@drawbridge/drawbridge-utils 0.0.151 → 0.0.153

package/dist/connections/index.d.ts

@@ -1192,10 +1192,16 @@ var attentive = {
 	// `redact` marks a secret — never returned by the api, and blank on save means
 	// keep the stored value. `required` drives the live check.
 	provider : {
-		fields : [
-			{ input : 'text', key : 'clientId', credential : 'ATTENTIVE_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our app\'s registration in the Attentive developer portal.', required : true },
-			{ input : 'password', key : 'clientSecret', credential : 'ATTENTIVE_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID in the Attentive developer portal.', redact : true, required : true }
-		]
+		vendors : {
+			attentive : {
+				fields : [
+					{ input : 'text', key : 'clientId', credential : 'ATTENTIVE_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our app\'s registration in the Attentive developer portal.', required : true },
+					{ input : 'password', key : 'clientSecret', credential : 'ATTENTIVE_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID in the Attentive developer portal.', redact : true, required : true }
+				],
+				icon: icon$4,
+				name : 'Attentive'
+			}
+		}
 	},
 	requires : [
 		'ATTENTIVE_OAUTH_CLIENT_ID',
@@ -1591,6 +1597,60 @@ var icon$3 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 </defs>
 </svg>`;
 
+// HubSpot's sprocket, drawn by hand on the vendor's orange rather than exported
+// from a brand kit — there was no export to hand. Replace with the kit's own
+// mark when one is available; the shape and the fill are the recognisable
+// parts and both are here.
+//
+// A .js wrapper around otherwise untouched SVG so `node --test` can run against
+// lib/ directly. A bare .svg import would need a bundler loader and force the
+// tests onto dist/, which is a worse trade than one line of wrapper.
+var hubspotIcon = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#FF7A59"/>
+<circle cx="290" cy="290" r="78" stroke="white" stroke-width="30"/>
+<circle cx="290" cy="290" r="18" fill="white"/>
+<path d="M290 212V150" stroke="white" stroke-width="30" stroke-linecap="round"/>
+<circle cx="290" cy="125" r="28" fill="white"/>
+<path d="M270 137L172 96" stroke="white" stroke-width="22" stroke-linecap="round"/>
+<circle cx="160" cy="91" r="20" fill="white"/>
+<path d="M233 347L184 396" stroke="white" stroke-width="26" stroke-linecap="round"/>
+<circle cx="172" cy="408" r="22" fill="white"/>
+</svg>`;
+
+// Sendgrid, exported from the brand kit and left as authored — the
+// fills are the vendor's own mark, not a recolour.
+//
+// A .js wrapper around otherwise untouched SVG so `node --test` can run against
+// lib/ directly. A bare .svg import would need a bundler loader and force the
+// tests onto dist/, which is a worse trade than one line of wrapper.
+var sendgridIcon = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#F1FAFF"/>
+<g clip-path="url(#clip0_1011_2743)">
+<path d="M366.676 134.534V289.172H289.203V366.487H134.258L134.258 289.171L134.256 289.172V211.851H211.729V134.534H366.676Z" fill="#9DD6E3"/>
+<path d="M134.258 366.488H211.731V289.169H134.258V366.488Z" fill="#3F72AB"/>
+<path d="M289.203 289.172H366.677V211.852H289.203V289.172Z" fill="#00A9D1"/>
+<path d="M211.729 211.853H289.202V134.534H211.729V211.853Z" fill="#00A9D1"/>
+<path d="M211.729 289.17H289.202V211.852H211.729V289.17Z" fill="#2191C4"/>
+<path d="M289.203 211.853H366.677V134.534H289.203V211.853Z" fill="#3F72AB"/>
+</g>
+<defs>
+<clipPath id="clip0_1011_2743">
+<rect width="232.42" height="231.956" fill="white" transform="translate(134.256 134.534)"/>
+</clipPath>
+</defs>
+</svg>`;
+
+// Twilio, exported from the brand kit and left as authored — the
+// fills are the vendor's own mark, not a recolour.
+//
+// A .js wrapper around otherwise untouched SVG so `node --test` can run against
+// lib/ directly. A bare .svg import would need a bundler loader and force the
+// tests onto dist/, which is a worse trade than one line of wrapper.
+var twilioIcon = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#F22F46"/>
+<path d="M250 134.954C186.341 134.954 134.954 186.341 134.954 250C134.954 313.659 186.341 365.047 250 365.047C313.659 365.047 365.047 313.659 365.047 250C365.047 186.341 313.659 134.954 250 134.954ZM250 334.368C203.215 334.368 165.633 296.786 165.633 250C165.633 203.215 203.215 165.633 250 165.633C296.786 165.633 334.368 203.215 334.368 250C334.368 296.786 296.786 334.368 250 334.368ZM302.155 221.622C302.155 234.661 291.417 245.399 278.378 245.399C265.34 245.399 254.602 234.661 254.602 221.622C254.602 208.584 265.34 197.846 278.378 197.846C291.417 197.846 302.155 208.584 302.155 221.622ZM302.155 278.378C302.155 291.417 291.417 302.155 278.378 302.155C265.34 302.155 254.602 291.417 254.602 278.378C254.602 265.34 265.34 254.602 278.378 254.602C291.417 254.602 302.155 265.34 302.155 278.378ZM245.399 278.378C245.399 291.417 234.661 302.155 221.622 302.155C208.584 302.155 197.846 291.417 197.846 278.378C197.846 265.34 208.584 254.602 221.622 254.602C234.661 254.602 245.399 265.34 245.399 278.378ZM245.399 221.622C245.399 234.661 234.661 245.399 221.622 245.399C208.584 245.399 197.846 234.661 197.846 221.622C197.846 208.584 208.584 197.846 221.622 197.846C234.661 197.846 245.399 208.584 245.399 221.622Z" fill="white"/>
+</svg>`;
+
 // TWILIO'S OWN KEYWORD LISTS. STOP-family withdraws consent for the number —
 // platform-wide, because every organization sends from the same platform number,
 // so a withdrawal cannot be scoped narrower than the number it was sent to.
@@ -2396,37 +2456,56 @@ var drawbridge = {
 	//
 	// They belong on THIS manifest because this is the connection that sends: the
 	// email, sms and segment hooks below are the only things that spend them, and
-	// a private connection is still where a vendor fact lives.
+	// a private connection is still where a vendor fact lives. They are THREE
+	// VENDORS, not one, and each is its own row and its own admin card — so
+	// SendGrid reads live on a deployment that never configured Twilio, instead
+	// of one card for all three that could only ever be as live as its weakest.
 	//
 	// UNLIKE every public vendor, none of these appear in `requires` — see the
 	// comment there. Availability and configuration are different questions, and a
 	// missing CRM token must not take every base workflow step away.
+	//
+	// ponytail: the field keys keep the names they had on the shared row
+	// (smsSid, hubspotToken) so the readers destructuring vendorSettings() did
+	// not move. Rename them to sid/token when those readers are next touched.
 	provider : {
-		fields : [
-			{ input : 'email', key : 'accountSender', credential : 'SENDGRID_FROM_ADDRESS', label : 'Account sender', message : 'Verification codes and security alerts send from here.', required : true },
-			{ input : 'password', key : 'apiKey', credential : 'SENDGRID_API_KEY', label : 'SendGrid API key', message : 'SendGrid dashboard, Settings, API Keys — full access for sends.', redact : true, required : true },
-			// NOT required. The CRM sync is best-effort internal tooling and no-ops
-			// without a token — requiring it would make the whole drawbridge provider
-			// read not-live over something no merchant ever sees.
-			{ input : 'password', key : 'hubspotToken', credential : 'HUBSPOT_ACCESS_TOKEN', label : 'HubSpot access token', message : 'Drawbridge\'s own CRM portal. Internal — no merchant sees this.', redact : true },
-			// Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-			// either. Unset, it degrades to the account sender rather than
-			// refusing to start.
-			{ input : 'email', key : 'leadSender', credential : 'SENDGRID_SEND_FROM_ADDRESS', label : 'Lead sender', message : 'The default for lead-facing mail when a merchant has not verified their own domain.' },
-			// NOT required, the three of them together. SendGrid alone is enough to
-			// run the platform — sign-in codes, notifications and every lead-facing
-			// mail are email. Requiring Twilio here made the whole drawbridge
-			// provider read not-live on a deployment that never sends SMS, over a
-			// channel it was not using.
-			//
+		vendors : {
+			sendgrid : {
+				fields : [
+					{ input : 'email', key : 'accountSender', credential : 'SENDGRID_FROM_ADDRESS', label : 'Account sender', message : 'Verification codes and security alerts send from here.', required : true },
+					{ input : 'password', key : 'apiKey', credential : 'SENDGRID_API_KEY', label : 'SendGrid API key', message : 'SendGrid dashboard, Settings, API Keys — full access for sends.', redact : true, required : true },
+					// Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
+					// either. Unset, it degrades to the account sender rather than
+					// refusing to start.
+					{ input : 'email', key : 'leadSender', credential : 'SENDGRID_SEND_FROM_ADDRESS', label : 'Lead sender', message : 'The default for lead-facing mail when a merchant has not verified their own domain.' }
+				],
+				icon : sendgridIcon,
+				name : 'SendGrid'
+			},
 			// Missing, SMS is LOCKED DOWN rather than broken: every send path
 			// refuses cleanly (queue/notification.js cancels, the otc stream skips
 			// and logs), the number-purchase routes deny, and identityDefaults.sms
-			// hides the org's SMS settings entirely.
-			{ input : 'text', key : 'smsFrom', credential : 'TWILIO_ACCOUNT_FROM', label : 'SMS number', message : 'Without Twilio credentials, SMS is disabled across the platform.' },
-			{ input : 'password', key : 'smsSid', credential : 'TWILIO_ACCOUNT_SID', label : 'Twilio account SID', message : 'Twilio console home — the AC… identifier on the account dashboard.', redact : true },
-			{ input : 'password', key : 'smsToken', credential : 'TWILIO_AUTH_TOKEN', label : 'Twilio auth token', message : 'Beside the account SID on the Twilio console dashboard.', redact : true }
-		]
+			// hides the org's SMS settings entirely. The card reads not live, which
+			// is the truth about Twilio and says nothing about email.
+			twilio : {
+				fields : [
+					{ input : 'text', key : 'smsFrom', credential : 'TWILIO_ACCOUNT_FROM', label : 'SMS number', message : 'Without Twilio credentials, SMS is disabled across the platform.', required : true },
+					{ input : 'password', key : 'smsSid', credential : 'TWILIO_ACCOUNT_SID', label : 'Twilio account SID', message : 'Twilio console home — the AC… identifier on the account dashboard.', redact : true, required : true },
+					{ input : 'password', key : 'smsToken', credential : 'TWILIO_AUTH_TOKEN', label : 'Twilio auth token', message : 'Beside the account SID on the Twilio console dashboard.', redact : true, required : true }
+				],
+				icon : twilioIcon,
+				name : 'Twilio'
+			},
+			// The CRM sync is best-effort internal tooling and no-ops without a
+			// token. Not live here costs nothing a merchant can see.
+			hubspot : {
+				fields : [
+					{ input : 'password', key : 'hubspotToken', credential : 'HUBSPOT_ACCESS_TOKEN', label : 'HubSpot access token', message : 'Drawbridge\'s own CRM portal. Internal — no merchant sees this.', redact : true, required : true }
+				],
+				icon : hubspotIcon,
+				name : 'HubSpot'
+			}
+		}
 	},
 	// NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
 	//
@@ -3176,12 +3255,20 @@ var klaviyo = {
 	// DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
 	// what an admin types on the provider screen. Declared here rather than in a
 	// table in lib/providers.js, so a vendor's credentials sit beside the
-	// `requires` that names the same variables.
+	// `requires` that names the same variables. Keyed by the VENDOR that holds
+	// them — here the vendor and the connection are the same thing, which is not
+	// true of every manifest.
 	provider : {
-		fields : [
-			{ input : 'text', key : 'clientId', credential : 'KLAVIYO_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our app in the Klaviyo developer portal (developers.klaviyo.com).', required : true },
-			{ input : 'password', key : 'clientSecret', credential : 'KLAVIYO_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID on the Klaviyo app.', redact : true, required : true }
-		]
+		vendors : {
+			klaviyo : {
+				fields : [
+					{ input : 'text', key : 'clientId', credential : 'KLAVIYO_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our app in the Klaviyo developer portal (developers.klaviyo.com).', required : true },
+					{ input : 'password', key : 'clientSecret', credential : 'KLAVIYO_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID on the Klaviyo app.', redact : true, required : true }
+				],
+				icon: icon$2,
+				name : 'Klaviyo'
+			}
+		}
 	},
 	requires : [
 		'KLAVIYO_OAUTH_CLIENT_ID',
@@ -3642,10 +3729,16 @@ var mailchimp = {
 	// what an admin types on the provider screen, beside the `requires` naming the
 	// same variables.
 	provider : {
-		fields : [
-			{ input : 'text', key : 'clientId', credential : 'MAILCHIMP_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our registered app — Mailchimp account, Extras, Registered apps.', required : true },
-			{ input : 'password', key : 'clientSecret', credential : 'MAILCHIMP_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID on the registered app.', redact : true, required : true }
-		]
+		vendors : {
+			mailchimp : {
+				fields : [
+					{ input : 'text', key : 'clientId', credential : 'MAILCHIMP_OAUTH_CLIENT_ID', label : 'Client ID', message : 'From our registered app — Mailchimp account, Extras, Registered apps.', required : true },
+					{ input : 'password', key : 'clientSecret', credential : 'MAILCHIMP_OAUTH_CLIENT_SECRET', label : 'Client secret', message : 'Beside the Client ID on the registered app.', redact : true, required : true }
+				],
+				icon: icon$1,
+				name : 'Mailchimp'
+			}
+		}
 	},
 	// The OAuth client this deployment registered. Without both, the vendor drops
 	// out of availableConnections rather than offering a Connect button that
@@ -4931,6 +5024,9 @@ var shopify = {
 					let metered;
 					let shopCurrency = null;
 					let billingProbeFailed = false;
+					// Per-boundary reconciliation results, surfaced in the step
+					// response — the operator's ledger view of charged vs billed.
+					let reconciliation = null;
 
 					try {
 
@@ -4971,71 +5067,162 @@ var shopify = {
 						// THE REAL METER SIGNAL — Partner API accrual. A CHARGE_USAGE
 						// event for this shop is proof billing works: its charge id
 						// becomes the stamp (overriding the line-item probe, which
-						// managed pricing keeps blind). No accrual AND a billed order
-						// old enough that one should exist is the HONEST unmetered
-						// verdict — the null that re-arms the card, the Issue and the
-						// pager on truth instead of the Admin API's silence. Off
-						// entirely until the provider row carries the credentials.
+						// managed pricing keeps blind), and each charge row is a
+						// billing BOUNDARY the reconciler below balances the books
+						// against. Off entirely until the provider row carries the
+						// credentials.
 						const partnerRow = read?.get ? await read.get({ collection : 'provider', query : { slug : 'shopify' } }) : null;
 						const partner = partnerRow?.settings ? decrypt( partnerRow.settings ) : {};
 
 						if( partner.partnerToken && partner.partnerOrgId && partner.partnerAppId && source?.id && shopify.partner?.getUsageChargeEvents ){
 
+							const ledgerFloor = new Date( Date.now() - 30 * 24 * 60 * 60 * 1000 );
+
 							const accruals = await shopify.partner.getUsageChargeEvents({
 								appId : 'gid://shopify/App/' + partner.partnerAppId,
-								first : 5,
-								occurredAtMin : new Date( Date.now() - 30 * 24 * 60 * 60 * 1000 ).toISOString(),
+								first : 10,
+								occurredAtMin : ledgerFloor.toISOString(),
 								organizationId : partner.partnerOrgId,
 								partnerToken : partner.partnerToken,
 								shopId : 'gid://shopify/Shop/' + source.id
 							});
 
+							// Oldest first: each charge row is a boundary that closes
+							// the window since the row before it.
+							const boundaries = accruals
+								.filter( ( event ) => event.occurredAt )
+								.sort( ( a, b ) => new Date( a.occurredAt ) - new Date( b.occurredAt ) );
+
 							// A usage ROW exists per subscription even before anything
 							// accrues (measured: a pre-meter approval shows qty 0), so
 							// the row is not the proof — a POSITIVE usageQuantity is.
-							const accrued = accruals.find( ( event ) => Number( event.usageQuantity ) > 0 );
+							// The LATEST positive row is the stamp.
+							const accrued = [ ...boundaries ].reverse().find( ( event ) => Number( event.usageQuantity ) > 0 );
+
+							if( accrued ) metered = String( accrued.chargeId || accrued.id );
+
+							// THE BOUNDARY RECONCILER. Money truth lives at boundaries:
+							// each charge row states what Shopify actually charged for
+							// the window since the previous row, and the orders billed
+							// inside that window state what we asked for — in the same
+							// cents (billed.amount IS the value the usage event
+							// carried). Balanced and positive → the window's orders get
+							// the charge id as billed.receipt (their invoice bucket).
+							// Mismatched → an alarm with the diff, and NO stamp: a
+							// short window is money silently lost, which is the one
+							// thing this whole chain exists to make loud.
+							//
+							// The stored stamp is the CURSOR: rows at or before the
+							// charge already stamped were judged on the run that
+							// stamped it, and re-judging them would page daily on the
+							// pre-meter era's known losses. (A store with losses and no
+							// positive row yet has no cursor, so its mismatch DOES
+							// re-alarm daily — deliberately: that nag is what drives
+							// the admin write-off, and voided orders leave the sums.)
+							const stampedAt = boundaries.find(
+								( event ) => String( event.chargeId || event.id ) === String( connection.source?.metered || '' )
+							)?.occurredAt;
+
+							reconciliation = [];
+
+							let windowStart = ledgerFloor;
+
+							for( const boundary of boundaries ){
+
+								const windowEnd = new Date( boundary.occurredAt );
+								const windowOpensAt = windowStart;
+
+								windowStart = windowEnd;
+
+								if( stampedAt && windowEnd <= new Date( stampedAt ) ) continue;
+
+								const charged = Math.round( Number( boundary.usageQuantity ) || 0 );
+
+								// Voided orders are written off — known unrecoverable,
+								// excluded so they stop swaying every future boundary.
+								// Already-receipted orders still COUNT in the sum (an
+								// early stamp must not read as missing money) but are
+								// never restamped.
+								const [ tally ] = await read.aggregate({
+									collection : 'order',
+									pipeline : [
+										{ $match : {
+											'billed.date' : { $gt : windowOpensAt, $lte : windowEnd },
+											'billed.void' : { $in : [ null ] },
+											organization : workflow.organization,
+											'provider.slug' : 'shopify'
+										} },
+										{ $group : {
+											_id : null,
+											billed : { $sum : '$billed.amount' },
+											orders : { $push : '$id' }
+										} }
+									]
+								}) || [];
+
+								const billed = tally?.billed || 0;
+								const orders = tally?.orders || [];
+								const charge = String( boundary.chargeId || boundary.id );
+								const balanced = charged === billed;
+
+								if( ! ( charged || billed ) ) continue;
+
+								if( balanced ){
+
+									writes.push({
+										collection : 'order',
+										data : {
+											$set : { 'billed.receipt' : charge }
+										},
+										// Top-level, not an option — the controller takes
+										// `multiple` beside `options`, and the shell
+										// forwards it as such.
+										multiple : true,
+										operation : 'update',
+										query : {
+											'billed.date' : { $gt : windowOpensAt, $lte : windowEnd },
+											'billed.receipt' : { $in : [ null ] },
+											'billed.void' : { $in : [ null ] },
+											organization : workflow.organization,
+											'provider.slug' : 'shopify'
+										}
+									});
+
+								} else {
+
+									logger?.error?.( new Error(
+										'shopify.usage.reconciliation.mismatch on shop ' + connection.shop
+										+ ': charge ' + charge + ' charged ' + charged + ' cents but its window holds '
+										+ billed + ' cents across ' + orders.length + ' billed orders'
+										+ ' — each cent of difference is commission that never charged'
+									), {
+										extra : {
+											billed,
+											charge,
+											charged,
+											orders : orders.slice( 0, 50 ),
+											shop : connection.shop,
+											windowEnd,
+											windowStart : windowOpensAt
+										}
+									});
 
-							if( accrued ){
+								}
 
-								metered = String( accrued.chargeId || accrued.id );
-
-								// THE BUCKET STAMPS ITS ORDERS. Partner accrual rows
-								// are per-subscription, not per-order, so the charge id
-								// is the invoice bucket every order billed since that
-								// subscription's approval rolled into — written onto
-								// billed.receipt (many-update; $in [null] matches both
-								// null and never-stamped). Orders billed before the
-								// window belong to earlier, possibly unbillable
-								// approvals and honestly stay unstamped.
-								writes.push({
-									collection : 'order',
-									data : {
-										$set : { 'billed.receipt' : metered }
-									},
-									// Top-level, not an option — the controller takes
-									// `multiple` beside `options`, and the shell
-									// forwards it as such.
-									multiple : true,
-									operation : 'update',
-									query : {
-										'billed.date' : { $gte : new Date( accrued.occurredAt || 0 ) },
-										'billed.receipt' : { $in : [ null ] },
-										organization : workflow.organization,
-										'provider.slug' : 'shopify'
-									}
-								});
+								reconciliation.push({ balanced, billed, charge, charged, occurredAt : boundary.occurredAt, orders : orders.length });
 
 							}
 
-							// NO negative verdict from an empty ledger: measured
-							// 2026-09-04, CHARGE_USAGE rows only materialize at
-							// BILLING moments (cycle end, cancellation/replacement)
-							// — usage accrues invisibly between them, so a
-							// first-cycle store with billed orders and no row is
-							// the NORMAL state, not an unmetered one. The honest
-							// negative is a boundary reconciliation (a charge-out
-							// row whose quantity falls short of the window's billed
-							// sum) — until that exists, absence stays a no-verdict.
+							// DELIBERATELY NO null verdict from a lossy boundary. A
+							// zero-charged window full of billed orders IS proof money
+							// was lost — but it cannot say whether the CURRENT approval
+							// is broken: the exact same shape appears the moment a
+							// merchant fixes their store (the release charges out qty 0
+							// and its window holds the pre-meter losses), and re-arming
+							// "Fix order billing" on a store that was just fixed sends
+							// the merchant through the flow again for nothing. The
+							// mismatch alarm above owns that truth for the operator,
+							// and the write-off drains it.
 
 						}
 
@@ -5154,6 +5341,9 @@ var shopify = {
 							metered : metered ?? null,
 							meterProbed : metered !== undefined,
 							pingedAt : new Date(),
+							// One entry per boundary charge judged this run: what
+							// Shopify charged vs what the window's orders billed.
+							...( reconciliation && { reconciliation }),
 							refreshTokenExpiresAt : refreshTokenExpiresAt || null,
 							refreshTokenRotated,
 							scopesMissing,
@@ -5334,28 +5524,34 @@ var shopify = {
 	// name required by the manifest and enterable nowhere is a vendor that can
 	// never go live from the admin screen.
 	provider : {
-		fields : [
-			{ input : 'text', key : 'apiKey', credential : 'SHOPIFY_API_KEY', label : 'API key', message : 'The app\'s Client ID — Dev Dashboard, the app, Settings.', required : true },
-			{ input : 'password', key : 'apiSecret', credential : 'SHOPIFY_API_SECRET', label : 'API secret', message : 'The app\'s Client secret, beside the Client ID in the app\'s settings.', redact : true, required : true },
-			{ input : 'text', key : 'appHandle', credential : 'SHOPIFY_APP_HANDLE', label : 'App handle', message : 'The app\'s URL handle (for example drawbridge-development), from the app\'s configuration.', required : true },
-			{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', message : 'Where "View on the Shopify App Store" sends merchants — the public listing, or the Dev Dashboard install link for the dev app.', required : true },
-			// The usage meter's event handle, when the plan config's meter ever
-			// changes: stored value overrides the built-in default
-			// (events.order.handle) at the mint point, and `format : 'slug'`
-			// normalizes it on save — a handle can carry no spaces or capitals,
-			// and classification against it is case-sensitive. Optional: empty
-			// means the default, and the sender still refuses any handle that
-			// disagrees with the transaction it minted.
-			{ format : 'slug', input : 'text', key : 'orderEventHandle', label : 'Order event handle', message : 'Must match the usage meter\'s Handle field on the plan exactly — lowercase and hyphens. Leave empty to use drawbridge-orders.', required : false, setting : true },
-			// The Partner API credential set — the ONE place meter billing is
-			// observable (CHARGE_USAGE accrual events). Org id and numeric app
-			// id come from the Partner Dashboard; the token from Settings →
-			// Partner API clients (Manage-apps permission). All optional: the
-			// accrual probe simply stays off until they exist.
-			{ input : 'text', key : 'partnerOrgId', label : 'Partner organization ID', message : 'The number in the Partner Dashboard URL — partners.shopify.com/<this number>/… — NOT the admin organization_id from the app listing link.', required : false, setting : true },
-			{ input : 'text', key : 'partnerAppId', label : 'Partner app ID (numeric)', message : 'The numeric id in the app\'s Partner Dashboard URL — not the Client ID.', required : false, setting : true },
-			{ input : 'password', key : 'partnerToken', label : 'Partner API token', message : 'Partner Dashboard, Settings, Partner API clients — create one with Manage apps and paste the prtapi_ token.', redact : true, required : false, setting : true }
-		]
+		vendors : {
+			shopify : {
+				fields : [
+					{ input : 'text', key : 'apiKey', credential : 'SHOPIFY_API_KEY', label : 'API key', message : 'The app\'s Client ID — Dev Dashboard, the app, Settings.', required : true },
+					{ input : 'password', key : 'apiSecret', credential : 'SHOPIFY_API_SECRET', label : 'API secret', message : 'The app\'s Client secret, beside the Client ID in the app\'s settings.', redact : true, required : true },
+					{ input : 'text', key : 'appHandle', credential : 'SHOPIFY_APP_HANDLE', label : 'App handle', message : 'The app\'s URL handle (for example drawbridge-development), from the app\'s configuration.', required : true },
+					{ input : 'text', key : 'listingUrl', credential : 'SHOPIFY_APP_LISTING_URL', label : 'App listing URL', message : 'Where "View on the Shopify App Store" sends merchants — the public listing, or the Dev Dashboard install link for the dev app.', required : true },
+					// The usage meter's event handle, when the plan config's meter ever
+					// changes: stored value overrides the built-in default
+					// (events.order.handle) at the mint point, and `format : 'slug'`
+					// normalizes it on save — a handle can carry no spaces or capitals,
+					// and classification against it is case-sensitive. Optional: empty
+					// means the default, and the sender still refuses any handle that
+					// disagrees with the transaction it minted.
+					{ format : 'slug', input : 'text', key : 'orderEventHandle', label : 'Order event handle', message : 'Must match the usage meter\'s Handle field on the plan exactly — lowercase and hyphens. Leave empty to use drawbridge-orders.', required : false, setting : true },
+					// The Partner API credential set — the ONE place meter billing is
+					// observable (CHARGE_USAGE accrual events). Org id and numeric app
+					// id come from the Partner Dashboard; the token from Settings →
+					// Partner API clients (Manage-apps permission). All optional: the
+					// accrual probe simply stays off until they exist.
+					{ input : 'text', key : 'partnerOrgId', label : 'Partner organization ID', message : 'The number in the Partner Dashboard URL — partners.shopify.com/<this number>/… — NOT the admin organization_id from the app listing link.', required : false, setting : true },
+					{ input : 'text', key : 'partnerAppId', label : 'Partner app ID (numeric)', message : 'The numeric id in the app\'s Partner Dashboard URL — not the Client ID.', required : false, setting : true },
+					{ input : 'password', key : 'partnerToken', label : 'Partner API token', message : 'Partner Dashboard, Settings, Partner API clients — create one with Manage apps and paste the prtapi_ token.', redact : true, required : false, setting : true }
+				],
+				icon,
+				name : 'Shopify'
+			}
+		}
 	},
 	// A pre-launch integration: it only surfaces once the App Store listing
 	// exists and the app is fully configured. Requiring all four means it can
@@ -5784,6 +5980,34 @@ const leaves = ( node, path = [] ) => Object.entries( node || {} ).flatMap(
 	)
 );
 
+// Checked for the three things that actually break a card:
+//   it must be an svg          a filename here means the file is elsewhere again
+//   it must carry a viewBox    without one it will not scale into the 50px tile
+//   it must not wrap a raster  Figma exports a placed bitmap inside an <svg>
+//                              shell, which looks like a vector, weighs 90KB and
+//                              blurs exactly like the png it actually is
+const checkIcon = ( owner, icon ) => {
+
+	if( typeof icon !== 'string' || ! icon.includes( '<svg' ) ){
+
+		throw new Error( owner + ' needs an icon — the svg markup itself, not a path to one' );
+
+	}
+
+	if( ! icon.includes( 'viewBox' ) ){
+
+		throw new Error( owner + ' icon has no viewBox, so it cannot scale' );
+
+	}
+
+	if( icon.includes( '<image' ) ){
+
+		throw new Error( owner + ' icon wraps a raster — re-export it as vector shapes' );
+
+	}
+
+};
+
 // WHAT A CONNECTION MUST DECLARE. Thrown at import rather than discovered by a
 // merchant looking at a broken card, or by a workflow that accepted a step it
 // could never run.
@@ -5883,9 +6107,18 @@ const build = ( manifest ) => {
 
 	}
 
-	// DRAWBRIDGE'S OWN CREDENTIALS for this vendor, if it has any. A connection
-	// with no third party behind it — webhook — declares no block at all, which is
-	// what keeps it off the provider screen.
+	// DRAWBRIDGE'S OWN CREDENTIALS, declared under the VENDOR that holds them.
+	//
+	// A provider is a vendor Drawbridge has an account with; a connection is a
+	// thing a merchant turns on. They are not one-to-one in either direction:
+	// `drawbridge` spends SendGrid, Twilio and HubSpot, and a future Google row
+	// would be spent by analytics, geocoding and whatever comes after. So a
+	// manifest declares the fields IT spends, subkeyed by vendor, and mergeVendors
+	// below unions every manifest's declarations into one vendor each. Nobody
+	// owns a vendor — removing a manifest removes its fields and nothing else.
+	//
+	// A connection with no third party behind it — webhook — declares no block at
+	// all, which is what keeps it off the provider screen.
 	//
 	// Every field is checked harder than a merchant field: it must be editable
 	// (an admin cannot type into a read-only descriptor, and a credential nobody
@@ -5894,56 +6127,69 @@ const build = ( manifest ) => {
 	// providerFields is what the api's redaction derives from, so a password field
 	// that forgot `redact : true` is a platform secret handed back over the wire
 	// to every admin screen that asks.
-	for( const field of manifest.provider?.fields || [] ){
+	if( manifest.provider?.fields ){
 
-		if( ! field?.key || ! field?.label ){
+		throw new Error( manifest.slug + ' declares provider.fields — fields live under provider.vendors.<vendor> now, keyed by the vendor that holds them' );
 
-			throw new Error( manifest.slug + ' declares a provider field with no key or label' );
+	}
 
-		}
+	const declaredKeys = new Set();
 
-		if( ! INPUTS.includes( field.input ) ){
+	for( const [ vendor, declared ] of Object.entries( manifest.provider?.vendors || {} ) ){
 
-			throw new Error( manifest.slug + '.provider.' + field.key + ' needs an input the admin form can render — one of ' + INPUTS.join( ', ' ) );
+		if( ! declared?.name ) throw new Error( manifest.slug + ' declares vendor ' + vendor + ' with no name' );
 
-		}
+		// The admin card shows the vendor's own mark, which is not always the
+		// connection's — SendGrid's card is not the Drawbridge logo.
+		checkIcon( manifest.slug + ' vendor ' + vendor, declared.icon );
 
-		if( field.input === 'password' && ! field.redact ){
+		if( ! Array.isArray( declared.fields ) || ! declared.fields.length ){
 
-			throw new Error( manifest.slug + '.provider.' + field.key + ' is a password and must declare redact : true — the api would hand the value back' );
+			throw new Error( manifest.slug + ' declares vendor ' + vendor + ' with no fields — a vendor nothing is typed into holds nothing' );
 
 		}
 
-	}
+		for( const field of declared.fields ){
 
-	// THE ICON RIDES WITH THE MANIFEST, so a vendor cannot name an asset nobody
-	// added — which is what the old arrangement allowed, with the markup in one
-	// repo and the file in another.
-	//
-	// Checked for the three things that actually break a card:
-	//   it must be an svg          a filename here means the file is elsewhere again
-	//   it must carry a viewBox    without one it will not scale into the 50px tile
-	//   it must not wrap a raster  Figma exports a placed bitmap inside an <svg>
-	//                              shell, which looks like a vector, weighs 90KB and
-	//                              blurs exactly like the png it actually is
-	if( typeof manifest?.icon !== 'string' || ! manifest.icon.includes( '<svg' ) ){
+			if( ! field?.key || ! field?.label ){
 
-		throw new Error( manifest.slug + ' needs an icon — the svg markup itself, not a path to one' );
+				throw new Error( manifest.slug + ' declares a provider field with no key or label' );
 
-	}
+			}
 
-	if( ! manifest.icon.includes( 'viewBox' ) ){
+			if( ! INPUTS.includes( field.input ) ){
 
-		throw new Error( manifest.slug + ' icon has no viewBox, so it cannot scale' );
+				throw new Error( manifest.slug + '.provider.' + field.key + ' needs an input the admin form can render — one of ' + INPUTS.join( ', ' ) );
 
-	}
+			}
+
+			if( field.input === 'password' && ! field.redact ){
+
+				throw new Error( manifest.slug + '.provider.' + field.key + ' is a password and must declare redact : true — the api would hand the value back' );
+
+			}
+
+			// ONE KEY PER CONNECTION across its vendors. vendorSettings() hands a
+			// connection every vendor's settings merged into one object, so two
+			// vendors on one manifest sharing a key would be one value silently
+			// winning over the other.
+			if( declaredKeys.has( field.key ) ){
 
-	if( manifest.icon.includes( '<image' ) ){
+				throw new Error( manifest.slug + ' declares ' + field.key + ' under two vendors — vendorSettings() merges them and one would win' );
 
-		throw new Error( manifest.slug + ' icon wraps a raster — re-export it as vector shapes' );
+			}
+
+			declaredKeys.add( field.key );
+
+		}
 
 	}
 
+	// THE ICON RIDES WITH THE MANIFEST, so a vendor cannot name an asset nobody
+	// added — which is what the old arrangement allowed, with the markup in one
+	// repo and the file in another.
+	checkIcon( manifest.slug, manifest?.icon );
+
 	// `group` does the actual grouping on the connections page, and `category`
 	// was a second word for the same fact — so it is gone rather than kept as an
 	// alias nobody could tell apart from this one.
@@ -6220,6 +6466,96 @@ const connections = Object.freeze({
 	webhook : build( webhook )
 });
 
+// A field declaration, with its keys in a fixed order, so two manifests that
+// declare the same field can be compared as strings whatever order they wrote
+// the keys in.
+const canonical = ( field ) => JSON.stringify( Object.fromEntries( Object.entries( field ).sort() ) );
+
+// DRAWBRIDGE'S OWN VENDOR ACCOUNTS, one entry per vendor, unioned from every
+// manifest that spends one. This is what the provider screen lists and what
+// the `provider` collection is keyed by: one row per key here.
+//
+// Exported as a function over a catalog, and not only as the merged constant,
+// so the guards can be exercised against a catalog that breaks them — the real
+// one is built to pass.
+//
+// THREE GUARDS, and each one is a way two files could disagree about one fact:
+//   the vendor's name and icon   the same vendor drawn two ways is two cards
+//   a field two manifests both   the same key declared differently is a form
+//   declare                      that renders whichever manifest loaded last
+//   a credential name            the join between `requires` and a row — two
+//                                fields answering one name is one value silently
+//                                winning, which is exactly the drift a row per
+//                                vendor exists to end
+const mergeVendors = ( catalog ) => {
+
+	const merged = {};
+	const claimed = new Map();
+
+	for( const [ slug, manifest ] of Object.entries( catalog ) ){
+
+		for( const [ vendor, declared ] of Object.entries( manifest.provider?.vendors || {} ) ){
+
+			const held = merged[ vendor ] || ( merged[ vendor ] = { fields : [], icon : declared.icon, name : declared.name } );
+
+			if( held.name !== declared.name ){
+
+				throw new Error( slug + ' names vendor ' + vendor + ' "' + declared.name + '" but another manifest names it "' + held.name + '"' );
+
+			}
+
+			if( held.icon !== declared.icon ){
+
+				throw new Error( slug + ' declares a different icon for vendor ' + vendor + ' than another manifest — one vendor, one mark' );
+
+			}
+
+			for( const field of declared.fields ){
+
+				const existing = held.fields.find( ( entry ) => entry.key === field.key );
+
+				if( existing ){
+
+					if( canonical( existing ) !== canonical( field ) ){
+
+						throw new Error( slug + ' declares ' + vendor + '.' + field.key + ' differently from another manifest — a field two connections spend is declared identically in both' );
+
+					}
+
+					continue;
+
+				}
+
+				if( field.credential ){
+
+					const owner = claimed.get( field.credential );
+
+					if( owner ){
+
+						throw new Error( field.credential + ' is claimed by both ' + owner + ' and ' + vendor + '.' + field.key + ' — one would silently overwrite the other' );
+
+					}
+
+					claimed.set( field.credential, vendor + '.' + field.key );
+
+				}
+
+				held.fields.push( field );
+
+			}
+
+		}
+
+	}
+
+	return Object.freeze( Object.fromEntries(
+		Object.entries( merged ).map( ( [ vendor, held ] ) => [ vendor, Object.freeze({ ...held, fields : Object.freeze( held.fields ) }) ] )
+	) );
+
+};
+
+const vendors = mergeVendors( connections );
+
 // A STEP TYPE MAY BE SHARED, BUT NOT ITS QUEUE.
 //
 // A step type belongs to the CAPABILITY rather than to whoever implements it —
@@ -6622,4 +6958,4 @@ const resolveConnection = ( item, data, env = {} ) => {
 
 };
 
-export { AUTH_TYPES, GROUPS, HOOKS, HOOK_EFFECTS, HOOK_NAMES, HOOK_OPTIONS, HOOK_PROPS, INPUTS, OAUTH_FIELDS, OUTCOMES, RETIRED, STATUSES, STEPS, STEP_TYPES, WRITE_OPERATIONS, accessToken, authToken, availableConnections, build, catalogConnections, connectFields, connectionSteps, connections, effectsOf, hookSupport, isStale, mergeSettings, projectConnection, publicConnectionKeys, publicSettingsBySlug, redactSettings, resolveConnection, runHook, scopesMessage, stepLabels, stepQueues, stepRoutes, tokenSettings };
+export { AUTH_TYPES, GROUPS, HOOKS, HOOK_EFFECTS, HOOK_NAMES, HOOK_OPTIONS, HOOK_PROPS, INPUTS, OAUTH_FIELDS, OUTCOMES, RETIRED, STATUSES, STEPS, STEP_TYPES, WRITE_OPERATIONS, accessToken, authToken, availableConnections, build, catalogConnections, connectFields, connectionSteps, connections, effectsOf, hookSupport, isStale, mergeSettings, mergeVendors, projectConnection, publicConnectionKeys, publicSettingsBySlug, redactSettings, resolveConnection, runHook, scopesMessage, stepLabels, stepQueues, stepRoutes, tokenSettings, vendors };