health check
+// and drawbridge-sync's approval restamp share the source tag). One string,
+// used by both writers, so the entries dedupe and $pull cleanly.
+const BILLING_ERROR_SOURCE = 'billing';
+const BILLING_ERROR_MESSAGE = 'Order billing isn\'t set up for this store — reselect and approve the plan from the Shopify connection page.';
+
 // What Shopify says when the merchant has uninstalled or revoked. Neither is
 // retryable and both mean the same thing to a merchant: reconnect.
 const OAUTH_GRANT_REVOKED_CODES = [ 'application_cannot_be_found', 'invalid_grant' ];
@@ -4592,6 +4602,22 @@ var shopify = {
 				// roll back.
 				const billable = org?.billingProvider === 'shopify' && fee > 0 && ! backfill;
 
+				// THE EFFECTIVE METER HANDLE. The provider row's orderEventHandle
+				// (admin-editable, for the day the plan config's meter changes)
+				// overrides the built-in default; slugified again on read as belt
+				// and braces with the save-side formatter, since a drifted stored
+				// value would mint transactions no meter classifies. Read directly
+				// (not via providerSettings — that module imports this one) and
+				// only for a billable order, which keeps the cost off every
+				// ordinary redemption.
+				const providerRow = billable
+					? await read.get({ collection : 'provider', query : { slug : 'shopify' } })
+					: null;
+
+				const { orderEventHandle } = providerRow?.settings ? decrypt( providerRow.settings ) : {};
+
+				const handle = ( typeof orderEventHandle === 'string' && slugify( orderEventHandle ) ) || ORDER_EVENT_HANDLE;
+
 				// A billable order with no shop id is revenue lost SILENTLY — the
 				// gate below just yields no job, the order records normally, and the
 				// connection looks healthy. An Error (not a warn) because this is
@@ -4622,7 +4648,7 @@ var shopify = {
 							// verify it against the transaction prefix and refuse a
 							// drifted pair — idempotency keys are permanent, so a
 							// mistraceable event can never be resent under its own key.
-							handle : ORDER_EVENT_HANDLE,
+							handle,
 							idempotencyKey : String( orderId ),
 							orderDocId,
 							orderId : String( orderId ),
@@ -4632,7 +4658,7 @@ var shopify = {
 							// here — the event handle plus the order id — and sent as the
 							// event's `reference`. queue/usage.js stamps the same id onto
 							// the order as billed.transaction.
-							transaction : ORDER_EVENT_HANDLE + '.' + orderId,
+							transaction : handle + '.' + orderId,
 							value : Math.round( fee * 100 )
 						},
 						name : 'billing',
@@ -4962,6 +4988,63 @@ var shopify = {
 
 					}
 
+					// THE ISSUE MARKER rides beside the stamp: a probed-unmetered
+					// store carries a billing entry in the connection's own errors —
+					// the Issues surface a merchant already knows — and a metered
+					// verdict clears it. Keyed on PRESENCE rather than the verdict
+					// changing, so a connection stamped before this writer existed
+					// still gains its entry on the next run. Status is deliberately
+					// untouched on the way in (orders must keep recording), and the
+					// way out mirrors the resume idiom: reactivate only a connection
+					// that is errored with nothing else wrong.
+					const hasBillingIssue = ( connection.errors || [] ).some( ( entry ) => entry.source === BILLING_ERROR_SOURCE );
+
+					if( metered === null && ! hasBillingIssue ){
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$push : {
+									errors : {
+										message : BILLING_ERROR_MESSAGE,
+										source : BILLING_ERROR_SOURCE
+									}
+								}
+							},
+							operation : 'update',
+							query : { id : connection.id }
+						});
+
+					}
+
+					if( typeof metered === 'string' && hasBillingIssue ){
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$pull : {
+									errors : { source : BILLING_ERROR_SOURCE }
+								}
+							},
+							operation : 'update',
+							query : { id : connection.id }
+						});
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$set : { status : 'active' }
+							},
+							operation : 'update',
+							query : {
+								id : connection.id,
+								status : 'error',
+								'errors.0' : { $exists : false }
+							}
+						});
+
+					}
+
 					return {
 						writes,
 						enqueues : [ {
@@ -5174,7 +5257,15 @@ var shopify = {
 			{ input : 'text', key : 'apiKey', credential : 'SHOPIFY_API_KEY', label : 'API key', required : true },
 			{ input : 'password', key : 'apiSecret', credential : 'SHOPIFY_API_SECRET', label : 'API secret', redact : true, required : true },
 			{ input : 'text', key : 'appHandle', credential : 'SHOPIFY_APP_HANDLE', label : 'App handle', required : true },
-			{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true }
+			{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true },
+			// The usage meter's event handle, when the plan config's meter ever
+			// changes: stored value overrides the built-in default
+			// (events.order.handle) at the mint point, and `format : 'slug'`
+			// normalizes it on save — a handle can carry no spaces or capitals,
+			// and classification against it is case-sensitive. Optional: empty
+			// means the default, and the sender still refuses any handle that
+			// disagrees with the transaction it minted.
+			{ format : 'slug', input : 'text', key : 'orderEventHandle', label : 'Order event handle', required : false, setting : true }
 		]
 	},
 	// A pre-launch integration: it only surfaces once the App Store listing
@@ -5192,9 +5283,19 @@ var shopify = {
 	// there is nothing further to choose. `shop` absent means the install did not
 	// finish, which is a credential problem rather than a setup one, so the
 	// stored status already says so.
-	// Nothing to add — no setting can make this connection unusable, so the
-	// credential's own verdict stands.
-	status : ( data ) => data?.status,
+	//
+	// ONE presentation downgrade: an ACTIVE store whose approval carries no
+	// usage meter (source.metered explicitly null) PRESENTS as error, so the
+	// connections list shows the red state and the merchant knows to click in
+	// — where the Fix-order-billing card and the billing Issue explain the
+	// click. The STORED status stays active on purpose: serving and tracking
+	// gate on it, and the orders recorded while the merchant fixes the plan
+	// are the ones billed afterward.
+	status : ( data ) => (
+		data?.status === 'active' && data?.source?.metered === null
+			? 'error'
+			: data?.status
+	),
 	// Step types name the CAPABILITY, not this vendor. A second store platform
 	// implements the same four commerce steps, and the connection on the step
 	// says which store it runs against — so a merchant sees one "Create
@@ -5326,8 +5427,9 @@ var shopify = {
 			? [
 				{
 					action : 'billing',
-					message : 'Approve the Drawbridge plan to activate this connection. You\'ll confirm the pricing on Shopify, then everything else happens here.',
-					title : 'Approve your plan'
+					message : 'Approve the Drawbridge plan to activate this connection. You\'ll be asked to select a plan on Shopify, then everything else happens here.',
+					title : 'Approve your plan',
+					type : 'warning'
 				}
 			]
 			: []
@@ -5343,8 +5445,9 @@ var shopify = {
 			? [
 				{
 					action : 'billing',
-					message : 'Order billing isn\'t set up for this store, so campaign-attributed orders aren\'t being charged. Approve the updated plan to fix it — one click here, one confirmation on Shopify.',
-					title : 'Fix order billing'
+					message : 'Order billing isn\'t set up for this store, so campaign-attributed orders aren\'t being charged. You\'ll need to reselect your plan on Shopify and approve it to fix this.',
+					title : 'Fix order billing',
+					type : 'error'
 				}
 			]
 			: []
@@ -6361,6 +6464,11 @@ const publicConnectionKeys = Object.freeze([
 	'settings',
 	'shop',
 	'slug',
+	// Vendor identity plus the metered billing stamp — domain, id, label,
+	// metered — no credentials live here (those are the encrypted settings
+	// blob). The status and tasks hooks pivot on source.metered, so stripping
+	// it here left the presented status blind to the one state it must show.
+	'source',
 	'status',
 	'tasks',
 	'title',

package/dist/connections/index.d.ts

@@ -7,6 +7,7 @@ import { channels } from '../pricing.js';
 import { customAlphabet } from 'nanoid';
 import { toCanonicalEmail } from '../email.js';
 import { conversionRate } from '../plans.js';
+import { decrypt } from '../encrypt.js';
 import { slugify } from '../slugify.js';
 import { safeRequest } from '../safe-http.js';
 import 'libphonenumber-js';
@@ -19,6 +20,8 @@ import '../index.js';
 import 'currency-codes';
 import '../color.js';
 import 'tinycolor2';
+import 'crypto';
+import '../token.js';
 import 'slugify';
 import 'dns';
 import 'node:http';
@@ -3869,6 +3872,13 @@ const REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1000;
 
 const OAUTH_ERROR_SOURCE = 'oauth';
 
+// The billing Issue a probed-unmetered store carries in its connection
+// errors, written and cleared beside the source.metered stamp (health check
+// and drawbridge-sync's approval restamp share the source tag). One string,
+// used by both writers, so the entries dedupe and $pull cleanly.
+const BILLING_ERROR_SOURCE = 'billing';
+const BILLING_ERROR_MESSAGE = 'Order billing isn\'t set up for this store — reselect and approve the plan from the Shopify connection page.';
+
 // What Shopify says when the merchant has uninstalled or revoked. Neither is
 // retryable and both mean the same thing to a merchant: reconnect.
 const OAUTH_GRANT_REVOKED_CODES = [ 'application_cannot_be_found', 'invalid_grant' ];
@@ -4592,6 +4602,22 @@ var shopify = {
 				// roll back.
 				const billable = org?.billingProvider === 'shopify' && fee > 0 && ! backfill;
 
+				// THE EFFECTIVE METER HANDLE. The provider row's orderEventHandle
+				// (admin-editable, for the day the plan config's meter changes)
+				// overrides the built-in default; slugified again on read as belt
+				// and braces with the save-side formatter, since a drifted stored
+				// value would mint transactions no meter classifies. Read directly
+				// (not via providerSettings — that module imports this one) and
+				// only for a billable order, which keeps the cost off every
+				// ordinary redemption.
+				const providerRow = billable
+					? await read.get({ collection : 'provider', query : { slug : 'shopify' } })
+					: null;
+
+				const { orderEventHandle } = providerRow?.settings ? decrypt( providerRow.settings ) : {};
+
+				const handle = ( typeof orderEventHandle === 'string' && slugify( orderEventHandle ) ) || ORDER_EVENT_HANDLE;
+
 				// A billable order with no shop id is revenue lost SILENTLY — the
 				// gate below just yields no job, the order records normally, and the
 				// connection looks healthy. An Error (not a warn) because this is
@@ -4622,7 +4648,7 @@ var shopify = {
 							// verify it against the transaction prefix and refuse a
 							// drifted pair — idempotency keys are permanent, so a
 							// mistraceable event can never be resent under its own key.
-							handle : ORDER_EVENT_HANDLE,
+							handle,
 							idempotencyKey : String( orderId ),
 							orderDocId,
 							orderId : String( orderId ),
@@ -4632,7 +4658,7 @@ var shopify = {
 							// here — the event handle plus the order id — and sent as the
 							// event's `reference`. queue/usage.js stamps the same id onto
 							// the order as billed.transaction.
-							transaction : ORDER_EVENT_HANDLE + '.' + orderId,
+							transaction : handle + '.' + orderId,
 							value : Math.round( fee * 100 )
 						},
 						name : 'billing',
@@ -4962,6 +4988,63 @@ var shopify = {
 
 					}
 
+					// THE ISSUE MARKER rides beside the stamp: a probed-unmetered
+					// store carries a billing entry in the connection's own errors —
+					// the Issues surface a merchant already knows — and a metered
+					// verdict clears it. Keyed on PRESENCE rather than the verdict
+					// changing, so a connection stamped before this writer existed
+					// still gains its entry on the next run. Status is deliberately
+					// untouched on the way in (orders must keep recording), and the
+					// way out mirrors the resume idiom: reactivate only a connection
+					// that is errored with nothing else wrong.
+					const hasBillingIssue = ( connection.errors || [] ).some( ( entry ) => entry.source === BILLING_ERROR_SOURCE );
+
+					if( metered === null && ! hasBillingIssue ){
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$push : {
+									errors : {
+										message : BILLING_ERROR_MESSAGE,
+										source : BILLING_ERROR_SOURCE
+									}
+								}
+							},
+							operation : 'update',
+							query : { id : connection.id }
+						});
+
+					}
+
+					if( typeof metered === 'string' && hasBillingIssue ){
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$pull : {
+									errors : { source : BILLING_ERROR_SOURCE }
+								}
+							},
+							operation : 'update',
+							query : { id : connection.id }
+						});
+
+						writes.push({
+							collection : 'connection',
+							data : {
+								$set : { status : 'active' }
+							},
+							operation : 'update',
+							query : {
+								id : connection.id,
+								status : 'error',
+								'errors.0' : { $exists : false }
+							}
+						});
+
+					}
+
 					return {
 						writes,
 						enqueues : [ {
@@ -5174,7 +5257,15 @@ var shopify = {
 			{ input : 'text', key : 'apiKey', credential : 'SHOPIFY_API_KEY', label : 'API key', required : true },
 			{ input : 'password', key : 'apiSecret', credential : 'SHOPIFY_API_SECRET', label : 'API secret', redact : true, required : true },
 			{ input : 'text', key : 'appHandle', credential : 'SHOPIFY_APP_HANDLE', label : 'App handle', required : true },
-			{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true }
+			{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', required : true },
+			// The usage meter's event handle, when the plan config's meter ever
+			// changes: stored value overrides the built-in default
+			// (events.order.handle) at the mint point, and `format : 'slug'`
+			// normalizes it on save — a handle can carry no spaces or capitals,
+			// and classification against it is case-sensitive. Optional: empty
+			// means the default, and the sender still refuses any handle that
+			// disagrees with the transaction it minted.
+			{ format : 'slug', input : 'text', key : 'orderEventHandle', label : 'Order event handle', required : false, setting : true }
 		]
 	},
 	// A pre-launch integration: it only surfaces once the App Store listing
@@ -5192,9 +5283,19 @@ var shopify = {
 	// there is nothing further to choose. `shop` absent means the install did not
 	// finish, which is a credential problem rather than a setup one, so the
 	// stored status already says so.
-	// Nothing to add — no setting can make this connection unusable, so the
-	// credential's own verdict stands.
-	status : ( data ) => data?.status,
+	//
+	// ONE presentation downgrade: an ACTIVE store whose approval carries no
+	// usage meter (source.metered explicitly null) PRESENTS as error, so the
+	// connections list shows the red state and the merchant knows to click in
+	// — where the Fix-order-billing card and the billing Issue explain the
+	// click. The STORED status stays active on purpose: serving and tracking
+	// gate on it, and the orders recorded while the merchant fixes the plan
+	// are the ones billed afterward.
+	status : ( data ) => (
+		data?.status === 'active' && data?.source?.metered === null
+			? 'error'
+			: data?.status
+	),
 	// Step types name the CAPABILITY, not this vendor. A second store platform
 	// implements the same four commerce steps, and the connection on the step
 	// says which store it runs against — so a merchant sees one "Create
@@ -5326,8 +5427,9 @@ var shopify = {
 			? [
 				{
 					action : 'billing',
-					message : 'Approve the Drawbridge plan to activate this connection. You\'ll confirm the pricing on Shopify, then everything else happens here.',
-					title : 'Approve your plan'
+					message : 'Approve the Drawbridge plan to activate this connection. You\'ll be asked to select a plan on Shopify, then everything else happens here.',
+					title : 'Approve your plan',
+					type : 'warning'
 				}
 			]
 			: []
@@ -5343,8 +5445,9 @@ var shopify = {
 			? [
 				{
 					action : 'billing',
-					message : 'Order billing isn\'t set up for this store, so campaign-attributed orders aren\'t being charged. Approve the updated plan to fix it — one click here, one confirmation on Shopify.',
-					title : 'Fix order billing'
+					message : 'Order billing isn\'t set up for this store, so campaign-attributed orders aren\'t being charged. You\'ll need to reselect your plan on Shopify and approve it to fix this.',
+					title : 'Fix order billing',
+					type : 'error'
 				}
 			]
 			: []
@@ -6361,6 +6464,11 @@ const publicConnectionKeys = Object.freeze([
 	'settings',
 	'shop',
 	'slug',
+	// Vendor identity plus the metered billing stamp — domain, id, label,
+	// metered — no credentials live here (those are the encrypted settings
+	// blob). The status and tasks hooks pivot on source.metered, so stripping
+	// it here left the presented status blind to the one state it must show.
+	'source',
 	'status',
 	'tasks',
 	'title',