@drawbridge/drawbridge-utils 0.0.151 → 0.0.153

package/dist/providers.js

@@ -721,10 +721,16 @@ var attentive_default2 = {
   // `redact` marks a secret — never returned by the api, and blank on save means
   // keep the stored value. `required` drives the live check.
   provider: {
-    fields: [
-      { input: "text", key: "clientId", credential: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", message: "From our app's registration in the Attentive developer portal.", required: true },
-      { input: "password", key: "clientSecret", credential: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID in the Attentive developer portal.", redact: true, required: true }
-    ]
+    vendors: {
+      attentive: {
+        fields: [
+          { input: "text", key: "clientId", credential: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", message: "From our app's registration in the Attentive developer portal.", required: true },
+          { input: "password", key: "clientSecret", credential: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID in the Attentive developer portal.", redact: true, required: true }
+        ],
+        icon: attentive_default,
+        name: "Attentive"
+      }
+    }
   },
   requires: [
     "ATTENTIVE_OAUTH_CLIENT_ID",
@@ -990,6 +996,43 @@ var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fi
 </defs>
 </svg>`;
 
+// lib/connections/icons/hubspot.js
+var hubspot_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#FF7A59"/>
+<circle cx="290" cy="290" r="78" stroke="white" stroke-width="30"/>
+<circle cx="290" cy="290" r="18" fill="white"/>
+<path d="M290 212V150" stroke="white" stroke-width="30" stroke-linecap="round"/>
+<circle cx="290" cy="125" r="28" fill="white"/>
+<path d="M270 137L172 96" stroke="white" stroke-width="22" stroke-linecap="round"/>
+<circle cx="160" cy="91" r="20" fill="white"/>
+<path d="M233 347L184 396" stroke="white" stroke-width="26" stroke-linecap="round"/>
+<circle cx="172" cy="408" r="22" fill="white"/>
+</svg>`;
+
+// lib/connections/icons/sendgrid.js
+var sendgrid_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#F1FAFF"/>
+<g clip-path="url(#clip0_1011_2743)">
+<path d="M366.676 134.534V289.172H289.203V366.487H134.258L134.258 289.171L134.256 289.172V211.851H211.729V134.534H366.676Z" fill="#9DD6E3"/>
+<path d="M134.258 366.488H211.731V289.169H134.258V366.488Z" fill="#3F72AB"/>
+<path d="M289.203 289.172H366.677V211.852H289.203V289.172Z" fill="#00A9D1"/>
+<path d="M211.729 211.853H289.202V134.534H211.729V211.853Z" fill="#00A9D1"/>
+<path d="M211.729 289.17H289.202V211.852H211.729V289.17Z" fill="#2191C4"/>
+<path d="M289.203 211.853H366.677V134.534H289.203V211.853Z" fill="#3F72AB"/>
+</g>
+<defs>
+<clipPath id="clip0_1011_2743">
+<rect width="232.42" height="231.956" fill="white" transform="translate(134.256 134.534)"/>
+</clipPath>
+</defs>
+</svg>`;
+
+// lib/connections/icons/twilio.js
+var twilio_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#F22F46"/>
+<path d="M250 134.954C186.341 134.954 134.954 186.341 134.954 250C134.954 313.659 186.341 365.047 250 365.047C313.659 365.047 365.047 313.659 365.047 250C365.047 186.341 313.659 134.954 250 134.954ZM250 334.368C203.215 334.368 165.633 296.786 165.633 250C165.633 203.215 203.215 165.633 250 165.633C296.786 165.633 334.368 203.215 334.368 250C334.368 296.786 296.786 334.368 250 334.368ZM302.155 221.622C302.155 234.661 291.417 245.399 278.378 245.399C265.34 245.399 254.602 234.661 254.602 221.622C254.602 208.584 265.34 197.846 278.378 197.846C291.417 197.846 302.155 208.584 302.155 221.622ZM302.155 278.378C302.155 291.417 291.417 302.155 278.378 302.155C265.34 302.155 254.602 291.417 254.602 278.378C254.602 265.34 265.34 254.602 278.378 254.602C291.417 254.602 302.155 265.34 302.155 278.378ZM245.399 278.378C245.399 291.417 234.661 302.155 221.622 302.155C208.584 302.155 197.846 291.417 197.846 278.378C197.846 265.34 208.584 254.602 221.622 254.602C234.661 254.602 245.399 265.34 245.399 278.378ZM245.399 221.622C245.399 234.661 234.661 245.399 221.622 245.399C208.584 245.399 197.846 234.661 197.846 221.622C197.846 208.584 208.584 197.846 221.622 197.846C234.661 197.846 245.399 208.584 245.399 221.622Z" fill="white"/>
+</svg>`;
+
 // lib/transactions.js
 import { currentTraceId } from "@drawbridge/drawbridge-telemetry";
 
@@ -2156,37 +2199,56 @@ var drawbridge_default2 = {
   //
   // They belong on THIS manifest because this is the connection that sends: the
   // email, sms and segment hooks below are the only things that spend them, and
-  // a private connection is still where a vendor fact lives.
+  // a private connection is still where a vendor fact lives. They are THREE
+  // VENDORS, not one, and each is its own row and its own admin card — so
+  // SendGrid reads live on a deployment that never configured Twilio, instead
+  // of one card for all three that could only ever be as live as its weakest.
   //
   // UNLIKE every public vendor, none of these appear in `requires` — see the
   // comment there. Availability and configuration are different questions, and a
   // missing CRM token must not take every base workflow step away.
+  //
+  // ponytail: the field keys keep the names they had on the shared row
+  // (smsSid, hubspotToken) so the readers destructuring vendorSettings() did
+  // not move. Rename them to sid/token when those readers are next touched.
   provider: {
-    fields: [
-      { input: "email", key: "accountSender", credential: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
-      { input: "password", key: "apiKey", credential: "SENDGRID_API_KEY", label: "SendGrid API key", message: "SendGrid dashboard, Settings, API Keys \u2014 full access for sends.", redact: true, required: true },
-      // NOT required. The CRM sync is best-effort internal tooling and no-ops
-      // without a token — requiring it would make the whole drawbridge provider
-      // read not-live over something no merchant ever sees.
-      { input: "password", key: "hubspotToken", credential: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
-      // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-      // either. Unset, it degrades to the account sender rather than
-      // refusing to start.
-      { input: "email", key: "leadSender", credential: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
-      // NOT required, the three of them together. SendGrid alone is enough to
-      // run the platform — sign-in codes, notifications and every lead-facing
-      // mail are email. Requiring Twilio here made the whole drawbridge
-      // provider read not-live on a deployment that never sends SMS, over a
-      // channel it was not using.
-      //
+    vendors: {
+      sendgrid: {
+        fields: [
+          { input: "email", key: "accountSender", credential: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
+          { input: "password", key: "apiKey", credential: "SENDGRID_API_KEY", label: "SendGrid API key", message: "SendGrid dashboard, Settings, API Keys \u2014 full access for sends.", redact: true, required: true },
+          // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
+          // either. Unset, it degrades to the account sender rather than
+          // refusing to start.
+          { input: "email", key: "leadSender", credential: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." }
+        ],
+        icon: sendgrid_default,
+        name: "SendGrid"
+      },
       // Missing, SMS is LOCKED DOWN rather than broken: every send path
       // refuses cleanly (queue/notification.js cancels, the otc stream skips
       // and logs), the number-purchase routes deny, and identityDefaults.sms
-      // hides the org's SMS settings entirely.
-      { input: "text", key: "smsFrom", credential: "TWILIO_ACCOUNT_FROM", label: "SMS number", message: "Without Twilio credentials, SMS is disabled across the platform." },
-      { input: "password", key: "smsSid", credential: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", message: "Twilio console home \u2014 the AC\u2026 identifier on the account dashboard.", redact: true },
-      { input: "password", key: "smsToken", credential: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", message: "Beside the account SID on the Twilio console dashboard.", redact: true }
-    ]
+      // hides the org's SMS settings entirely. The card reads not live, which
+      // is the truth about Twilio and says nothing about email.
+      twilio: {
+        fields: [
+          { input: "text", key: "smsFrom", credential: "TWILIO_ACCOUNT_FROM", label: "SMS number", message: "Without Twilio credentials, SMS is disabled across the platform.", required: true },
+          { input: "password", key: "smsSid", credential: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", message: "Twilio console home \u2014 the AC\u2026 identifier on the account dashboard.", redact: true, required: true },
+          { input: "password", key: "smsToken", credential: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", message: "Beside the account SID on the Twilio console dashboard.", redact: true, required: true }
+        ],
+        icon: twilio_default,
+        name: "Twilio"
+      },
+      // The CRM sync is best-effort internal tooling and no-ops without a
+      // token. Not live here costs nothing a merchant can see.
+      hubspot: {
+        fields: [
+          { input: "password", key: "hubspotToken", credential: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true, required: true }
+        ],
+        icon: hubspot_default,
+        name: "HubSpot"
+      }
+    }
   },
   // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
   //
@@ -2772,12 +2834,20 @@ var klaviyo_default2 = {
   // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
   // what an admin types on the provider screen. Declared here rather than in a
   // table in lib/providers.js, so a vendor's credentials sit beside the
-  // `requires` that names the same variables.
+  // `requires` that names the same variables. Keyed by the VENDOR that holds
+  // them — here the vendor and the connection are the same thing, which is not
+  // true of every manifest.
   provider: {
-    fields: [
-      { input: "text", key: "clientId", credential: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", message: "From our app in the Klaviyo developer portal (developers.klaviyo.com).", required: true },
-      { input: "password", key: "clientSecret", credential: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID on the Klaviyo app.", redact: true, required: true }
-    ]
+    vendors: {
+      klaviyo: {
+        fields: [
+          { input: "text", key: "clientId", credential: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", message: "From our app in the Klaviyo developer portal (developers.klaviyo.com).", required: true },
+          { input: "password", key: "clientSecret", credential: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID on the Klaviyo app.", redact: true, required: true }
+        ],
+        icon: klaviyo_default,
+        name: "Klaviyo"
+      }
+    }
   },
   requires: [
     "KLAVIYO_OAUTH_CLIENT_ID",
@@ -3120,10 +3190,16 @@ var mailchimp_default2 = {
   // what an admin types on the provider screen, beside the `requires` naming the
   // same variables.
   provider: {
-    fields: [
-      { input: "text", key: "clientId", credential: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", message: "From our registered app \u2014 Mailchimp account, Extras, Registered apps.", required: true },
-      { input: "password", key: "clientSecret", credential: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID on the registered app.", redact: true, required: true }
-    ]
+    vendors: {
+      mailchimp: {
+        fields: [
+          { input: "text", key: "clientId", credential: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", message: "From our registered app \u2014 Mailchimp account, Extras, Registered apps.", required: true },
+          { input: "password", key: "clientSecret", credential: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", message: "Beside the Client ID on the registered app.", redact: true, required: true }
+        ],
+        icon: mailchimp_default,
+        name: "Mailchimp"
+      }
+    }
   },
   // The OAuth client this deployment registered. Without both, the vendor drops
   // out of availableConnections rather than offering a Connect button that
@@ -4028,7 +4104,7 @@ var shopify_default2 = {
       // against the ones the app now needs, and queues a webhook
       // reconciliation.
       health: async ({ connection: connection2, workflow }, { adminToken, logger: logger2, read, reconcileScopes, resolveSettings, rotateToken, shopify } = {}) => {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f;
         const request2 = {
           connectionId: workflow.connection,
           organizationId: workflow.organization,
@@ -4053,6 +4129,7 @@ var shopify_default2 = {
           let metered;
           let shopCurrency = null;
           let billingProbeFailed = false;
+          let reconciliation = null;
           try {
             if (!(source == null ? void 0 : source.id)) {
               const shopData = await shopify.oauth.getShop({ adminAccessToken, shop: connection2.shop });
@@ -4073,45 +4150,99 @@ var shopify_default2 = {
             const partnerRow = (read == null ? void 0 : read.get) ? await read.get({ collection: "provider", query: { slug: "shopify" } }) : null;
             const partner = (partnerRow == null ? void 0 : partnerRow.settings) ? decrypt(partnerRow.settings) : {};
             if (partner.partnerToken && partner.partnerOrgId && partner.partnerAppId && (source == null ? void 0 : source.id) && ((_b = shopify.partner) == null ? void 0 : _b.getUsageChargeEvents)) {
+              const ledgerFloor = new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3);
               const accruals = await shopify.partner.getUsageChargeEvents({
                 appId: "gid://shopify/App/" + partner.partnerAppId,
-                first: 5,
-                occurredAtMin: new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3).toISOString(),
+                first: 10,
+                occurredAtMin: ledgerFloor.toISOString(),
                 organizationId: partner.partnerOrgId,
                 partnerToken: partner.partnerToken,
                 shopId: "gid://shopify/Shop/" + source.id
               });
-              const accrued = accruals.find((event) => Number(event.usageQuantity) > 0);
-              if (accrued) {
-                metered = String(accrued.chargeId || accrued.id);
-                writes.push({
+              const boundaries = accruals.filter((event) => event.occurredAt).sort((a, b) => new Date(a.occurredAt) - new Date(b.occurredAt));
+              const accrued = [...boundaries].reverse().find((event) => Number(event.usageQuantity) > 0);
+              if (accrued) metered = String(accrued.chargeId || accrued.id);
+              const stampedAt = (_c = boundaries.find(
+                (event) => {
+                  var _a2;
+                  return String(event.chargeId || event.id) === String(((_a2 = connection2.source) == null ? void 0 : _a2.metered) || "");
+                }
+              )) == null ? void 0 : _c.occurredAt;
+              reconciliation = [];
+              let windowStart = ledgerFloor;
+              for (const boundary of boundaries) {
+                const windowEnd = new Date(boundary.occurredAt);
+                const windowOpensAt = windowStart;
+                windowStart = windowEnd;
+                if (stampedAt && windowEnd <= new Date(stampedAt)) continue;
+                const charged = Math.round(Number(boundary.usageQuantity) || 0);
+                const [tally] = await read.aggregate({
                   collection: "order",
-                  data: {
-                    $set: { "billed.receipt": metered }
-                  },
-                  // Top-level, not an option — the controller takes
-                  // `multiple` beside `options`, and the shell
-                  // forwards it as such.
-                  multiple: true,
-                  operation: "update",
-                  query: {
-                    "billed.date": { $gte: new Date(accrued.occurredAt || 0) },
-                    "billed.receipt": { $in: [null] },
-                    organization: workflow.organization,
-                    "provider.slug": "shopify"
-                  }
-                });
+                  pipeline: [
+                    { $match: {
+                      "billed.date": { $gt: windowOpensAt, $lte: windowEnd },
+                      "billed.void": { $in: [null] },
+                      organization: workflow.organization,
+                      "provider.slug": "shopify"
+                    } },
+                    { $group: {
+                      _id: null,
+                      billed: { $sum: "$billed.amount" },
+                      orders: { $push: "$id" }
+                    } }
+                  ]
+                }) || [];
+                const billed = (tally == null ? void 0 : tally.billed) || 0;
+                const orders = (tally == null ? void 0 : tally.orders) || [];
+                const charge = String(boundary.chargeId || boundary.id);
+                const balanced = charged === billed;
+                if (!(charged || billed)) continue;
+                if (balanced) {
+                  writes.push({
+                    collection: "order",
+                    data: {
+                      $set: { "billed.receipt": charge }
+                    },
+                    // Top-level, not an option — the controller takes
+                    // `multiple` beside `options`, and the shell
+                    // forwards it as such.
+                    multiple: true,
+                    operation: "update",
+                    query: {
+                      "billed.date": { $gt: windowOpensAt, $lte: windowEnd },
+                      "billed.receipt": { $in: [null] },
+                      "billed.void": { $in: [null] },
+                      organization: workflow.organization,
+                      "provider.slug": "shopify"
+                    }
+                  });
+                } else {
+                  (_d = logger2 == null ? void 0 : logger2.error) == null ? void 0 : _d.call(logger2, new Error(
+                    "shopify.usage.reconciliation.mismatch on shop " + connection2.shop + ": charge " + charge + " charged " + charged + " cents but its window holds " + billed + " cents across " + orders.length + " billed orders \u2014 each cent of difference is commission that never charged"
+                  ), {
+                    extra: {
+                      billed,
+                      charge,
+                      charged,
+                      orders: orders.slice(0, 50),
+                      shop: connection2.shop,
+                      windowEnd,
+                      windowStart: windowOpensAt
+                    }
+                  });
+                }
+                reconciliation.push({ balanced, billed, charge, charged, occurredAt: boundary.occurredAt, orders: orders.length });
               }
             }
           } catch (probeError) {
             billingProbeFailed = true;
-            (_c = logger2 == null ? void 0 : logger2.warn) == null ? void 0 : _c.call(logger2, "shopify.health.billing.probe.failed", {
+            (_e = logger2 == null ? void 0 : logger2.warn) == null ? void 0 : _e.call(logger2, "shopify.health.billing.probe.failed", {
               connectionId: connection2.id,
               message: probeError == null ? void 0 : probeError.message,
               shop: connection2.shop
             });
           }
-          if (sourceRepaired || metered !== void 0 && metered !== (((_d = connection2.source) == null ? void 0 : _d.metered) ?? void 0)) {
+          if (sourceRepaired || metered !== void 0 && metered !== (((_f = connection2.source) == null ? void 0 : _f.metered) ?? void 0)) {
             writes.push({
               collection: "connection",
               data: {
@@ -4182,6 +4313,9 @@ var shopify_default2 = {
               metered: metered ?? null,
               meterProbed: metered !== void 0,
               pingedAt: /* @__PURE__ */ new Date(),
+              // One entry per boundary charge judged this run: what
+              // Shopify charged vs what the window's orders billed.
+              ...reconciliation && { reconciliation },
               refreshTokenExpiresAt: refreshTokenExpiresAt || null,
               refreshTokenRotated,
               scopesMissing,
@@ -4321,28 +4455,34 @@ var shopify_default2 = {
   // name required by the manifest and enterable nowhere is a vendor that can
   // never go live from the admin screen.
   provider: {
-    fields: [
-      { input: "text", key: "apiKey", credential: "SHOPIFY_API_KEY", label: "API key", message: "The app's Client ID \u2014 Dev Dashboard, the app, Settings.", required: true },
-      { input: "password", key: "apiSecret", credential: "SHOPIFY_API_SECRET", label: "API secret", message: "The app's Client secret, beside the Client ID in the app's settings.", redact: true, required: true },
-      { input: "text", key: "appHandle", credential: "SHOPIFY_APP_HANDLE", label: "App handle", message: "The app's URL handle (for example drawbridge-development), from the app's configuration.", required: true },
-      { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", message: 'Where "View on the Shopify App Store" sends merchants \u2014 the public listing, or the Dev Dashboard install link for the dev app.', required: true },
-      // The usage meter's event handle, when the plan config's meter ever
-      // changes: stored value overrides the built-in default
-      // (events.order.handle) at the mint point, and `format : 'slug'`
-      // normalizes it on save — a handle can carry no spaces or capitals,
-      // and classification against it is case-sensitive. Optional: empty
-      // means the default, and the sender still refuses any handle that
-      // disagrees with the transaction it minted.
-      { format: "slug", input: "text", key: "orderEventHandle", label: "Order event handle", message: "Must match the usage meter's Handle field on the plan exactly \u2014 lowercase and hyphens. Leave empty to use drawbridge-orders.", required: false, setting: true },
-      // The Partner API credential set — the ONE place meter billing is
-      // observable (CHARGE_USAGE accrual events). Org id and numeric app
-      // id come from the Partner Dashboard; the token from Settings →
-      // Partner API clients (Manage-apps permission). All optional: the
-      // accrual probe simply stays off until they exist.
-      { input: "text", key: "partnerOrgId", label: "Partner organization ID", message: "The number in the Partner Dashboard URL \u2014 partners.shopify.com/<this number>/\u2026 \u2014 NOT the admin organization_id from the app listing link.", required: false, setting: true },
-      { input: "text", key: "partnerAppId", label: "Partner app ID (numeric)", message: "The numeric id in the app's Partner Dashboard URL \u2014 not the Client ID.", required: false, setting: true },
-      { input: "password", key: "partnerToken", label: "Partner API token", message: "Partner Dashboard, Settings, Partner API clients \u2014 create one with Manage apps and paste the prtapi_ token.", redact: true, required: false, setting: true }
-    ]
+    vendors: {
+      shopify: {
+        fields: [
+          { input: "text", key: "apiKey", credential: "SHOPIFY_API_KEY", label: "API key", message: "The app's Client ID \u2014 Dev Dashboard, the app, Settings.", required: true },
+          { input: "password", key: "apiSecret", credential: "SHOPIFY_API_SECRET", label: "API secret", message: "The app's Client secret, beside the Client ID in the app's settings.", redact: true, required: true },
+          { input: "text", key: "appHandle", credential: "SHOPIFY_APP_HANDLE", label: "App handle", message: "The app's URL handle (for example drawbridge-development), from the app's configuration.", required: true },
+          { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", message: 'Where "View on the Shopify App Store" sends merchants \u2014 the public listing, or the Dev Dashboard install link for the dev app.', required: true },
+          // The usage meter's event handle, when the plan config's meter ever
+          // changes: stored value overrides the built-in default
+          // (events.order.handle) at the mint point, and `format : 'slug'`
+          // normalizes it on save — a handle can carry no spaces or capitals,
+          // and classification against it is case-sensitive. Optional: empty
+          // means the default, and the sender still refuses any handle that
+          // disagrees with the transaction it minted.
+          { format: "slug", input: "text", key: "orderEventHandle", label: "Order event handle", message: "Must match the usage meter's Handle field on the plan exactly \u2014 lowercase and hyphens. Leave empty to use drawbridge-orders.", required: false, setting: true },
+          // The Partner API credential set — the ONE place meter billing is
+          // observable (CHARGE_USAGE accrual events). Org id and numeric app
+          // id come from the Partner Dashboard; the token from Settings →
+          // Partner API clients (Manage-apps permission). All optional: the
+          // accrual probe simply stays off until they exist.
+          { input: "text", key: "partnerOrgId", label: "Partner organization ID", message: "The number in the Partner Dashboard URL \u2014 partners.shopify.com/<this number>/\u2026 \u2014 NOT the admin organization_id from the app listing link.", required: false, setting: true },
+          { input: "text", key: "partnerAppId", label: "Partner app ID (numeric)", message: "The numeric id in the app's Partner Dashboard URL \u2014 not the Client ID.", required: false, setting: true },
+          { input: "password", key: "partnerToken", label: "Partner API token", message: "Partner Dashboard, Settings, Partner API clients \u2014 create one with Manage apps and paste the prtapi_ token.", redact: true, required: false, setting: true }
+        ],
+        icon: shopify_default,
+        name: "Shopify"
+      }
+    }
   },
   // A pre-launch integration: it only surfaces once the App Store listing
   // exists and the app is fully configured. Requiring all four means it can
@@ -4823,8 +4963,19 @@ var implemented = (hooks, path) => {
 var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
 );
+var checkIcon = (owner, icon) => {
+  if (typeof icon !== "string" || !icon.includes("<svg")) {
+    throw new Error(owner + " needs an icon \u2014 the svg markup itself, not a path to one");
+  }
+  if (!icon.includes("viewBox")) {
+    throw new Error(owner + " icon has no viewBox, so it cannot scale");
+  }
+  if (icon.includes("<image")) {
+    throw new Error(owner + " icon wraps a raster \u2014 re-export it as vector shapes");
+  }
+};
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -4854,46 +5005,53 @@ var build = (manifest) => {
       }
     }
   }
-  for (const field2 of ((_c = manifest.provider) == null ? void 0 : _c.fields) || []) {
-    if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
-      throw new Error(manifest.slug + " declares a provider field with no key or label");
-    }
-    if (!INPUTS.includes(field2.input)) {
-      throw new Error(manifest.slug + ".provider." + field2.key + " needs an input the admin form can render \u2014 one of " + INPUTS.join(", "));
+  if ((_c = manifest.provider) == null ? void 0 : _c.fields) {
+    throw new Error(manifest.slug + " declares provider.fields \u2014 fields live under provider.vendors.<vendor> now, keyed by the vendor that holds them");
+  }
+  const declaredKeys = /* @__PURE__ */ new Set();
+  for (const [vendor, declared] of Object.entries(((_d = manifest.provider) == null ? void 0 : _d.vendors) || {})) {
+    if (!(declared == null ? void 0 : declared.name)) throw new Error(manifest.slug + " declares vendor " + vendor + " with no name");
+    checkIcon(manifest.slug + " vendor " + vendor, declared.icon);
+    if (!Array.isArray(declared.fields) || !declared.fields.length) {
+      throw new Error(manifest.slug + " declares vendor " + vendor + " with no fields \u2014 a vendor nothing is typed into holds nothing");
     }
-    if (field2.input === "password" && !field2.redact) {
-      throw new Error(manifest.slug + ".provider." + field2.key + " is a password and must declare redact : true \u2014 the api would hand the value back");
+    for (const field2 of declared.fields) {
+      if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
+        throw new Error(manifest.slug + " declares a provider field with no key or label");
+      }
+      if (!INPUTS.includes(field2.input)) {
+        throw new Error(manifest.slug + ".provider." + field2.key + " needs an input the admin form can render \u2014 one of " + INPUTS.join(", "));
+      }
+      if (field2.input === "password" && !field2.redact) {
+        throw new Error(manifest.slug + ".provider." + field2.key + " is a password and must declare redact : true \u2014 the api would hand the value back");
+      }
+      if (declaredKeys.has(field2.key)) {
+        throw new Error(manifest.slug + " declares " + field2.key + " under two vendors \u2014 vendorSettings() merges them and one would win");
+      }
+      declaredKeys.add(field2.key);
     }
   }
-  if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
-    throw new Error(manifest.slug + " needs an icon \u2014 the svg markup itself, not a path to one");
-  }
-  if (!manifest.icon.includes("viewBox")) {
-    throw new Error(manifest.slug + " icon has no viewBox, so it cannot scale");
-  }
-  if (manifest.icon.includes("<image")) {
-    throw new Error(manifest.slug + " icon wraps a raster \u2014 re-export it as vector shapes");
-  }
+  checkIcon(manifest.slug, manifest == null ? void 0 : manifest.icon);
   if (!GROUPS.includes(manifest == null ? void 0 : manifest.group)) {
     throw new Error(manifest.slug + " needs a group \u2014 one of " + GROUPS.join(", "));
   }
-  if ((_d = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _d.type) {
+  if ((_e = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _e.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_e = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _e.type)) {
+  if (!AUTH_TYPES.includes((_f = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _f.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
     for (const field2 of OAUTH_FIELDS) {
-      if (!((_f = manifest.auth.oauth) == null ? void 0 : _f[field2])) {
+      if (!((_g = manifest.auth.oauth) == null ? void 0 : _g[field2])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field2);
       }
     }
-    if (typeof ((_h = (_g = manifest.hooks) == null ? void 0 : _g.auth) == null ? void 0 : _h.token) !== "function") {
+    if (typeof ((_i = (_h = manifest.hooks) == null ? void 0 : _h.auth) == null ? void 0 : _i.token) !== "function") {
       throw new Error(manifest.slug + " is oauth and must implement hooks.auth.token \u2014 point it at authToken() or wrap it");
     }
     for (const url of OAUTH_URLS) {
-      if (!((_j = (_i = manifest.auth.oauth) == null ? void 0 : _i.urls) == null ? void 0 : _j[url])) {
+      if (!((_k = (_j = manifest.auth.oauth) == null ? void 0 : _j.urls) == null ? void 0 : _k[url])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth.urls." + url);
       }
     }
@@ -4903,16 +5061,16 @@ var build = (manifest) => {
       );
     }
   }
-  if (implemented(manifest.hooks, "inbound.event") && typeof ((_l = (_k = manifest.hooks) == null ? void 0 : _k.inbound) == null ? void 0 : _l.event) !== "function" && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.event)) {
+  if (implemented(manifest.hooks, "inbound.event") && typeof ((_m = (_l = manifest.hooks) == null ? void 0 : _l.inbound) == null ? void 0 : _m.event) !== "function" && !((_o = (_n = manifest.inbound) == null ? void 0 : _n.headers) == null ? void 0 : _o.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_p = (_o = manifest.inbound) == null ? void 0 : _o.headers) == null ? void 0 : _p.signature)) {
+  if (implemented(manifest.hooks, "inbound.verify") && !((_q = (_p = manifest.inbound) == null ? void 0 : _p.headers) == null ? void 0 : _q.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
     throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray((_q = manifest == null ? void 0 : manifest.content) == null ? void 0 : _q.guide) || !manifest.content.guide.length) {
+  if (!Array.isArray((_r = manifest == null ? void 0 : manifest.content) == null ? void 0 : _r.guide) || !manifest.content.guide.length) {
     throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
@@ -4924,8 +5082,8 @@ var build = (manifest) => {
   }
   for (const [domain, verbs] of Object.entries(HOOKS)) {
     for (const verb of verbs) {
-      const hook = (_s = (_r = manifest.hooks) == null ? void 0 : _r[domain]) == null ? void 0 : _s[verb];
-      if (((_t = manifest.hooks) == null ? void 0 : _t[domain]) === false) continue;
+      const hook = (_t = (_s = manifest.hooks) == null ? void 0 : _s[domain]) == null ? void 0 : _t[verb];
+      if (((_u = manifest.hooks) == null ? void 0 : _u[domain]) === false) continue;
       if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
         throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
       }
@@ -4970,6 +5128,44 @@ var connections = Object.freeze({
   shopify: build(shopify_default2),
   webhook: build(webhook_default)
 });
+var canonical = (field2) => JSON.stringify(Object.fromEntries(Object.entries(field2).sort()));
+var mergeVendors = (catalog) => {
+  var _a;
+  const merged = {};
+  const claimed = /* @__PURE__ */ new Map();
+  for (const [slug2, manifest] of Object.entries(catalog)) {
+    for (const [vendor, declared] of Object.entries(((_a = manifest.provider) == null ? void 0 : _a.vendors) || {})) {
+      const held = merged[vendor] || (merged[vendor] = { fields: [], icon: declared.icon, name: declared.name });
+      if (held.name !== declared.name) {
+        throw new Error(slug2 + " names vendor " + vendor + ' "' + declared.name + '" but another manifest names it "' + held.name + '"');
+      }
+      if (held.icon !== declared.icon) {
+        throw new Error(slug2 + " declares a different icon for vendor " + vendor + " than another manifest \u2014 one vendor, one mark");
+      }
+      for (const field2 of declared.fields) {
+        const existing = held.fields.find((entry) => entry.key === field2.key);
+        if (existing) {
+          if (canonical(existing) !== canonical(field2)) {
+            throw new Error(slug2 + " declares " + vendor + "." + field2.key + " differently from another manifest \u2014 a field two connections spend is declared identically in both");
+          }
+          continue;
+        }
+        if (field2.credential) {
+          const owner = claimed.get(field2.credential);
+          if (owner) {
+            throw new Error(field2.credential + " is claimed by both " + owner + " and " + vendor + "." + field2.key + " \u2014 one would silently overwrite the other");
+          }
+          claimed.set(field2.credential, vendor + "." + field2.key);
+        }
+        held.fields.push(field2);
+      }
+    }
+  }
+  return Object.freeze(Object.fromEntries(
+    Object.entries(merged).map(([vendor, held]) => [vendor, Object.freeze({ ...held, fields: Object.freeze(held.fields) })])
+  ));
+};
+var vendors = mergeVendors(connections);
 (() => {
   var _a;
   const routes = {};
@@ -5042,11 +5238,8 @@ var publicConnectionKeys = Object.freeze([
 ]);
 
 // lib/providers.js
-var providerFields = (slug2) => {
-  var _a;
-  return Object.hasOwn(connections, slug2) ? ((_a = connections[slug2].provider) == null ? void 0 : _a.fields) || [] : [];
-};
-var providerSlugs = () => Object.keys(connections).filter((slug2) => connections[slug2].provider).sort();
+var providerFields = (slug2) => Object.hasOwn(vendors, slug2) ? vendors[slug2].fields : [];
+var providerSlugs = () => Object.keys(vendors).sort();
 var isLive = (slug2, settings) => {
   const fields2 = providerFields(slug2);
   if (!fields2.length) return false;
@@ -5071,6 +5264,15 @@ var providerSettings = async ({ controller, slug: slug2 }) => {
   providerMemo.set(slug2, { at: Date.now(), value });
   return value;
 };
+var vendorSettings = async ({ controller, slug: slug2 }) => {
+  var _a;
+  const declared = Object.hasOwn(connections, slug2) ? Object.keys(((_a = connections[slug2].provider) == null ? void 0 : _a.vendors) || {}) : [];
+  let merged = {};
+  for (const vendor of declared) {
+    merged = { ...merged, ...await providerSettings({ controller, slug: vendor }) };
+  }
+  return merged;
+};
 var saveProviderSettings = async ({ authenticated, clear, controller, settings, slug: slug2 }) => {
   const fields2 = providerFields(slug2);
   if (!fields2.length) return null;
@@ -5132,5 +5334,7 @@ export {
   providerMemo,
   providerSettings,
   providerSlugs,
-  saveProviderSettings
+  saveProviderSettings,
+  vendorSettings,
+  vendors
 };