@drawbridge/drawbridge-utils 0.0.176 → 0.0.177

package/dist/{index-B8JhYfvU.d.ts → index-B546oDNo.d.ts}

@@ -1,11 +1,18 @@
 import { isDuplicateKey } from './usage.js';
+import { decrypt, encrypt } from './encrypt.js';
 import { authToken } from './connections/oauth.js';
 import { toE164, detectCountry } from './phone.js';
 import crypto, { randomUUID, createHmac, timingSafeEqual, createVerify, createHash } from 'node:crypto';
 import { request } from './http.js';
 import { customAlphabet } from 'nanoid';
+import { i as shopifyAdmin } from './admin-C3HtEM6h.js';
+import { a as shopifyBilling } from './billing-mNsKflmQ.js';
+import { s as shopifyOauth } from './oauth-DveZMLHx.js';
+import { s as shopifyPartner } from './partner-BOZltuh2.js';
+import { s as shopifyStorefront } from './storefront-DJFGLqPl.js';
 import { toCanonicalEmail } from './email.js';
-import { decrypt } from './encrypt.js';
+import { tokenTypes, hashToken } from './oauth/index.js';
+import { sanitizeDomain } from './sanitize.js';
 import { slugify } from './slugify.js';
 import { safeRequest } from './safe-http.js';
 
@@ -158,6 +165,10 @@ const HOOKS = Object.freeze({
 		'code',
 		// Create the buyer at the vendor, so an order can be attributed to them.
 		'customer',
+		// HOW MANY OF THIS PRODUCT ARE LEFT, at the vendor. Read at the moment a
+		// campaign's product list is rendered rather than stored, because stock is
+		// the one product fact that is stale the instant it is written down.
+		'inventory',
 		// An order arrived at the vendor: attribute it, record it, update totals.
 		'order',
 		// Pull product data across on a vendor update.
@@ -233,7 +244,19 @@ const HOOKS = Object.freeze({
 
 		// What the merchant pays the VENDOR. Pairs with auth.install.billing, which
 		// declares the plan they are being charged on.
-		plan : Object.freeze([ 'cancel', 'reselect' ]),
+		//
+		// `verify` is the odd one of the three: not something a merchant does, but
+		// the question "is this store's billing actually metered right now". It is
+		// here because it is the same subject — and because the answer was being
+		// derived in TWO places, the vendor's health check and drawbridge-sync's
+		// approval webhook, whose copy said in its own comment that it matched the
+		// other and did not.
+		// `charge` and `verify` are the two that are not merchant actions: one
+		// sends a usage charge to the vendor's meter, the other asks whether that
+		// meter is actually working. Both are here because both are the same
+		// subject — what the merchant pays the vendor — and both were being done
+		// from drawbridge-sync with a direct import of the vendor's client.
+		plan : Object.freeze([ 'cancel', 'charge', 'reselect', 'verify' ]),
 
 		// The embedded app's own session, stored by us on the vendor's behalf.
 		session : Object.freeze([ 'clear', 'read', 'save' ]),
@@ -535,12 +558,22 @@ const WRITE_OPERATIONS = Object.freeze([ 'create', 'delete', 'update' ]);
 //                       -> features)
 //   chunkSize           the worker fleet's fan-out width — deployment tuning,
 //                       passed, never published
+//   currencies          the settlement currencies Drawbridge can bill, so a
+//                       store outside them is refused with the reason rather
+//                       than failing a validator inside a transaction
 //   dispatch()          the caller's own coordinator table, for hooks that are
 //                       dispatches
+//   mark()              the one write a description cannot carry because of its
+//                       ORDER — install.plan.reselect must persist the marker
+//                       BEFORE it releases the approval, and a described write
+//                       lands after the hook returns
 //   fetcher             fetch-shaped transport: ( url, options )
 //   logger              the caller's logger
 //   mintId()            an id minted before the write it belongs to, so one
 //                       described write can reference another
+//   planTitle()         the name of the Drawbridge plan an organization is on,
+//                       given its subscription. Injected for the same reason as
+//                       conversionRate, and from the same catalogue
 //   read                the controller's READ methods — get, aggregate, count —
 //                       and never anything that writes; not `controller`, not
 //                       `db`, because a name that implies writing invites it
@@ -553,10 +586,15 @@ const WRITE_OPERATIONS = Object.freeze([ 'create', 'delete', 'update' ]);
 //                       decides billing
 //   resolveSettings()   fresh from wherever the vendor keeps credentials, per
 //                       call, never a snapshot
+//   shopify             the vendor's client namespaces. DEFAULTED to the real
+//                       client, which the manifest imports directly — production
+//                       injects nothing. Overridable because it is the SDK
+//                       boundary, and that is where a hook test belongs: the
+//                       health tests stub getActiveAppSubscriptions and assert
+//                       the arguments it was called with
 //   rotateToken()       deliberate rotation, for the health check that rotates
 //                       before the window closes
-//   shopify             the SDK namespaces, injected — this package cannot
-//                       import what depends on it
+
 //
 // WHICH OF THESE A GIVEN SLOT ACTUALLY CARRIES is the table below, not this
 // glossary. A name here means one thing everywhere it appears; the table says
@@ -564,7 +602,13 @@ const WRITE_OPERATIONS = Object.freeze([ 'create', 'delete', 'update' ]);
 // Three signatures shared by a whole family, declared once so the family cannot
 // drift apart the way resources.* was starting to. Named rather than repeated:
 // a copy-pasted array is a copy that can be edited alone.
-const INSTALL_SIGNATURE = Object.freeze({ options : [ 'read', 'request' ], props : [ 'context' ] });
+// THE INSTALL BASELINE: the request's own body, and the ability to read. Seven
+// of the thirteen slots need nothing else — they answer from the shared install
+// record and describe their writes. `request` came off it when the slots were
+// implemented and none of them made an outbound call of its own; four reach the
+// VENDOR, and they do it through `shopify`, which is the seam every other
+// vendor-calling slot already uses.
+const INSTALL_SIGNATURE = Object.freeze({ options : [ 'read' ], props : [ 'context' ] });
 
 const LIFECYCLE_SIGNATURE = Object.freeze({ options : [ 'dispatch' ], props : [ 'context' ] });
 
@@ -617,15 +661,30 @@ const HOOK_SLOT_PROPS = Object.freeze({
 	// stubbed-fetcher-reaches-production failure the split exists to prevent.
 	'auth.token' : false,
 
-	// COMMERCE. `cart` is declared and unimplemented — the Checkout Kit path in
-	// api/route/subdomain.js writes nothing, which is why it never became a hook
-	// — so its signature mirrors `code`, its nearest sibling, and moving the
-	// route here is a deliberate widening of this line rather than a silent one.
-	'commerce.cart' : Object.freeze({ options : [ 'adminToken', 'shopify' ], props : [ 'connection', 'context', 'step' ] }),
+	// COMMERCE. `cart` is the odd one: it runs for a SHOPPER on a public page,
+	// not for an organization inside a workflow, so it takes no `connection` and
+	// no `step`. It reads the storefront with the store's own storefront token
+	// and mints a checkout token from DRAWBRIDGE'S app credentials, which is why
+	// `clientId`/`clientSecret` are here — as props, the way auth.disconnect
+	// already carries them, because a credential is a fact of the run rather
+	// than a service.
+	'commerce.cart' : Object.freeze({
+		options : [ 'fetcher', 'shopify' ],
+		props : [ 'clientId', 'clientSecret', 'context', 'settings' ]
+	}),
 	'commerce.code' : Object.freeze({ options : [ 'adminToken', 'shopify' ], props : [ 'connection', 'context', 'step' ] }),
 	'commerce.customer' : Object.freeze({ options : [ 'adminToken', 'read', 'shopify' ], props : [ 'connection', 'context' ] }),
+	'commerce.inventory' : Object.freeze({ options : [ 'adminToken', 'shopify' ], props : [ 'connection', 'context' ] }),
 	'commerce.order' : Object.freeze({ options : [ 'conversionRate', 'logger', 'mintId', 'read' ], props : [ 'connection', 'context' ] }),
-	'commerce.product' : Object.freeze({ options : [ 'mintId', 'read' ], props : [ 'connection', 'context', 'workflow' ] }),
+	// THREE OPERATIONS, one slot — record, sync, variants. `settings` and
+	// `adminToken` arrived with the pull half: the storefront read needs the
+	// store's storefront token and the product-feedback send needs its admin one,
+	// and both are resolved by the caller because minting either needs a
+	// controller.
+	'commerce.product' : Object.freeze({
+		options : [ 'adminToken', 'mintId', 'read', 'shopify' ],
+		props : [ 'connection', 'context', 'settings', 'workflow' ]
+	}),
 
 	// THE ADDRESS IS `contact` IN BOTH, and the shell already says why: it is the
 	// person, not the lead document. `remove` called it `email` and `sync` called
@@ -641,19 +700,58 @@ const HOOK_SLOT_PROPS = Object.freeze({
 	'inbound.receive' : Object.freeze({ options : [], props : [ 'channel', 'event', 'headers', 'payload' ] }),
 	'inbound.verify' : Object.freeze({ options : [], props : [ 'body', 'channel', 'headers', 'secret', 'url' ] }),
 
-	// INSTALL — thirteen slots, none implemented yet. They are what the thirteen
-	// routes in api/route/shopify-embedded.js become, and the signature is
-	// deliberately narrow: `context` is the request's own body, `read` and
-	// `request` are the only services an install surface has been shown to need.
-	// A route that cannot be expressed inside this line is a finding to bring
-	// back here, not a name to add at the call site.
+	// INSTALL — thirteen slots, and they are the thirteen routes that used to be
+	// api/route/shopify-embedded.js. `context` is the request's own body in all
+	// of them; the options are where they differ, and every difference below was
+	// forced by a line in those routes rather than chosen.
+	//
+	// SEVEN NEED NOTHING BUT `read`. The two session slots that write, the two
+	// token slots that write, the two clears, and both account slots answer from
+	// the shared install record alone.
+	//
+	// SIX TAKE MORE, and the widenings are worth naming because each is a fact
+	// Drawbridge owns that the manifest must not:
+	//
+	//   conversionRate, planTitle   what Drawbridge charges this organization.
+	//                               The org list renders both, and importing the
+	//                               plan catalogue here is the cycle
+	//                               features -> connections -> shopify -> plans
+	//                               -> features that was just broken.
+	//   currencies                  which settlement currencies Drawbridge can
+	//                               bill. A store outside them fails the
+	//                               connection validator INSIDE the transaction,
+	//                               which surfaces as an opaque 500, so `add`
+	//                               checks first and says so.
+	//   mintId                      the connection's id, known before the write
+	//                               that creates it, because the organization's
+	//                               own refs have to name it in the same
+	//                               transaction.
+	//   shopify                     the vendor. Four slots call the store: two
+	//                               read the live plan, two release it.
+	//   mark                        THE ONE WRITE A DESCRIPTION CANNOT CARRY, and
+	//                               `reselect` is the only slot with one. See its
+	//                               implementation for why the order is the point.
 	'install.account.link' : INSTALL_SIGNATURE,
 	'install.account.unlink' : INSTALL_SIGNATURE,
-	'install.organizations.add' : INSTALL_SIGNATURE,
-	'install.organizations.list' : INSTALL_SIGNATURE,
+	'install.organizations.add' : Object.freeze({
+		options : [ 'currencies', 'mintId', 'read', 'shopify' ],
+		props : [ 'context' ]
+	}),
+	'install.organizations.list' : Object.freeze({
+		options : [ 'conversionRate', 'planTitle', 'read', 'shopify' ],
+		props : [ 'context' ]
+	}),
 	'install.organizations.remove' : INSTALL_SIGNATURE,
-	'install.plan.cancel' : INSTALL_SIGNATURE,
-	'install.plan.reselect' : INSTALL_SIGNATURE,
+	'install.plan.cancel' : Object.freeze({ options : [ 'read', 'shopify' ], props : [ 'context' ] }),
+	// `manifest` because the handle this charge bills under is the vendor's own
+	// declaration (auth.install.billing.handle), and checking the job against the
+	// declaration is what the enqueuer-checks-itself version could not do.
+	'install.plan.charge' : Object.freeze({
+		options : [ 'shopify' ],
+		props : [ 'clientId', 'clientSecret', 'context', 'manifest' ]
+	}),
+	'install.plan.reselect' : Object.freeze({ options : [ 'mark', 'read', 'shopify' ], props : [ 'context' ] }),
+	'install.plan.verify' : Object.freeze({ options : [ 'adminToken', 'read', 'shopify' ], props : [ 'context' ] }),
 	'install.session.clear' : INSTALL_SIGNATURE,
 	'install.session.read' : INSTALL_SIGNATURE,
 	'install.session.save' : INSTALL_SIGNATURE,
@@ -1223,6 +1321,301 @@ const surviving = ({ errors = [], proved = [] } = {}) => (
 // as a Mongo "Document failed validation" naming no field.
 const isStatus = ( status ) => STATUSES.includes( status );
 
+// CARRYING OUT WHAT A HOOK DESCRIBED, and the only place that does it.
+//
+// It lived in drawbridge-sync until drawbridge-api needed it too: the install
+// hooks describe writes, and an api route that performed them itself would be a
+// second implementation of this file. Two performers is exactly the drift this
+// package exists to remove — and the subtle half is not the writing, it is the
+// ORDERING and the transaction, which a second copy would eventually get wrong.
+//
+// ENQUEUE AND EMIT ARE INJECTED rather than imported. They are the two effects a
+// performer cannot own: sync enqueues onto its own BullMQ queues through the
+// telemetry wrapper and emits through its socket server, and the api has
+// neither. Everything else — the writes, the duplicate rule, the transaction —
+// is the same wherever the answer came from.
+
+const perform = async ({ answer, controller, emit, enqueue }) => {
+
+	const { enqueues, events, transaction, writes } = answerOf( answer ) || {};
+
+	const write = async ( { collection, data, ignoreDuplicate, multiple, operation, options, query }, session ) => {
+
+		// NOTHING IS REBUILT HERE. This used to reconstruct `_id` from a created
+		// document's `id`, because the injected `mintId` handed the manifests a bare
+		// string — a published package has no mongodb dependency and cannot make an
+		// ObjectId. So the pair was minted in one direction here and derived in the
+		// other by drawbridge-mongodb's own `ids()`, which already accepts a supplied
+		// `_id` and derives `id` from it. Two places minting one pair, opposite ways.
+		//
+		// `mintId` now returns BOTH halves and the hook places each, so a described
+		// write arrives already shaped and this is a plain pass-through.
+
+		try {
+
+			await controller[ operation ]({
+				collection,
+				data,
+				// The controller takes `multiple` beside options — an update that
+				// means every matching document must say so explicitly.
+				...( multiple && { multiple : true }),
+				...( ( options || session ) && { options : { ...options, ...( session && { session }) } }),
+				...( query && { query })
+			});
+
+		} catch ( error ){
+
+			// A DUPLICATE IS THE MECHANISM WORKING where the hook said so — the
+			// team-notify damper is a partial unique index, and a collision means this
+			// recipient has already been told inside the bucket. Everywhere else a
+			// duplicate key is a real failure and must still throw.
+			if( ! ( ignoreDuplicate && isDuplicateKey( error ) ) ) throw error;
+
+		}
+
+	};
+
+	// ALL OR NONE when the hook asked for it — the order/redemption pair, where a
+	// half-written attribution is revenue counted twice or not at all. Enqueues
+	// and events stay OUTSIDE and after: a job must not observe rows that later
+	// roll back, and an emit is not transactional anywhere.
+	if( transaction ){
+
+		await controller.transaction( async ( session ) => {
+
+			for( const descriptor of writes ) await write( descriptor, session );
+
+		});
+
+	} else {
+
+		for( const descriptor of writes ) await write( descriptor );
+
+	}
+
+	for( const { data, name, options, queue : target } of enqueues ){
+
+		// ENQUEUE AND EMIT ARE INJECTED, because they are the two things a
+		// performer cannot own. drawbridge-sync enqueues through the telemetry
+		// wrapper onto its own BullMQ queues and emits through its socket server;
+		// drawbridge-api has neither. A hook that describes one where the caller
+		// supplied no way to do it is a programming error, and it says so rather
+		// than dropping the effect on the floor.
+		if( ! enqueue ) throw new Error( 'A hook described an enqueue and this caller supplied no enqueuer' );
+
+		await enqueue({ data, name, options, queue : target });
+
+	}
+
+	for( const descriptor of events ){
+
+		if( ! emit ) throw new Error( 'A hook described a socket event and this caller supplied no emitter' );
+
+		emit( descriptor );
+
+	}
+
+};
+
+// WORK DONE ON A STORED CONNECTION ROW, FROM OUTSIDE A HOOK.
+//
+// Two things live here, and they are here for the same reason: each needs a
+// CONTROLLER, which a hook may never hold. A hook describes its effects and
+// perform() carries them out; these two are the cases where that split does not
+// fit, so they are the shell's work — but they were the shell's work in
+// drawbridge-sync, in a `lib/connection.js` that also imported the Shopify
+// client. That made them a second connections library beside this one.
+//
+// They take a controller as an ARGUMENT rather than importing anything, exactly
+// as perform() does. That is the established shape for a utils file that has to
+// touch the database.
+
+// FETCH A CONNECTION AND DECRYPT ITS SETTINGS IN ONE CALL. Callers pass the
+// whole query — by id, by organization and slug, with $in arrays — and typically
+// include `status : 'active'`.
+//
+// Answers `{ connection, settings }`, both null when nothing matched, so the
+// call site keeps its terse guard:
+//
+//     const { connection, settings } = await connectionSettings({ controller, query });
+//     if( ! connection ) return;
+const connectionSettings = async ({ controller, query }) => {
+
+	const connection = await controller.get({ collection : 'connection', query });
+
+	if( ! connection ) return { connection : null, settings : null };
+
+	return { connection, settings : decrypt( connection.settings ) };
+
+};
+
+const SCOPES_ERROR_SOURCE = 'scopes';
+
+// Merchant-facing text. It must match the entry drawbridge-api presents, so the
+// two writers converging on one row never change the message; the missing-scope
+// detail stays in the log.
+const SCOPES_ERROR_MESSAGE = 'Shopify permissions are out of date. Open the Drawbridge app in your Shopify admin to approve the updated permissions.';
+
+// SCOPE-DRIFT ENFORCEMENT, SHOP-SCOPED — because every organization's connection
+// to the same store shares ONE grant.
+//
+// WHY THIS IS NOT A HOOK, which is the question it invites. A hook answers for
+// one connection and describes writes for that connection. This one reads a
+// grant held on a shared install record and then writes across EVERY
+// organization's connection to that store, plus their products and
+// advertisements. And `lifecycle.health` needs its RESULT to compose the message
+// it returns, which is why the health hook takes it as an injected
+// `reconcileScopes` rather than calling it.
+//
+// THE VENDOR STILL JUDGES ITS OWN GRANT. What is missing from a grant is
+// `auth.scopes`, asked here through runHook. What to DO about it is this
+// function. The judging half used to be a direct import of the Shopify client.
+//
+// Missing scopes: every connection for the shop goes `status : 'error'` with a
+// scopes-sourced entry, the store's products deactivate, and their
+// advertisements draft. Complete scopes: the entry is removed, status returns to
+// active when nothing else survives, and each product RE-SYNCS through its own
+// worker — the single reconciliation point — rather than a blanket reactivate,
+// which would wrongly revive products that are inactive because the merchant
+// unpublished them from the channel. Ads stay drafted for a deliberate
+// re-enable, matching the disconnect and unpublish cascades.
+//
+// `granted` is the grant to evaluate, a string or an array. Omitted, it is read
+// from the install record's stored session, which the embedded app rewrites on
+// every open. NO GRANT DATA AT ALL MEANS SKIP, never enforce: absence of evidence
+// must not error a healthy connection, and a legacy one-to-one install carries no
+// install record.
+const reconcileConnectionScopes = async ({
+	controller,
+	enqueue,
+	granted = null,
+	logger,
+	shop,
+	slug = 'shopify'
+}) => {
+
+	if( granted === null ){
+
+		const record = await controller.get({ collection : 'shop', query : { shop } });
+
+		const session = record?.settings ? decrypt( record.settings ) : null;
+
+		granted = session?.scope || null;
+
+	}
+
+	if( ! granted ) return null;
+
+	// NULL IS NOT AN EMPTY LIST. The hook answers null when the grant could not be
+	// read at all, and reading that as "nothing missing" is how a connection
+	// reports healthy while it has quietly stopped doing half its job.
+	const answered = await runHook( slug, 'auth.scopes', { scope : granted } );
+
+	const missing = answered.outcome === 'answered' ? answered.answer.result?.missing : null;
+
+	if( ! Array.isArray( missing ) ){
+
+		logger?.warn?.( 'connection.scopes.unreadable', { shop, slug });
+
+		return null;
+
+	}
+
+	const connections = await controller.aggregate({
+		collection : 'connection',
+		pipeline : [ { $match : { shop, slug } } ]
+	});
+
+	let hadScopesError = false;
+
+	for( const connection of connections ){
+
+		const others = ( connection.errors || [] ).filter( ( entry ) => entry.source !== SCOPES_ERROR_SOURCE );
+
+		const hasScopesError = others.length !== ( connection.errors || [] ).length;
+
+		hadScopesError = hadScopesError || hasScopesError;
+
+		if( missing.length ){
+
+			await controller.update({
+				collection : 'connection',
+				data : {
+					$set : {
+						errors : [ ...others, { message : SCOPES_ERROR_MESSAGE, source : SCOPES_ERROR_SOURCE } ],
+						status : 'error'
+					}
+				},
+				query : { id : connection.id }
+			});
+
+		} else if( hasScopesError ){
+
+			await controller.update({
+				collection : 'connection',
+				data : {
+					$set : {
+						errors : others,
+						...( connection.status === 'error' && ! others.length && { status : 'active' })
+					}
+				},
+				query : { id : connection.id }
+			});
+
+		}
+
+	}
+
+	const products = connections.length
+		? await controller.aggregate({
+			collection : 'product',
+			pipeline : [ { $match : { 'provider.slug' : slug, 'source.domain' : shop } } ]
+		})
+		: [];
+
+	if( missing.length && products.length ){
+
+		const productIds = products.map( ( product ) => product.id );
+
+		await controller.update({
+			collection : 'product',
+			data : { $set : { status : 'inactive' } },
+			multiple : true,
+			query : { id : { $in : productIds } }
+		});
+
+		await controller.update({
+			collection : 'advertisement',
+			data : { $set : { status : 'drafted' } },
+			multiple : true,
+			query : { product : { $in : productIds } }
+		});
+
+	} else if( ! missing.length && hadScopesError && enqueue ){
+
+		// ENQUEUE IS INJECTED, for the same reason perform()'s is: this package
+		// holds no BullMQ queues, and a caller that supplied no enqueuer gets the
+		// writes without the re-sync rather than a crash. The health path supplies
+		// one; a caller that only wants the status corrected need not.
+		for( const product of products ){
+
+			await enqueue({
+				data : { product : product.id },
+				name : 'sync',
+				options : { jobId : 'product.' + slug + '.' + product.id + '.' + Date.now() },
+				queue : 'product.' + slug
+			});
+
+		}
+
+	}
+
+	logger?.info?.( 'connection.scopes.reconciled', { connections : connections.length, missing, shop });
+
+	return missing;
+
+};
+
 // THE WORKFLOWS A CONNECTION OWNS, provisioned from its manifest.
 //
 // It lived in drawbridge-sync until it was needed twice: sync provisions lazily
@@ -1895,9 +2288,18 @@ var scaffold = {
 		commerce : {
 			// NEW in phase 1 — the Checkout Kit cart path, which writes nothing and is
 			// the last api surface Shopify owns outside a hook.
-			cart : async ( { connection, context }, { read } = {} ) => ANSWER,
+			// NO `connection` AND NO `step`: this one runs for a SHOPPER on a public
+			// page, not for an organization inside a workflow. It reads the storefront
+			// with the store's storefront token and mints a checkout token from
+			// DRAWBRIDGE'S app credentials, which is why the credential pair rides in
+			// as props — the way auth.disconnect already carries it.
+			cart : async ( { clientId, clientSecret, context, settings }, { fetcher, shopify } = {} ) => ANSWER,
 			code : async ( { connection, context, step }, { adminToken, shopify } = {} ) => ANSWER,
 			customer : async ( { connection, context }, { adminToken, read, shopify } = {} ) => ANSWER,
+			// STOCK, READ AT RENDER TIME rather than stored. It is the one product
+			// fact that is stale the instant it is written down, so the campaign
+			// product list asks the vendor and caches the answer for a minute.
+			inventory : async ( { connection, context }, { adminToken, shopify } = {} ) => ANSWER,
 			order : async ( { connection, context }, { logger, mintId, read } = {} ) => ANSWER,
 			// THIS IS WHERE `product.insert` LANDS.
 			//
@@ -1919,7 +2321,7 @@ var scaffold = {
 			// nothing and shows up only as `workflow.dispatch.candidates matched : 0` in
 			// a log. Phase 1 closes it and build() checks every trigger against it.
 			product : {
-				hook : async ( { connection, context, workflow }, { mintId, read } = {} ) => ANSWER,
+				hook : async ( { connection, context, settings, workflow }, { adminToken, mintId, read, shopify } = {} ) => ANSWER,
 				step : () => ({
 					description : 'Syncs product data from the vendor when a product changes.',
 					key : 'Vendor Product Sync',
@@ -2067,8 +2469,19 @@ var scaffold = {
 			// Vendor billing, the only group that is not generic. Pairs with
 			// auth.install.billing, which declares what the merchant is being charged.
 			plan : {
-				cancel : async ( { context }, { dispatch, read } = {} ) => ANSWER,
-				reselect : async ( { context }, { dispatch, read } = {} ) => ANSWER
+				cancel : async ( { context }, { read, shopify } = {} ) => ANSWER,
+				// NOT A MERCHANT ACTION EITHER — one attributed order's usage charge,
+				// sent to the vendor's meter. The credential pair rides in as props
+				// because the charge authenticates as the APP, not as the store.
+				charge : async ( { clientId, clientSecret, context, manifest }, { shopify } = {} ) => ANSWER,
+				// `mark` is the one write a description cannot carry: the marker must
+				// be persisted BEFORE the approval is released, and a described write
+				// lands after the hook returns.
+				reselect : async ( { context }, { mark, read, shopify } = {} ) => ANSWER,
+				// NOT A MERCHANT ACTION — the question "is this store's billing
+				// actually metered right now", asked by the daily health check and by
+				// the vendor's own approval webhook, which used to hand-copy it.
+				verify : async ( { context }, { adminToken, read, shopify } = {} ) => ANSWER
 			},
 			// The embedded app's own session, stored by us on the vendor's behalf.
 			session : {
@@ -2711,16 +3124,19 @@ var attentive = {
 			'Anyone who has opted out in Drawbridge is sent to Attentive as an unsubscribe rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.',
 			'Attentive accepts these updates and applies them in the background, so a contact appears in your segment shortly after the sync rather than the instant it runs.'
 		],
-		// NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-		// The dashboard already carries generic reasons for every way an
-		// authorization can fail — declined, expired state, a vendor we are not set
-		// up for — and a sentence here is an ADDITION to those, for a vendor whose
-		// failures need saying differently. This one's do not.
+		// WHAT THE MERCHANT READS WHEN A CONNECT FAILS. Two states, because the
+		// consent screen has two ways to end: they said no, or something between
+		// here and the vendor went wrong.
 		//
-		// Answered rather than omitted, because `errors` existed on two of six
-		// manifests and there was no way to tell "nothing to add" from "nobody
-		// wrote it".
-		errors : false,
+		// THE VENDOR IS NAMED IN BOTH. The dashboard's generic copy says "the
+		// authorization"; a merchant connecting two accounts in one sitting needs
+		// to know which one this was.
+		errors : {
+			connect : {
+				denied : 'The Attentive authorization was declined, so nothing was connected.',
+				invalid : 'We couldn\'t complete the Attentive connection. Try connecting again.'
+			}
+		},
 		excerpt : 'Sync your Drawbridge contacts into an Attentive segment.',
 		// NAMES THE SEGMENT STEP, because `status` below gates on it: a grant with
 		// no segment chosen sits at Pending, and a guide that stops at the consent
@@ -4255,15 +4671,12 @@ var drawbridge = {
 		description : [
 			'Drawbridge sends your notification emails and your entrants\' emails, and recalculates segment membership on a schedule. It is always on and needs nothing connected.'
 		],
-		// NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-		// The dashboard already carries generic reasons for every way an
-		// authorization can fail — declined, expired state, a vendor we are not set
-		// up for — and a sentence here is an ADDITION to those, for a vendor whose
-		// failures need saying differently. This one's do not.
+		// NOTHING IS EVER CONNECTED, so no connect can fail. This is the platform's
+		// own manifest — always on, private, never in the catalogue — and it exists
+		// to give Drawbridge's own steps a hook to point at. `denied` and `invalid`
+		// describe a consent screen this connection does not have.
 		//
-		// Answered rather than omitted, because `errors` existed on two of six
-		// manifests and there was no way to tell "nothing to add" from "nobody
-		// wrote it".
+		// `false` is the recorded decision, not silence.
 		errors : false,
 		excerpt : 'The steps Drawbridge runs itself.',
 		guide : [
@@ -6607,16 +7020,19 @@ var mailchimp = {
 			'Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.',
 			'Someone who unsubscribed inside Mailchimp keeps that choice: a resync only sets the status of a subscriber Mailchimp has never seen before.'
 		],
-		// NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-		// The dashboard already carries generic reasons for every way an
-		// authorization can fail — declined, expired state, a vendor we are not set
-		// up for — and a sentence here is an ADDITION to those, for a vendor whose
-		// failures need saying differently. This one's do not.
+		// WHAT THE MERCHANT READS WHEN A CONNECT FAILS. Two states, because the
+		// consent screen has two ways to end: they said no, or something between
+		// here and the vendor went wrong.
 		//
-		// Answered rather than omitted, because `errors` existed on two of six
-		// manifests and there was no way to tell "nothing to add" from "nobody
-		// wrote it".
-		errors : false,
+		// THE VENDOR IS NAMED IN BOTH. The dashboard's generic copy says "the
+		// authorization"; a merchant connecting two accounts in one sitting needs
+		// to know which one this was.
+		errors : {
+			connect : {
+				denied : 'The Mailchimp authorization was declined, so nothing was connected.',
+				invalid : 'We couldn\'t complete the Mailchimp connection. Try connecting again.'
+			}
+		},
 		excerpt : 'Sync your Drawbridge contacts into a Mailchimp audience.',
 		// NAMES THE AUDIENCE STEP, because `status` below gates on it: a grant with
 		// no audience chosen sits at Pending, and a guide that stops at the consent
@@ -7434,6 +7850,28 @@ var icon = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmln
 <path d="M300.325 382.771L368 365.96C368 365.96 338.904 169.185 338.689 167.892C338.473 166.599 337.396 165.737 336.318 165.737C335.24 165.737 316.274 165.306 316.274 165.306C316.274 165.306 304.636 154.099 300.325 149.788V382.771Z" fill="white"/>
 </svg>`;
 
+// THE CLIENT, IMPORTED AND DEFAULTED — the same shape as `fetcher = fetch`
+// everywhere else in this package.
+//
+// It used to be injected because @drawbridge/shopify depended on this package,
+// so this file could not import it. That cycle is gone: the client lives in
+// lib/shopify/ now. But the injection had a SECOND job nobody wrote down — it is
+// the test seam, and it is at the right level. The hook tests stub
+// getActiveAppSubscriptions and getUsageChargeEvents and assert the arguments
+// they were called with; stubbing raw HTTP instead would mean hand-building
+// Shopify GraphQL envelopes and would lose those assertions entirely.
+//
+// So the default is the real client and callers inject nothing. Production
+// passes no `shopify` option at all — drawbridge-api and drawbridge-sync have
+// stopped wiring one — and a test overrides exactly the namespace it needs.
+const client = Object.freeze({
+	admin : shopifyAdmin,
+	billing : shopifyBilling,
+	oauth : shopifyOauth,
+	partner : shopifyPartner,
+	storefront : shopifyStorefront
+});
+
 // ── ORDER ATTRIBUTION, the vendor's own arithmetic ───────────────────────────
 //
 // Orders are attributed via `_drwbrdg_*` line-item properties injected at
@@ -7553,7 +7991,7 @@ const discountWarning = ( discount ) => {
 // equal, case-sensitively, the meter HANDLE configured on the app's plan in
 // the Dev Dashboard (the plan editor's Handle field — display names prove
 // nothing) and the SHOPIFY_USAGE_ORDERS_EVENT_HANDLE default in
-// @drawbridge/shopify, which this package cannot import. This is the single
+// the Shopify client, which lives in this package now. This is the single
 // mint point on the utils side: the transaction id is prefixed with it, the
 // billing enqueue carries it, and the manifest publishes it under
 // auth.install.billing.handle — so drawbridge-sync can refuse to send an event whose
@@ -7624,1032 +8062,2509 @@ const COMPLIANCE_TOPICS = new Set([
 	'shop/redact'
 ]);
 
-// Shopify — installed from the App Store, never connected with keys.
-var shopify = {
+// ── THE EMBEDDED-APP SURFACE ─────────────────────────────────────────────────
+//
+// Everything from here to the end of this block serves `hooks.install`, which
+// is what api/route/shopify-embedded.js became: 1,386 lines and thirteen routes
+// whose paths all began `/shopify/embedded/` — a vendor's name in a url, on a
+// surface no other connection could ever reach.
+
+// A REFUSAL WITH A STATUS. runHook already carries `error.status` out to the
+// caller for exactly this — inbound.verify answers 401 on a forged signature the
+// same way — so the install slots say 402, 403, 409, 422 or 502 in the same
+// breath as the reason, and the route answers what they said rather than folding
+// every rejection into a 500.
+const refusal = ( message, status ) => Object.assign( new Error( message ), { status });
+
+// THIRTY MINUTES for the one-shot link token. Long enough for a merchant to
+// finish a consent screen, short enough that a stranded token is not a standing
+// key to a store.
+const LINK_TOKEN_TTL_MS = 30 * 60 * 1000;
+
+// The statuses the connection-write gate accepts, mirroring the dashboard's
+// own list on every organization-connection route. Read by BOTH `add` and
+// `list`, so the list cannot tell a merchant an org is connectable and then
+// have `add` refuse it.
+const CONNECTABLE_STATUSES = [ 'active', 'unsubscribed' ];
+
+// THE MERCHANT'S OWN ORGANIZATIONS — owned, or joined with the `connections`
+// capability at `manage`. Shared by the list and the two org slots that gate on
+// access, and each org carries its Shopify connection ({ id, shop, status }) so
+// the one-store-per-organization rule is answered in the same round trip.
+const merchantOrganizations = ({ read, user }) => read.aggregate({
+	collection : 'organization',
+	pipeline : [
+		// A member qualifies only at `manage`; an owner always qualifies.
+		{
+			$lookup : {
+				as : 'membership',
+				from : 'member',
+				let : { organization : '$id' },
+				pipeline : [
+					{
+						$match : {
+							$expr : { $eq : [ '$organization', '$$organization' ] },
+							'capabilities.connections' : 'manage',
+							status : 'accepted',
+							user
+						}
+					},
+					{ $limit : 1 },
+					{ $project : { _id : 0, organization : 1 } }
+				]
+			}
+		},
+		{
+			$match : {
+				status : { $ne : 'canceled' },
+				$or : [ { owner : user }, { 'membership.0' : { $exists : true } } ]
+			}
+		},
+		// `organization.subscription` is a subscription RECORD ID — resolved here so
+		// the list can read the real plan and conversion rate. Without it every org
+		// rendered as free tier.
+		{ $lookup : { as : 'subscription', foreignField : 'id', from : 'subscription', localField : 'subscription' } },
+		{ $unwind : { path : '$subscription', preserveNullAndEmptyArrays : true } },
+		{
+			$lookup : {
+				as : 'connection',
+				foreignField : 'organization',
+				from : 'connection',
+				localField : 'id',
+				pipeline : [
+					{ $match : { slug : 'shopify' } },
+					{ $limit : 1 },
+					{ $project : { _id : 0, id : 1, shop : 1, status : 1 } }
+				]
+			}
+		},
+		{ $unwind : { path : '$connection', preserveNullAndEmptyArrays : true } },
+		{ $project : { _id : 0, billingStatus : '$status', connection : 1, id : 1, name : '$title', subscription : 1 } },
+		{ $sort : { name : 1 } }
+	]
+});
 
-	// THE WORDS ON THE BUTTONS. `listing` was `content.redirect.title`, which put
-	// a BUTTON LABEL inside the copy object next to a url — the title and the
-	// address it belongs to sat at different levels and could drift apart.
-	//
-	// It names where the link GOES rather than what it does: installing happens on
-	// the App Store listing, and the dashboard must never imply a store can be
-	// linked from inside it.
-	actions : {
-		create : null,
-		listing : 'View on the Shopify App Store',
-		manage : null,
-		update : null
-	},
-	// INSTALL, not oauth. The grant is an OAuth grant, but the merchant never
-	// sees a consent screen we sent them to -- they start at the App Store, and
-	// the install completes inside Shopify admin without redirecting back. A
-	// Connect button here would be lying about where connecting happens.
-	auth : {
+// THE STORE'S LIVE APP PRICING STATUS. getActiveAppSubscriptions returns only
+// ACTIVE subscriptions, so a non-empty list means the merchant approved a plan.
+//
+// BEST-EFFORT, AND THE FAILURE IS NAMED. "No plan" and "couldn't check" are
+// different answers — `add` returns a retryable 502 for the latter rather than
+// telling a paying merchant to approve a plan.
+const storePlan = async ({ record, shopify }) => {
 
-		// ONE STORE PER ORGANIZATION. A Shopify install IS a store, and a second
-		// one would give an organization two catalogues, two order streams and two
-		// usage meters with nothing to say which is authoritative.
-		//
-		// DECLARED AND ENFORCED BY NOTHING, measured 2026-09-13: no repo reads this
-		// key, and the connection collection's { organization, slug } index is not
-		// unique. So a second Shopify connection would be accepted today. The gate
-		// belongs at the connect route with a unique partial index behind it, and
-		// that is api work — this is the declaration it will read.
-		exclusive : true,
-		generated : false,
+	const settings = record?.settings ? decrypt( record.settings ) : null;
 
-		// THE MERCHANT STARTS AT SHOPIFY, not here. They install the app from
-		// Shopify's own admin or app store and the grant is exchanged inside that
-		// flow — there is no consent screen we sent them to, which is the whole
-		// reason this is not `oauth`. A Connect button would be lying.
-		//
-		// Both members are install-only, which is exactly why they could not live at
-		// the top of `auth`.
-		install : {
+	if( ! settings?.accessToken ) return { active : false, name : null };
 
-			// SHOPIFY APP PRICING. Was the top-level `events` key, which it never
-			// was: `events.order` is not an event vocabulary, it is a usage meter
-			// handle plus the capped plan a merchant approves. It reads correctly
-			// beside the install it belongs to, and it is the only manifest that
-			// has one.
-			billing : {
-				handle : ORDER_EVENT_HANDLE,
-				// THE SUBSCRIPTION THE APP MINTS FOR ITSELF (Billing API, not the
-				// managed-pricing meter system): a $0 recurring line plus this usage
-				// line, approved by the org owner at Shopify's confirmation screen.
-				// `terms` is the merchant-visible consent copy; "up to" because the
-				// actual rate is plan-derived (conversionRate) and must never exceed
-				// what was approved. cappedAmount bounds one 30-day cycle's usage
-				// charges — a record beyond it errors until the merchant raises it.
-				// ponytail: $1,000 cap ≈ $66k attributed revenue/cycle at 1.5%; raise
-				// via a re-approved subscription when a merchant outgrows it.
-				pricing : {
-					cappedAmount : 1000,
-					currency : 'usd',
-					name : 'Drawbridge Orders',
-					terms : 'Up to 1.5% of revenue from orders attributed to Drawbridge campaigns'
-				}
-			},
+	try {
 
-			// ONE GRANT BACKS EVERY ORGANIZATION'S CONNECTION TO ONE STORE, and today
-			// that is carried by a magic `settings.ref === 'shop'` pointer plus
-			// hardcoded slug checks in drawbridge-sync. Declared here so it stops being
-			// magic, and so the token path can be told what it is dealing with: a
-			// shared credential has many writers by definition, refreshAdminToken
-			// already does compare-and-swap on the encrypted blob, and utils' generic
-			// save is a plain $set that would clobber a concurrent rotation.
-			//
-			// NOTHING READS IT YET. The pointer is still the mechanism until the
-			// embedded routes become install hooks and the `shop` collection is renamed
-			// — this is the declaration those will read, put here now because the block
-			// it belongs in exists now.
-			shared : {
+		const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
+			adminAccessToken : settings.accessToken,
+			domain : record.shop
+		});
 
-				// WHERE THE ONE CREDENTIAL LIVES. Every organization's connection to the
-				// same store points at the same row.
-				collection : 'shop',
+		const active = ( subscriptions || [] ).length > 0;
 
-				// The settings key holding the lookup value, which is also the field it
-				// matches on that row — `connection.settings.shop` finds `shop.shop`.
-				key : 'shop',
+		// A USAGE LINE ON THE APPROVAL IS POSITIVE EVIDENCE (metered true); its
+		// ABSENCE IS NO VERDICT (null). Measured 2026-09-04 on both 2026-04 and
+		// unstable: managed-pricing App-Events meters never materialize as
+		// subscription line items, so absence must not drive the App Home banner.
+		// `false` is reserved for a signal that can actually observe the meter —
+		// Partner-ledger accrual, which sync stamps onto the connection.
+		const metered = active && subscriptions.some( ( subscription ) => subscription.metered === true ) ? true : null;
 
-				// AND HOW A CONNECTION SAYS ITS CREDENTIAL IS SHARED: settings[ marker ]
-				// equals the collection name. Today that is the magic
-				// `settings.ref === 'shop'` pointer, written at
-				// api/route/shopify-embedded.js and read by hardcoded slug checks in
-				// three repos. Declared, it stops being magic.
-				marker : 'ref'
+		return { active, metered, name : active ? subscriptions[ 0 ]?.name || null : null };
 
-			}
+	} catch ( _ ) {
 
-		},
-		keys : false,
-		none : false,
+		return { active : false, name : null, unavailable : true };
 
-		// Shopify's install grant is an OAuth exchange under the hood and is NOT
-		// declared here: it runs inside the app flow rather than through the shared
-		// runner, so a complete auth.oauth block would describe a flow this
-		// connection never takes. That disagreement is what the old enum could not
-		// prevent — `type : 'install'` beside a stale auth.oauth was legal.
-		oauth : false
-	},
-	// EVERYTHING A MERCHANT READS.
-	//
-	// `errors` is in here rather than at the top level, and that is not a
-	// preference: the connection DOCUMENT carries its own `errors` array of
-	// scope-drift entries, and the document is spread OVER the resolved manifest
-	// downstream — a top-level one would be replaced by that array and never
-	// render.
-	//
-	// `connect` no longer exists as a container. Its other member was `redirect`,
-	// which is a URL and now sits with the vendor's other addresses.
-	content : {
-		confirm : 'Disconnecting deactivates all products from this store, drafts any advertisements that use them, disables Shopify steps in your workflows until you reconnect, and stops revenue tracking for this organization.',
-		description : [
-			'Installing the Drawbridge app from the Shopify App Store links your store to a single Drawbridge organization and makes your product catalog available inside Drawbridge, so you can feature products in your campaigns and advertisements.',
-			'Drawbridge attributes orders that originate from your campaigns — matched through cart parameters and lead-mapped discount codes — so you can see the revenue each campaign drives.',
-			'Drawbridge reads your products, records orders placed through your campaigns, and can issue discount codes. Order and product updates reach Drawbridge through the app\'s own webhooks, which Shopify applies when the app is installed.'
-		],
-		errors : {
-			connect : {
-				conflict : 'This store is already connected to another Drawbridge organization.',
-				currency : 'This store settles in a currency we can\'t bill yet. Connect a store with a supported settlement currency.',
-				invalid : 'We couldn\'t verify the install. Please try connecting again from the Shopify App Store.'
+	}
+
+};
+
+// RELEASE EVERY ACTIVE APPROVAL for this app on this store. Shared by `cancel`
+// and `reselect`, which differ only in what happens before and what it means —
+// the mechanics are identical, and two copies of a billing mutation is how they
+// come to disagree.
+const releaseApprovals = async ({ context, read, shopify }) => {
+
+	const shop = sanitizeDomain( context?.shop );
+
+	if( ! shop ) throw refusal( 'shop is required', 400 );
+
+	const record = await read.get({ collection : 'shop', query : { shop } });
+
+	const settings = record?.settings ? decrypt( record.settings ) : null;
+
+	if( ! settings?.accessToken ) throw refusal( 'Store is not installed', 409 );
+
+	const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
+		adminAccessToken : settings.accessToken,
+		domain : shop
+	});
+
+	for( const subscription of ( subscriptions || [] ) ){
+
+		const data = await shopify.admin.adminFetch({
+			adminAccessToken : settings.accessToken,
+			domain : shop,
+			query : 'mutation appSubscriptionCancel( $id : ID! ) { appSubscriptionCancel( id : $id ) { appSubscription { id status } userErrors { field message } } }',
+			variables : { id : subscription.id }
+		});
+
+		const [ userError ] = data?.appSubscriptionCancel?.userErrors || [];
+
+		// SHOPIFY'S OWN WORDS, not ours. A cancel Shopify refused is a merchant-
+		// actionable fact and 422 is the honest code for it.
+		if( userError ) throw refusal( userError.message, 422 );
+
+	}
+
+	return {
+		message : 'Released ' + ( subscriptions || [] ).length + ' approval(s).',
+		request : { shop },
+		result : { ok : true }
+	};
+
+};
+
+// ── THE METER VERDICT, ASKED ONCE ────────────────────────────────────────────
+//
+// IS THIS STORE'S ORDER BILLING ACTUALLY WORKING? Two signals, and the rule for
+// reading them is the subtle part — subtle enough that drawbridge-sync's
+// approval webhook hand-copied it, said so in its own comment twice, and copied
+// it slightly wrong. One copy now, here, beside the vendor it is about.
+//
+//   A USAGE LINE on the approval is POSITIVE evidence and gets stamped. Its
+//   ABSENCE PROVES NOTHING: measured 2026-09-04, on both 2026-04 and unstable
+//   and against a plan whose meter exists, managed-pricing App-Events meters
+//   never materialize as subscription line items — AppUsagePricing is the
+//   legacy usage-charge model. Reading absence as "unmetered" flagged healthy
+//   stores, so absence is NO VERDICT: the stamp, the Issue, the card and the
+//   meter-missing pager all stay silent.
+//
+//   PARTNER-LEDGER ACCRUAL is the real signal. A CHARGE_USAGE event for this
+//   shop is proof billing works, and its charge id becomes the stamp — it
+//   overrides the line-item probe, which managed pricing keeps blind. A usage
+//   ROW exists per subscription even before anything accrues (measured: a
+//   pre-meter approval shows qty 0), so the row is not the proof; a POSITIVE
+//   usageQuantity is, and the LATEST positive row is the stamp.
+//
+// `undefined` means no verdict this run — never `null`, which is the health
+// check's word for "probed, and nothing is accruing".
+//
+// The boundaries come back with it because each charge row is also a billing
+// BOUNDARY the health check reconciles the books against, and re-reading the
+// ledger to get them would be a second call for data this one already holds.
+const LEDGER_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+
+const meterVerdict = async ({ adminAccessToken, ledgerFloor, partner, shop, shopId, shopify }) => {
+
+	const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({ adminAccessToken, domain : shop });
+
+	let metered = subscriptions.find( ( subscription ) => subscription.usageLineItemId )?.usageLineItemId;
+
+	// Off entirely until the provider row carries the Partner credentials.
+	// `ledger` says whether it was consulted at all, because "read it and found
+	// nothing accruing" and "could not read it" are different answers and only
+	// the first is evidence about the store.
+	if( ! ( partner?.partnerToken && partner?.partnerOrgId && partner?.partnerAppId && shopId ) ){
+
+		return { boundaries : [], ledger : false, metered };
+
+	}
+
+	const accruals = await shopify.partner.getUsageChargeEvents({
+		appId : 'gid://shopify/App/' + partner.partnerAppId,
+		first : 10,
+		occurredAtMin : ledgerFloor.toISOString(),
+		organizationId : partner.partnerOrgId,
+		partnerToken : partner.partnerToken,
+		shopId : 'gid://shopify/Shop/' + shopId
+	});
+
+	// Oldest first: each charge row closes the window since the row before it.
+	const boundaries = ( accruals || [] )
+		.filter( ( event ) => event.occurredAt )
+		.sort( ( a, b ) => new Date( a.occurredAt ) - new Date( b.occurredAt ) );
+
+	const accrued = [ ...boundaries ].reverse().find( ( event ) => Number( event.usageQuantity ) > 0 );
+
+	if( accrued ) metered = String( accrued.chargeId || accrued.id );
+
+	return { boundaries, ledger : true, metered };
+
+};
+
+// ── PRODUCT SYNC, the pull half ──────────────────────────────────────────────
+//
+// Everything below served drawbridge-sync's queue/product.js — 443 lines and two
+// BullMQ workers that imported three of this vendor's client modules directly.
+// It was a shadow implementation of the `commerce.product` step this manifest
+// already declared, and the step had no trigger, so the declaration and the
+// thing doing the work had never met.
+
+// A Storefront variant edge as the product row stores it.
+const toVariant = ( edge ) => ({
+	availableForSale : edge.node.availableForSale || false,
+	currency : edge.node.price?.currencyCode || null,
+	id : edge.node.id,
+	image : edge.node.image?.url || null,
+	price : parseFloat( edge.node.price?.amount ) || null,
+	requiresShipping : edge.node.requiresShipping || false,
+	sale : parseFloat( edge.node.compareAtPrice?.amount ) || null,
+	title : edge.node.title !== 'Default Title' ? edge.node.title : null
+});
+
+// REAL PURCHASABILITY, OVERLAID ON THE STOREFRONT'S CLAIM. availableForSale can
+// report true for stock checkout cannot actually fulfil — inventory at a
+// fulfillment-service location that cannot fulfil an online order — so a
+// throwaway cart is probed for Shopify's MERCHANDISE_OUT_OF_STOCK warnings.
+//
+// NEVER THROWS. A failed probe leaves the vendor's own answer standing, which is
+// the honest fallback: the overlay only ever removes availability it can prove
+// is wrong.
+const applyOutOfStock = async ({ domain, shopify, storefrontAccessToken, variants }) => {
+
+	try {
+
+		const outOfStock = new Set( await shopify.storefront.probeVariantsOutOfStock({
+			domain,
+			storefrontAccessToken,
+			variantIds : variants.map( ( variant ) => variant.id )
+		}) );
+
+		return variants.map( ( variant ) => ({
+			...variant,
+			availableForSale : variant.availableForSale && ! outOfStock.has( variant.id )
+		}) );
+
+	} catch ( _ ){
+
+		return variants;
+
+	}
+
+};
+
+// BEST-EFFORT PRODUCT ResourceFeedback — the required-action message on the
+// product page in the Shopify admin, which the sales-channel requirements say is
+// where a channel communicates a product's problems.
+//
+// Feedback must never fail the sync, and a failure must be LOUD. It is reported
+// through the caller's error channel rather than a warning: a warn only reaches
+// Sentry Logs, which is how a feedback path failing on every send since the
+// channel shipped stayed invisible through two rounds of QA.
+// sendProductResourceFeedback answers null rather than throwing for the expected
+// "nothing to attach it to" case, so anything that lands here is a real fault.
+const sendFeedback = async ({ adminToken, connection, messages, productId, shopify, state }) => {
+
+	try {
+
+		await shopify.admin.sendProductResourceFeedback({
+			adminAccessToken : await adminToken(),
+			domain : connection.shop,
+			messages,
+			productId,
+			state
+		});
+
+		return null;
+
+	} catch ( error ){
+
+		return error;
+
+	}
+
+};
+
+// BY PROVIDER IDENTITY WHEN THE DOC ID MISSES. The webhook branch upserts the row
+// and queues this pull in one described answer, so under a concurrent redelivery
+// the id it minted may be the one that LOST the upsert race — the row exists,
+// under the winner's id. The provider id and the shop are stable either way.
+const resolveProduct = async ({ connection, context, read }) => {
+
+	const byId = context?.product ? await read.get({ collection : 'product', query : { id : context.product } }) : null;
+
+	const row = byId || ( context?.providerId && ( context?.shop || connection?.shop )
+		? await read.get({
+			collection : 'product',
+			query : {
+				'provider.id' : context.providerId,
+				'provider.slug' : 'shopify',
+				'source.domain' : context.shop || connection.shop
+			}
+		})
+		: null );
+
+	return row;
+
+};
+
+// THE MESSAGE, and its format is enforced by Shopify rather than chosen: one
+// message, at most 100 characters, leading capital, trailing period, not all
+// caps — a breach fails the whole send.
+//
+// Shopify only carries this for a product STILL published to our channel, so
+// "publish this product" is advice the reader has already followed by the time
+// they can read it. The one state where it renders is a product the channel
+// holds but the Storefront will not return: excluded from the channel's US
+// market. Drafting does not qualify — drafting removes the product from the
+// channel, Shopify refuses the send, and the embedded app's publishing section
+// is that product's surface instead. Both causes stay named, because the
+// merchant reading it cannot tell which applies.
+const UNAVAILABLE_FEEDBACK = 'Drawbridge can\'t display this product. Check it is active and available in the United States.';
+
+// The Storefront's contract for a product it cannot see — not published to the
+// Drawbridge channel, or deleted. True deletions arrive on products/delete.
+const NOT_FOUND = 'Shopify product not found';
+
+const syncProduct = async ({ adminToken, connection, context, read, settings, shopify }) => {
+
+	const row = await resolveProduct({ connection, context, read });
+
+	if( ! row ) return { message : 'No product row to sync.', request : { product : context?.product || null }, skipped : true };
+
+	const domain = connection.shop;
+	const providerId = row.provider?.id;
+	const request = { product : row.id, providerId : providerId || null, shop : domain };
+
+	let product;
+
+	try {
+
+		product = await shopify.storefront.getProduct({
+			domain,
+			productId : providerId,
+			storefrontAccessToken : settings?.storefrontAccessToken
+		});
+
+	} catch ( error ){
+
+		// SOFT STATE, NOT TEARDOWN. The row goes inactive but keeps its campaign
+		// references, its ads are drafted — they cannot sell an invisible product —
+		// and the merchant gets product-page feedback. A later successful sync
+		// reverses all of it except the drafting, which stays for a deliberate
+		// re-enable, matching the disconnect and unpublish cascades.
+		if( error.message !== NOT_FOUND ) throw error;
+
+		const failed = await sendFeedback({
+			adminToken,
+			connection,
+			messages : [ UNAVAILABLE_FEEDBACK ],
+			productId : providerId,
+			shopify,
+			state : 'REQUIRES_ACTION'
+		});
+
+		return {
+			failed : failed ? [ failed.message ] : undefined,
+			message : 'Storefront cannot see this product — deactivated.',
+			request,
+			result : { status : 'inactive' },
+			writes : [
+				{
+					collection : 'product',
+					data : { $set : { status : 'inactive' } },
+					operation : 'update',
+					query : { id : row.id }
+				},
+				{
+					collection : 'advertisement',
+					data : { $set : { status : 'drafted' } },
+					multiple : true,
+					operation : 'update',
+					query : { product : row.id }
+				}
+			]
+		};
+
+	}
+
+	const variants = await applyOutOfStock({
+		domain,
+		shopify,
+		storefrontAccessToken : settings?.storefrontAccessToken,
+		variants : ( product?.variants?.edges || [] ).map( toVariant )
+	});
+
+	// The product is visible to the channel again, so any prior required-action
+	// feedback clears — ResourceFeedback replaces per send.
+	const failed = await sendFeedback({
+		adminToken,
+		connection,
+		messages : [],
+		productId : providerId,
+		shopify,
+		state : 'ACCEPTED'
+	});
+
+	return {
+		// EVERYTHING PAST THE FIRST PAGE, filled in silently. The first page is
+		// written above; a product with thousands of variants becomes N short
+		// sequential jobs rather than one long loop that risks a BullMQ stall.
+		enqueues : [ {
+			data : { operation : 'variants', product : row.id },
+			name : 'sync',
+			options : { jobId : 'product.shopify.variants.' + row.id + '.' + Date.now() },
+			queue : 'product.shopify.variants'
+		} ],
+		failed : failed ? [ failed.message ] : undefined,
+		message : 'Synced ' + ( product.title || 'product' ) + '.',
+		request,
+		result : { status : 'active', variants : variants.length },
+		writes : [ {
+			collection : 'product',
+			data : {
+				$set : {
+					description : product.description || null,
+					image : product.featuredImage?.url || null,
+					// A successful sync PROVES channel visibility, which reverses the
+					// deactivation above. Ads stay drafted.
+					status : 'active',
+					title : product.title || null,
+					type : product.productType || null,
+					url : ( domain && product.handle ) ? 'https://' + domain + '/products/' + product.handle : null,
+					variants
+				}
+			},
+			operation : 'update',
+			query : { id : row.id }
+		} ]
+	};
+
+};
+
+// ONE SHOPIFY PAGE PER RUN, self-chaining on the cursor.
+//
+// The first page (no cursor) $sets the array, clearing anything stale from a
+// prior sync; later pages $push, and Shopify's cursor pagination guarantees no
+// overlap within a session, so no dedup is needed. A restart begins again at
+// page one with $set, so a partial-state window is always recoverable.
+const syncVariants = async ({ connection, context, read, settings, shopify }) => {
+
+	const row = await resolveProduct({ connection, context, read });
+
+	if( ! row ) return { message : 'No product row to paginate.', request : { product : context?.product || null }, skipped : true };
+
+	const cursor = context?.cursor || null;
+	const request = { cursor, product : row.id };
+
+	let page;
+
+	try {
+
+		page = await shopify.storefront.getProductVariantsPage({
+			cursor,
+			domain : connection.shop,
+			productId : row.provider?.id,
+			storefrontAccessToken : settings?.storefrontAccessToken
+		});
+
+	} catch ( error ){
+
+		// Unpublished or deleted mid-pagination, the same contract getProduct
+		// carries. The sync branch's next run owns the feedback; just stop.
+		if( error.message !== NOT_FOUND ) throw error;
+
+		return { message : 'Storefront lost this product mid-pagination — stopping.', request, skipped : true };
+
+	}
+
+	const variants = await applyOutOfStock({
+		domain : connection.shop,
+		shopify,
+		storefrontAccessToken : settings?.storefrontAccessToken,
+		variants : ( page.edges || [] ).map( toVariant )
+	});
+
+	return {
+		...( page.pageInfo?.hasNextPage && { enqueues : [ {
+			data : { cursor : page.pageInfo.endCursor, operation : 'variants', product : row.id },
+			name : 'page',
+			options : { jobId : 'product.shopify.variants.' + row.id + '.' + Date.now() },
+			queue : 'product.shopify.variants'
+		} ] }),
+		message : variants.length + ' variant(s) on this page.',
+		request,
+		result : { hasNextPage : Boolean( page.pageInfo?.hasNextPage ), variants : variants.length },
+		writes : [ {
+			collection : 'product',
+			data : cursor
+				? { $push : { variants : { $each : variants } } }
+				: { $set : { variants } },
+			operation : 'update',
+			query : { id : row.id }
+		} ]
+	};
+
+};
+
+// Shopify — installed from the App Store, never connected with keys.
+var shopify = {
+
+	// THE WORDS ON THE BUTTONS. `listing` was `content.redirect.title`, which put
+	// a BUTTON LABEL inside the copy object next to a url — the title and the
+	// address it belongs to sat at different levels and could drift apart.
+	//
+	// It names where the link GOES rather than what it does: installing happens on
+	// the App Store listing, and the dashboard must never imply a store can be
+	// linked from inside it.
+	actions : {
+		create : null,
+		listing : 'View on the Shopify App Store',
+		manage : null,
+		update : null
+	},
+	// INSTALL, not oauth. The grant is an OAuth grant, but the merchant never
+	// sees a consent screen we sent them to -- they start at the App Store, and
+	// the install completes inside Shopify admin without redirecting back. A
+	// Connect button here would be lying about where connecting happens.
+	auth : {
+
+		// ONE STORE PER ORGANIZATION. A Shopify install IS a store, and a second
+		// one would give an organization two catalogues, two order streams and two
+		// usage meters with nothing to say which is authoritative.
+		//
+		// DECLARED AND ENFORCED BY NOTHING, measured 2026-09-13: no repo reads this
+		// key, and the connection collection's { organization, slug } index is not
+		// unique. So a second Shopify connection would be accepted today. The gate
+		// belongs at the connect route with a unique partial index behind it, and
+		// that is api work — this is the declaration it will read.
+		exclusive : true,
+		generated : false,
+
+		// THE MERCHANT STARTS AT SHOPIFY, not here. They install the app from
+		// Shopify's own admin or app store and the grant is exchanged inside that
+		// flow — there is no consent screen we sent them to, which is the whole
+		// reason this is not `oauth`. A Connect button would be lying.
+		//
+		// Both members are install-only, which is exactly why they could not live at
+		// the top of `auth`.
+		install : {
+
+			// SHOPIFY APP PRICING. Was the top-level `events` key, which it never
+			// was: `events.order` is not an event vocabulary, it is a usage meter
+			// handle plus the capped plan a merchant approves. It reads correctly
+			// beside the install it belongs to, and it is the only manifest that
+			// has one.
+			billing : {
+				handle : ORDER_EVENT_HANDLE,
+				// THE SUBSCRIPTION THE APP MINTS FOR ITSELF (Billing API, not the
+				// managed-pricing meter system): a $0 recurring line plus this usage
+				// line, approved by the org owner at Shopify's confirmation screen.
+				// `terms` is the merchant-visible consent copy; "up to" because the
+				// actual rate is plan-derived (conversionRate) and must never exceed
+				// what was approved. cappedAmount bounds one 30-day cycle's usage
+				// charges — a record beyond it errors until the merchant raises it.
+				// ponytail: $1,000 cap ≈ $66k attributed revenue/cycle at 1.5%; raise
+				// via a re-approved subscription when a merchant outgrows it.
+				pricing : {
+					cappedAmount : 1000,
+					currency : 'usd',
+					name : 'Drawbridge Orders',
+					terms : 'Up to 1.5% of revenue from orders attributed to Drawbridge campaigns'
+				}
 			},
 
-			// WHERE TO GO, which is the only reason this is worth overriding. The
-			// generic sentence says a connection is missing permissions and to
-			// reconnect it; for an install there is no reconnect button here, and
-			// telling a merchant to press one they do not have is worse than saying
-			// nothing. This says the place.
-			//
-			// A STRING, not a keyed map like `connect`: there is one way a grant is
-			// too narrow. The shape allows either because the keys under an area
-			// belong to the vendor.
-			scopes : 'Shopify permissions are out of date. Open the Drawbridge app in your Shopify admin to approve the updated permissions.'
-		},
-		excerpt : 'Connect your Shopify store to feature products in your campaigns and track conversions.',
-		guide : [
-			'Open the Drawbridge listing on the Shopify App Store.',
-			'Install the app on the store you want to connect. It opens in Shopify admin and stays there.',
-			'Approve the Drawbridge plan when prompted — during install, or from the connection page here. The connection shows Pending until you do, then Active.',
-			'Come back here — the connections list updates on its own once the install finishes.'
-		],
-	},
-	// VENDOR-FACING EVENT IDENTITY, published so readers outside this package
-	// (drawbridge-sync's usage queue, an operator checking the Dev Dashboard)
-	// see the same handle the order hook mints into transactions and enqueues.
-	feature : 'organization:connection:shopify',
-	fields : [
-		{
-			// `shop` on the connection record wins when present — it is written by
-			// the install, while settings.domain is the stored copy.
-			from : 'shop',
-			key : 'domain',
-			label : 'Store domain'
-		}
-	],
-	// Was `category : 'commerce'` AND `group : 'ecommerce'` — two words for one
-	// fact, which left nobody able to say which one a page read.
-	group : 'commerce',
-	// verify and event lean entirely on the shared HMAC helper — Shopify's scheme
-	// is exactly the shape it covers, so there is nothing vendor-specific to
-	// write for either. receive is the one hook that genuinely differs by
-	// channel: /events buffers whatever arrives with the shop domain stamped on;
-	// /compliance enforces the topic allowlist above, because answering one late
-	// is a legal deadline rather than a retry.
-	hooks : {
+			// ONE GRANT BACKS EVERY ORGANIZATION'S CONNECTION TO ONE STORE, and today
+			// that is carried by a magic `settings.ref === 'shop'` pointer plus
+			// hardcoded slug checks in drawbridge-sync. Declared here so it stops being
+			// magic, and so the token path can be told what it is dealing with: a
+			// shared credential has many writers by definition, refreshAdminToken
+			// already does compare-and-swap on the encrypted blob, and utils' generic
+			// save is a plain $set that would clobber a concurrent rotation.
+			//
+			// NOTHING READS IT YET. The pointer is still the mechanism until the
+			// embedded routes become install hooks and the `shop` collection is renamed
+			// — this is the declaration those will read, put here now because the block
+			// it belongs in exists now.
+			shared : {
+
+				// WHERE THE ONE CREDENTIAL LIVES. Every organization's connection to the
+				// same store points at the same row.
+				collection : 'shop',
+
+				// The settings key holding the lookup value, which is also the field it
+				// matches on that row — `connection.settings.shop` finds `shop.shop`.
+				key : 'shop',
+
+				// AND HOW A CONNECTION SAYS ITS CREDENTIAL IS SHARED: settings[ marker ]
+				// equals the collection name. Today that is the magic
+				// `settings.ref === 'shop'` pointer, written at
+				// api/route/shopify-embedded.js and read by hardcoded slug checks in
+				// three repos. Declared, it stops being magic.
+				marker : 'ref'
+
+			}
+
+		},
+		keys : false,
+		none : false,
+
+		// Shopify's install grant is an OAuth exchange under the hood and is NOT
+		// declared here: it runs inside the app flow rather than through the shared
+		// runner, so a complete auth.oauth block would describe a flow this
+		// connection never takes. That disagreement is what the old enum could not
+		// prevent — `type : 'install'` beside a stale auth.oauth was legal.
+		oauth : false
+	},
+	// EVERYTHING A MERCHANT READS.
+	//
+	// `errors` is in here rather than at the top level, and that is not a
+	// preference: the connection DOCUMENT carries its own `errors` array of
+	// scope-drift entries, and the document is spread OVER the resolved manifest
+	// downstream — a top-level one would be replaced by that array and never
+	// render.
+	//
+	// `connect` no longer exists as a container. Its other member was `redirect`,
+	// which is a URL and now sits with the vendor's other addresses.
+	content : {
+		confirm : 'Disconnecting deactivates all products from this store, drafts any advertisements that use them, disables Shopify steps in your workflows until you reconnect, and stops revenue tracking for this organization.',
+		description : [
+			'Installing the Drawbridge app from the Shopify App Store links your store to a single Drawbridge organization and makes your product catalog available inside Drawbridge, so you can feature products in your campaigns and advertisements.',
+			'Drawbridge attributes orders that originate from your campaigns — matched through cart parameters and lead-mapped discount codes — so you can see the revenue each campaign drives.',
+			'Drawbridge reads your products, records orders placed through your campaigns, and can issue discount codes. Order and product updates reach Drawbridge through the app\'s own webhooks, which Shopify applies when the app is installed.'
+		],
+		errors : {
+			connect : {
+				conflict : 'This store is already connected to another Drawbridge organization.',
+				currency : 'This store settles in a currency we can\'t bill yet. Connect a store with a supported settlement currency.',
+				invalid : 'We couldn\'t verify the install. Please try connecting again from the Shopify App Store.'
+			},
+
+			// WHERE TO GO, which is the only reason this is worth overriding. The
+			// generic sentence says a connection is missing permissions and to
+			// reconnect it; for an install there is no reconnect button here, and
+			// telling a merchant to press one they do not have is worse than saying
+			// nothing. This says the place.
+			//
+			// A STRING, not a keyed map like `connect`: there is one way a grant is
+			// too narrow. The shape allows either because the keys under an area
+			// belong to the vendor.
+			scopes : 'Shopify permissions are out of date. Open the Drawbridge app in your Shopify admin to approve the updated permissions.'
+		},
+		excerpt : 'Connect your Shopify store to feature products in your campaigns and track conversions.',
+		guide : [
+			'Open the Drawbridge listing on the Shopify App Store.',
+			'Install the app on the store you want to connect. It opens in Shopify admin and stays there.',
+			'Approve the Drawbridge plan when prompted — during install, or from the connection page here. The connection shows Pending until you do, then Active.',
+			'Come back here — the connections list updates on its own once the install finishes.'
+		],
+	},
+	// VENDOR-FACING EVENT IDENTITY, published so readers outside this package
+	// (drawbridge-sync's usage queue, an operator checking the Dev Dashboard)
+	// see the same handle the order hook mints into transactions and enqueues.
+	feature : 'organization:connection:shopify',
+	fields : [
+		{
+			// `shop` on the connection record wins when present — it is written by
+			// the install, while settings.domain is the stored copy.
+			from : 'shop',
+			key : 'domain',
+			label : 'Store domain'
+		}
+	],
+	// Was `category : 'commerce'` AND `group : 'ecommerce'` — two words for one
+	// fact, which left nobody able to say which one a page read.
+	group : 'commerce',
+	// verify and event lean entirely on the shared HMAC helper — Shopify's scheme
+	// is exactly the shape it covers, so there is nothing vendor-specific to
+	// write for either. receive is the one hook that genuinely differs by
+	// channel: /events buffers whatever arrives with the shop domain stamped on;
+	// /compliance enforces the topic allowlist above, because answering one late
+	// is a legal deadline rather than a retry.
+	hooks : {
+
+		auth : {
+			// The install completes inside Shopify admin; the api's callback stores
+			// what it hands back. Scope drift is its own hook because a token can be
+			// perfectly valid while the grant is too narrow.
+			//
+			// connect and disconnect are FALSE rather than `{}`: there is nothing to
+			// call on either side. The install already hands the callback everything
+			// it stores, and a Shopify grant is withdrawn by UNINSTALLING the app in
+			// Shopify admin — which Drawbridge learns about from the app_uninstalled
+			// webhook rather than by asking. `{}` claimed a body implemented
+			// elsewhere; none exists, and none could.
+			connect : false,
+			disconnect : false,
+
+			// WHETHER THE GRANT IS STILL WIDE ENOUGH. A token can be perfectly valid
+			// and still too narrow — a deploy that adds a scope leaves every existing
+			// install short of it, and no webhook fires to say so.
+			//
+			// The comparison is the vendor's, so it belongs here. Reading WHICH
+			// scopes a store granted is not: that lives in the `shop` collection and
+			// needs a controller, which is precisely what a hook in a published
+			// package must not be handed. The caller reads the grant and passes the
+			// string; this answers what is missing from it.
+			//
+			// `shopify` is injected for the same reason it is everywhere else — this
+			// client is imported here and defaulted, never wired in by a caller.
+			scopes : ( { scope }, { shopify = client } = {} ) => ({ result : { missing : scope ? shopify.oauth.missingScopes( scope ) : null } }),
+			// Shopify's install grant is exchanged inside its own app flow, not
+			// through the shared OAuth runner.
+			token : false
+		},
+		// THE VENDOR'S OWN WORK, here in full. Every body describes its writes,
+		// enqueues and events for the shell to perform — see contract.js — and
+		// everything it needs arrives as an argument: `read` (the controller's
+		// read methods, nothing that writes), `shopify` (the SDK, injected because
+		// this package cannot import what depends on it), `adminToken` (minted by
+		// the shell, which persists rotations), `mintId` (so one described write
+		// can reference another), `dispatch` (the caller's own coordinator table,
+		// for the hooks that are dispatches).
+		commerce : {
+
+			// THE CHECKOUT KIT CART. Six operations that were six direct calls into
+			// the storefront client from api/route/subdomain.js.
+			//
+			// IT WRITES NOTHING, which is exactly why it was the last surface to
+			// become a hook — a hook is usually reached to have its effects performed
+			// and this one has none. That reasoning was wrong: a hook is also the one
+			// place a vendor's client is allowed to be called from, and leaving the
+			// cart out meant a public route importing a vendor SDK directly.
+			//
+			// ONE HOOK, OPERATION IN THE CONTEXT, the same shape `inbound.process`
+			// uses for its topic table. Six slots would be six names in the closed
+			// vocabulary for one question — what does this shopper's cart look like
+			// now — asked six ways.
+			//
+			// A USER ERROR IS A 400 AND THE SHOPPER'S OWN WORDS. Shopify's cart
+			// mutations answer "that variant is sold out" as a userError rather than a
+			// transport failure, and the route it replaced already told the two apart.
+			// runHook carries `status` off a thrown error, so it survives to the
+			// caller; the rest of a thrown error's shape does not.
+			cart : async ( { clientId, clientSecret, context, settings }, { fetcher, shopify = client } = {} ) => {
+
+				const { cartId, lineIds, lines, operation } = context || {};
+				const { domain, storefrontAccessToken } = settings || {};
+
+				// MINTED FROM DRAWBRIDGE'S OWN APP CREDENTIALS rather than the store's
+				// token — the Checkout Kit authenticates as the app. The only operation
+				// here that does not touch the merchant's storefront.
+				if( operation === 'checkout' ){
+
+					const token = await shopify.storefront.createCheckoutToken({ clientId, clientSecret, fetcher });
+
+					return { message : 'Checkout token minted.', result : { token } };
+
+				}
+
+				const storefront = { domain, fetcher, storefrontAccessToken };
+
+				try {
+
+					const cart = await ({
+						create : () => shopify.storefront.cartCreate({ ...storefront, lines }),
+						get : () => shopify.storefront.cartGet({ ...storefront, cartId }),
+						linesAdd : () => shopify.storefront.cartLinesAdd({ ...storefront, cartId, lines }),
+						linesRemove : () => shopify.storefront.cartLinesRemove({ ...storefront, cartId, lineIds }),
+						linesUpdate : () => shopify.storefront.cartLinesUpdate({ ...storefront, cartId, lines })
+					}[ operation ] || ( () => {
+
+						throw Object.assign( new Error( 'Unknown cart operation: ' + operation ), { status : 400 });
+
+					}) )();
+
+					return { message : 'Cart ' + operation + '.', request : { cartId : cartId || null, operation }, result : cart };
+
+				} catch ( error ){
+
+					// The shopper can act on this one; everything else is ours.
+					if( error?.userError ) throw Object.assign( error, { status : 400 });
+
+					throw error;
+
+				}
+
+			},
+
+			// MINT A DISCOUNT CODE against the merchant's chosen discount, mapped to
+			// one lead — which is what lets an order that redeems it be attributed
+			// back.
+			code : async ( { connection, context, step }, { adminToken, shopify = client } = {} ) => {
+
+				const discount = step.settings?.discount;
+
+				const request = { email : context?.email || null, lead : context?.lead || null, shop : connection.shop };
+
+				// KEPT even though nothing below sends the address anywhere. A code
+				// that reaches nobody is a wasted action and a merchant's wasted
+				// allowance: issuing is only half a workflow, and the email step after
+				// it needs somewhere to send the code.
+				if( ! context?.email ) return { message : 'Lead email is missing.', request, response : { skipped : true }, skipped : true };
+				if( ! context?.lead ) return { message : 'Lead id is missing.', request, response : { skipped : true }, skipped : true };
+				if( ! discount?.id ) return { message : 'Discount is not configured on this step.', request, response : { skipped : true }, skipped : true };
+
+				const adminAccessToken = await adminToken();
+
+				// NOTHING IS SENT TO SHOPIFY TO LINK THE CODE TO THE PERSON, because
+				// there is nothing to send: discountRedeemCodeBulkAdd takes a discount
+				// and a list of codes, and no customer
+				// (shopify.dev/docs/api/admin-graphql/2026-04/mutations/discountRedeemCodeBulkAdd).
+				// The link lives entirely on our side — `lead.shopifyDiscountCode`
+				// below — and attribution happens when the order comes back carrying
+				// the code, matched org-scoped against that field by commerce.order.
+				//
+				// This step used to call getOrCreateCustomer first, on the stated
+				// reasoning that "the customer must exist before a code is mapped to
+				// them". No code was ever mapped to them: the result was assigned and
+				// discarded, createDiscountCode never received it, and redemption
+				// attribution never consulted it. All it did was create a customer in
+				// the merchant's store as a side effect of issuing a discount — which
+				// QA reported as surprising, and was right to. A merchant who wants the
+				// buyer to exist at the store adds the Create customer step, which is
+				// what that step is for.
+				const discountCode = await shopify.admin.createDiscountCode({
+					adminAccessToken,
+					code : 'DB-' + generateDiscountCode(),
+					discountId : discount.id,
+					domain : connection.shop
+				});
+
+				if( ! discountCode ) return { message : 'Shopify did not return a discount code — create failed.', request, response : { skipped : true }, skipped : true };
+
+				return {
+					context : {
+						shopifyDiscountCode : discountCode.code,
+						shopifyDiscountId : String( discountCode.id )
+					},
+					message : 'Discount code created and linked to lead.',
+					request,
+					response : { code : discountCode.code, id : String( discountCode.id ) },
+					// bypassDocumentValidation because these are vendor ids on a
+					// Drawbridge document the schema does not declare — the
+					// canonical-identity work resolves it properly.
+					writes : [ {
+						collection : 'lead',
+						data : {
+							$set : {
+								shopifyDiscountCode : discountCode.code,
+								shopifyDiscountId : String( discountCode.id )
+							}
+						},
+						operation : 'update',
+						options : { bypassDocumentValidation : true },
+						query : { id : context.lead }
+					} ]
+				};
+
+			},
+
+			// CREATE THE BUYER AT THE STORE, so an order can be attributed to them.
+			//
+			// IDEMPOTENT THREE WAYS, because this runs on every entry and a duplicate
+			// customer at the store is a support ticket: the context may already
+			// carry the id from an earlier step, the lead may already be linked from
+			// an earlier run, and Shopify's own get-or-create settles the rest.
+			customer : async ( { connection, context }, { adminToken, read, shopify = client } = {} ) => {
+
+				const request = { email : context?.email || null, lead : context?.lead || null, shop : connection.shop };
+
+				if( ! context?.email ) return { message : 'Lead email is missing — cannot create Shopify customer.', request, response : { skipped : true }, skipped : true };
+				if( ! context?.lead ) return { message : 'Lead id is missing — cannot create Shopify customer.', request, response : { skipped : true }, skipped : true };
+
+				// Already known from an earlier step in this run.
+				if( context.shopifyCustomerId ){
+
+					return {
+						context : { shopifyCustomerId : context.shopifyCustomerId },
+						message : 'Trigger data already includes a Shopify customer id — reusing.',
+						request,
+						response : { shopifyCustomerId : context.shopifyCustomerId },
+						// Reusing an id is not a creation, so it does not bill.
+						skipped : true
+					};
+
+				}
+
+				const lead = await read.get({ collection : 'lead', query : { id : context.lead } });
+
+				// Already linked by an earlier run.
+				if( lead?.shopifyCustomerId ){
+
+					return {
+						context : { shopifyCustomerId : lead.shopifyCustomerId },
+						message : 'Lead already has a Shopify customer id — reusing.',
+						request,
+						response : { shopifyCustomerId : lead.shopifyCustomerId },
+						skipped : true
+					};
+
+				}
+
+				const adminAccessToken = await adminToken();
+
+				// Shopify keeps first and last separately; Drawbridge keeps one name.
+				// Split on the first space and give everything after it to the
+				// surname, which is wrong for some names and is what the vendor's
+				// shape allows.
+				const parts = ( lead?.name || '' ).trim().split( /\s+/ ).filter( Boolean );
+
+				const customer = await shopify.admin.getOrCreateCustomer({
+					adminAccessToken,
+					domain : connection.shop,
+					email : context.email,
+					firstName : parts.length ? parts[ 0 ] : null,
+					lastName : parts.length > 1 ? parts.slice( 1 ).join( ' ' ) : null,
+					source : 'drawbridge'
+				});
+
+				if( ! customer?.id ) return { message : 'Shopify did not return a customer id — create/lookup failed.', request, response : { skipped : true }, skipped : true };
+
+				return {
+					context : { shopifyCustomerId : customer.id },
+					message : 'Shopify customer created/linked to lead.',
+					request,
+					response : { shopifyCustomerId : customer.id },
+					// The hook's own result, described beside the call that produced it.
+					writes : [ {
+						collection : 'lead',
+						data : { $set : { shopifyCustomerId : customer.id } },
+						operation : 'update',
+						options : { bypassDocumentValidation : true },
+						query : { id : context.lead }
+					} ]
+				};
+
+			},
+
+			// HOW MANY ARE LEFT. Read at the moment a campaign's product list is
+			// rendered rather than stored on the product, because stock is the one
+			// product fact that is stale the instant it is written down.
+			//
+			// SUMMED HERE, not by the caller. Shopify answers per variant and every
+			// caller wanted the total; the one that existed summed it inline, and
+			// summing `Object.values()` over the raw map is how a cache wrapper's own
+			// bookkeeping key got counted as a quantity.
+			inventory : async ( { connection, context }, { adminToken, shopify = client } = {} ) => {
+
+				const productId = context?.product;
+
+				const request = { product : productId || null, shop : connection.shop };
+
+				if( ! productId ) return { message : 'No product id — nothing to count.', request, result : { total : null }, skipped : true };
+
+				const adminAccessToken = await adminToken();
+
+				const byVariant = await shopify.admin.getProductInventory({
+					adminAccessToken,
+					domain : connection.shop,
+					productId
+				});
+
+				return {
+					message : 'Inventory read.',
+					request,
+					result : { total : Object.values( byVariant || {} ).reduce( ( sum, quantity ) => sum + quantity, 0 ) }
+				};
+
+			},
+
+			// AN ORDER ARRIVED AT THE STORE. The largest hook in the family, because
+			// attribution genuinely is: an order can reach Drawbridge two ways and
+			// they bill differently.
+			//
+			//   CONVERSION — a `_drwbrdg_ca` line-item property, injected at
+			//                add-to-cart. Causal: the campaign produced the sale, so
+			//                it carries a fee.
+			//   REDEMPTION — a DB- discount code matched to a lead. Associative: we
+			//                cannot claim we caused the purchase, so it is fee-free.
+			//
+			// Both can be true, and an order already recorded as a conversion can
+			// later have a redemption backfilled onto it — `backfill` below.
+			//
+			// IDEMPOTENT THROUGH THE RETRY, one layer up: two deliveries of the same
+			// order race, the loser's transaction hits a duplicate key, the step
+			// fails and BullMQ redelivers — and the re-run's read at the top finds
+			// what the winner wrote and skips instead of double-billing a merchant
+			// for one purchase. The hook used to loop for this itself; describing
+			// the writes moved the retry to the queue, with the same guarantee.
+			order : async ( { connection, context }, { conversionRate, logger, mintId, read } = {} ) => {
+
+				const {
+					advertisement,
+					created_at : createdAt,
+					currency,
+					customer : orderCustomer,
+					email,
+					id : orderId,
+					line_items : lineItems = [],
+					organization,
+					phone
+				} = context || {};
+
+				const request = { orderId : orderId ? String( orderId ) : null, organization };
+
+				const [ existingOrder, existingRedemption ] = await Promise.all([
+					read.get({ collection : 'order', query : { 'provider.id' : String( orderId ), 'provider.slug' : 'shopify' } }),
+					read.get({ collection : 'redemption', query : { 'provider.id' : String( orderId ), 'provider.slug' : 'shopify' } })
+				]);
+
+				// Already fully recorded. This is the branch the redelivery exists to
+				// reach.
+				if( existingRedemption ){
+
+					return {
+						message : 'Order/redemption already recorded — skipping duplicate.',
+						request,
+						response : {
+							existingOrderId : existingOrder?.id || null,
+							existingRedemptionId : existingRedemption.id,
+							skipped : true
+						},
+						skipped : true
+					};
+
+				}
+
+				const backfill = ! ! existingOrder;
+
+				// ONLY `_drwbrdg_ca`-TAGGED LINES COUNT toward attributed gross.
+				const { attrMap, attributedGross, attributedLines } = attributeLineItems( lineItems );
+
+				const campaign = attrMap[ '_drwbrdg_ca' ] || null;
+
+				const discountCodes = Array.isArray( context?.discount_codes ) ? context.discount_codes : [];
+				const codes = [ ...new Set( discountCodes.map( ( dc ) => dc?.code ).filter( Boolean ) ) ];
+
+				const matchedLeads = codes.length
+					? await read.aggregate({
+						collection : 'lead',
+						pipeline : [ { $match : { organization, shopifyDiscountCode : { $in : codes } } } ]
+					})
+					: [];
+
+				const codeToLead = {};
+
+				for( const found of matchedLeads ){
+
+					if( found.shopifyDiscountCode ) codeToLead[ found.shopifyDiscountCode ] = found;
+
+				}
+
+				const matchedDiscounts = discountCodes
+					.filter( ( dc ) => dc?.code && codeToLead[ dc.code ] )
+					.map( ( dc ) => ({
+						amount : parseFloat( dc.amount ) || 0,
+						code : dc.code,
+						id : codeToLead[ dc.code ].shopifyDiscountId || null
+					}) );
+
+				const matchedLead = matchedDiscounts.length ? codeToLead[ matchedDiscounts[ 0 ].code ] : null;
+
+				const discount = matchedDiscounts.length
+					? {
+						amount : matchedDiscounts.reduce( ( sum, entry ) => sum + entry.amount, 0 ),
+						codes : matchedDiscounts
+					}
+					: null;
+
+				const matchedCodes = new Set( matchedDiscounts.map( ( entry ) => entry.code ) );
+
+				// A DB- code we minted that matched no lead. Logged rather than
+				// ignored: it means a code went out and its lead link was lost, which
+				// is revenue we cannot attribute and nobody would otherwise notice.
+				const unmatched = codes.filter( ( code ) => code.startsWith( 'DB-' ) && ! matchedCodes.has( code ) );
+
+				if( unmatched.length ){
+
+					logger?.warn?.( 'shopify.order.discount.unmatched', {
+						campaign : campaign || null,
+						codes : JSON.stringify( unmatched ),
+						isConversion : ! ! campaign,
+						orderId : String( orderId ),
+						organization
+					});
+
+				}
+
+				if( ( ! campaign && ! discount ) || ( backfill && ! discount ) ){
+
+					return {
+						message : backfill
+							? 'Order already recorded and no Drawbridge discount code matched — nothing to backfill.'
+							: 'Order has no Drawbridge attribution — not recording.',
+						request,
+						response : { skipped : true },
+						skipped : true
+					};
+
+				}
+
+				let advertisementId = null;
+				let affiliateId = null;
+				let campaignOrganization = organization;
+				let gross = 0;
+				let leadId = null;
+				let lines = [];
+				let orderCampaign = null;
+				let pageId = null;
+
+				const isConversion = ! ! campaign;
+
+				const customerPhone = toE164( orderCustomer?.phone || phone ) || null;
+
+				const matchPhones = [ ...new Set([
+					customerPhone,
+					toE164( context?.billing_address?.phone ),
+					toE164( context?.shipping_address?.phone )
+				].filter( Boolean ) ) ];
+
+				if( isConversion ){
+
+					const campaignDoc = await read.get({ collection : 'campaign', query : { id : campaign } });
+
+					// THE CAMPAIGN MUST BELONG TO THE DELIVERING SHOP'S OWN ORG.
+					//
+					// `_drwbrdg_ca` is a line-item property, and on most Shopify themes
+					// a buyer can attach arbitrary line-item properties via cart
+					// permalinks or the AJAX cart API — and campaign ids are
+					// discoverable from public campaign links. Without this check, a $1
+					// order on ANY connected store carrying another org's campaign id
+					// records a conversion under that org: its revenue totals climb,
+					// its usage document is incremented, and its matching leads gain
+					// order counts — a cross-tenant write driven entirely by the buyer.
+					//
+					// A stale or garbage id lands here too, so this is also the null
+					// check: either way the order simply has no Drawbridge attribution.
+					if( ! campaignDoc || campaignDoc.organization !== organization ){
+
+						return {
+							message : 'Order carried a campaign attribution that does not belong to this store — not recording.',
+							request,
+							response : { skipped : true },
+							skipped : true
+						};
+
+					}
+
+					advertisementId = attrMap[ '_drwbrdg_ad' ] || advertisement || null;
+					affiliateId = attrMap[ '_drwbrdg_af' ] || null;
+					campaignOrganization = campaignDoc.organization;
+					gross = attributedGross;
+					lines = attributedLines;
+					orderCampaign = campaign;
+					pageId = attrMap[ '_drwbrdg_pg' ] || null;
+
+					// MATCHED ON EVERY IDENTITY WE HOLD, canonical forms included,
+					// because the address on an order is often not the one they entered
+					// with.
+					const identifiers = [];
+
+					const canonicalEmail = toCanonicalEmail( email );
+
+					if( email ) identifiers.push({ email : email.toLowerCase() });
+					if( canonicalEmail ) identifiers.push({ 'canonical.email.value' : canonicalEmail });
+					if( matchPhones.length ) identifiers.push({ 'phone.number' : { $in : matchPhones } });
+					if( matchPhones.length ) identifiers.push({ 'canonical.phone.value' : { $in : matchPhones } });
+
+					if( identifiers.length ){
+
+						// Narrowed to the campaign first; an org-wide match is the
+						// fallback, because a buyer who entered a different campaign is
+						// still the same person and still worth linking.
+						const lead = await read.get({
+							collection : 'lead',
+							query : {
+								campaigns : { $in : [ campaign ] },
+								organization : campaignOrganization,
+								$or : identifiers
+							}
+						});
+
+						leadId = lead?.id || null;
+
+						if( ! leadId ){
+
+							const orgLead = await read.get({
+								collection : 'lead',
+								query : { organization : campaignOrganization, $or : identifiers }
+							});
+
+							leadId = orgLead?.id || null;
+
+						}
+
+					}
+
+				} else {
+
+					// REDEMPTION. The lead is known from the code, and the whole order
+					// counts as gross — there are no tagged lines to narrow it to.
+					leadId = matchedLead.id;
+					orderCampaign = ( matchedLead.campaigns || [] ).length === 1 ? matchedLead.campaigns[ 0 ] : null;
+					gross = lineItems.reduce( ( sum, item ) => {
+
+						const line = toLine( item );
+
+						return sum + ( line.price * line.quantity );
+
+					}, 0 );
+					lines = lineItems.map( toLine );
+
+				}
+
+				const org = await read.get({ collection : 'organization', query : { id : campaignOrganization } });
+
+				let rate = 0;
+
+				// THE FEE IS THE CONVERSION FEE, and only a conversion carries one. A
+				// redemption is associative — we cannot claim we caused the purchase —
+				// so it is recorded fee-free.
+				//
+				// `conversionRate` IS INJECTED rather than imported, and that is not
+				// ceremony. This file used to `import { conversionRate } from
+				// '../../plans.js'`, which made a VENDOR MANIFEST depend on
+				// DRAWBRIDGE'S PLAN CATALOGUE — backwards, and a genuine import cycle
+				// (features -> connections -> shopify -> plans -> features) that no
+				// derived feature list could be added around. What a merchant is
+				// charged is Drawbridge's business, not Shopify's; the manifest reads
+				// the subscription and asks.
+				if( isConversion ){
+
+					const subscription = await read.get({ collection : 'subscription', query : { id : org?.subscription } });
+
+					rate = conversionRate( subscription );
+
+				}
+
+				const fee = isConversion ? Math.round( gross * rate ) / 100 : 0;
+				const net = Math.round( ( gross - fee ) * 100 ) / 100;
+
+				const currencyCode = ( currency || 'usd' ).toLowerCase();
+				const purchasedAt = new Date( createdAt || Date.now() );
+
+				const customer = ( orderCustomer || email || phone )
+					? {
+						acceptsMarketing : orderCustomer?.email_marketing_consent?.state
+							? orderCustomer.email_marketing_consent.state === 'subscribed'
+							: ( typeof orderCustomer?.accepts_marketing === 'boolean' ? orderCustomer.accepts_marketing : null ),
+						email : orderCustomer?.email || email || null,
+						firstName : orderCustomer?.first_name || null,
+						id : orderCustomer?.id ? String( orderCustomer.id ) : null,
+						lastName : orderCustomer?.last_name || null,
+						phone : customerPhone
+					}
+					: null;
+
+				const source = connection?.source
+					? { domain : connection.source.domain, id : connection.source.id }
+					: undefined;
+
+				// EVERY PURCHASE GETS AN ORDER DOCUMENT, whichever way it reached us.
+				//
+				// A redemption used to write only a redemption row, which meant the
+				// money existed on the Redemptions page and nowhere else: contact
+				// totals are summed from the ORDER collection, so a real purchase by a
+				// known entrant contributed nothing to their revenue and was invisible
+				// to every revenue segment. `type` keeps the two kinds apart for the
+				// figures that must stay causal (the fee, the Revenue page's
+				// conversion column) without splitting the source of truth in two.
+				const createsOrder = ! backfill && ( isConversion || Boolean( discount ) );
+
+				// MINTED HERE, because the redemption names its order and the usage
+				// job names both — a description cannot read a write's result, so the
+				// id exists before either does. Minted for the redemption too, so the
+				// order can name it back.
+				// MINTED AS A PAIR. `mintId` hands back both halves — the driver's `_id` and
+				// its string `id` — because this package has no mongodb dependency and
+				// cannot construct one. The string is what every reference below uses; the
+				// `_id` goes on the create so the document is born with the pair the
+				// controller would otherwise derive.
+				const mintedOrder = ! existingOrder?.id && createsOrder ? mintId() : null;
+
+				const orderDocId = existingOrder?.id || mintedOrder?.id || null;
+				const mintedRedemption = discount ? mintId() : null;
+
+				const redemptionDocId = mintedRedemption?.id || null;
+
+				const writes = [];
+
+				if( createsOrder ){
+
+					writes.push({
+						collection : 'order',
+						data : {
+							advertisement : advertisementId,
+							affiliate : affiliateId,
+							campaign : orderCampaign,
+							currency : currencyCode,
+							customer,
+							discount,
+							fee,
+							gross,
+							_id : mintedOrder?._id,
+							id : orderDocId,
+							lead : leadId,
+							lines,
+							net,
+							organization : campaignOrganization,
+							page : pageId,
+							provider : { id : String( orderId ), slug : 'shopify' },
+							purchasedAt,
+							rate,
+							// Null on a conversion that matched no code of ours; the
+							// backfill branch below sets it when one arrives later.
+							redemption : redemptionDocId,
+							source,
+							status : 'completed',
+							type : isConversion ? 'conversion' : 'redemption'
+						},
+						operation : 'create'
+					});
+
+					if( org?.usage ){
+
+						writes.push({
+							collection : 'usage',
+							// TWO METERS, NOT ONE SUMMED. `revenue` has always meant
+							// conversion revenue and is the figure the fee is charged
+							// against, so redemption money gets its own key rather than
+							// changing what an existing number means.
+							data : { $inc : isConversion
+								? { 'totals.revenue' : gross }
+								: { 'totals.redemptionRevenue' : gross }
+							},
+							operation : 'update',
+							query : { id : org.usage }
+						});
+
+					}
+
+					if( leadId ){
+
+						writes.push({
+							collection : 'lead',
+							// Same grouped shape the contact carries, so a lead and the
+							// contact built from it cannot be read two different ways.
+							data : { $inc : {
+								'totals.orders.total' : 1,
+								...( isConversion
+									? { 'totals.orders.conversions' : 1 }
+									: { 'totals.orders.redemptions' : 1 }
+								)
+							} },
+							operation : 'update',
+							options : { bypassDocumentValidation : true },
+							query : { id : leadId }
+						});
+
+					}
+
+				}
+
+				if( discount ){
+
+					writes.push({
+						collection : 'redemption',
+						data : {
+							advertisement : advertisementId,
+							affiliate : affiliateId,
+							campaign : orderCampaign,
+							code : matchedDiscounts[ 0 ]?.code || null,
+							currency : currencyCode,
+							customer,
+							discount,
+							gross,
+							_id : mintedRedemption?._id,
+							id : redemptionDocId,
+							lead : leadId,
+							order : orderDocId,
+							organization : campaignOrganization,
+							page : pageId,
+							provider : { id : String( orderId ), slug : 'shopify' },
+							purchasedAt,
+							source,
+							status : 'completed'
+						},
+						operation : 'create'
+					});
+
+					if( org?.usage ){
+
+						writes.push({
+							collection : 'usage',
+							data : { $inc : { 'totals.redemptions' : 1 } },
+							operation : 'update',
+							query : { id : org.usage }
+						});
+
+					}
+
+					if( leadId ){
+
+						writes.push({
+							collection : 'lead',
+							data : { $inc : { 'totals.redemptions' : 1 } },
+							operation : 'update',
+							options : { bypassDocumentValidation : true },
+							query : { id : leadId }
+						});
+
+					}
+
+					// THE BACKFILL LEG: a conversion recorded earlier, matched to one of
+					// our codes now. The order already exists, so nothing above created
+					// it and nothing has told it which redemption it belongs to — this
+					// is the only write that closes that link. Skipped when the order
+					// was created in this same run, because it was minted carrying the
+					// id already.
+					if( backfill && orderDocId && redemptionDocId ){
+
+						writes.push({
+							collection : 'order',
+							data : { $set : { redemption : redemptionDocId } },
+							operation : 'update',
+							query : { id : orderDocId }
+						});
+
+					}
+
+				}
+
+				// SHOPIFY-BILLED ORGS ARE CHARGED THROUGH SHOPIFY, keyed on the order
+				// id so a redelivery cannot charge twice. Never on a backfill: the fee
+				// was charged when the order was first recorded. Enqueues run after
+				// the transaction commits, so the job can never observe rows that
+				// roll back.
+				const billable = org?.billingProvider === 'shopify' && fee > 0 && ! backfill;
+
+				// THE EFFECTIVE METER HANDLE. The provider row's orderEventHandle
+				// (admin-editable, for the day the plan config's meter changes)
+				// overrides the built-in default; slugified again on read as belt
+				// and braces with the save-side formatter, since a drifted stored
+				// value would mint transactions no meter classifies. Read directly
+				// (not via providerSettings — that module imports this one) and
+				// only for a billable order, which keeps the cost off every
+				// ordinary redemption.
+				const providerRow = billable
+					? await read.get({ collection : 'provider', query : { slug : 'shopify' } })
+					: null;
+
+				const { orderEventHandle } = providerRow?.settings ? decrypt( providerRow.settings ) : {};
+
+				const handle = ( typeof orderEventHandle === 'string' && slugify( orderEventHandle ) ) || ORDER_EVENT_HANDLE;
+
+				// A billable order with no shop id is revenue lost SILENTLY — the
+				// gate below just yields no job, the order records normally, and the
+				// connection looks healthy. An Error (not a warn) because this is
+				// money: the order id goes in the MESSAGE, since Sentry matches
+				// titles, and the health check's source self-heal is what makes the
+				// state rare enough to page on.
+				if( billable && ! connection?.source?.id ){
+
+					logger?.error?.( new Error(
+						'shopify.usage.billing.skipped on order ' + orderId + ': '
+						+ Math.round( fee * 100 ) + ' cents not billed — connection '
+						+ connection?.id + ' has no source.id'
+					), {
+						extra : {
+							connectionId : connection?.id,
+							fee,
+							orderDocId,
+							orderId : String( orderId )
+						}
+					});
+
+				}
 
-		auth : {
-			// The install completes inside Shopify admin; the api's callback stores
-			// what it hands back. Scope drift is its own hook because a token can be
-			// perfectly valid while the grant is too narrow.
-			//
-			// connect and disconnect are FALSE rather than `{}`: there is nothing to
-			// call on either side. The install already hands the callback everything
-			// it stores, and a Shopify grant is withdrawn by UNINSTALLING the app in
-			// Shopify admin — which Drawbridge learns about from the app_uninstalled
-			// webhook rather than by asking. `{}` claimed a body implemented
-			// elsewhere; none exists, and none could.
-			connect : false,
-			disconnect : false,
+				const enqueues = ( billable && connection?.source?.id )
+					? [ {
+						data : {
+							// The meter handle travels WITH the job so the sender can
+							// verify it against the transaction prefix and refuse a
+							// drifted pair — idempotency keys are permanent, so a
+							// mistraceable event can never be resent under its own key.
+							handle,
+							idempotencyKey : String( orderId ),
+							orderDocId,
+							orderId : String( orderId ),
+							rate,
+							shopId : connection.source.id,
+							// The App Events API returns no event id, so one is generated
+							// here — the event handle plus the order id — and sent as the
+							// event's `reference`. queue/usage.js stamps the same id onto
+							// the order as billed.transaction.
+							transaction : handle + '.' + orderId,
+							value : Math.round( fee * 100 )
+						},
+						name : 'billing',
+						options : { jobId : 'shopify.usage.' + orderId },
+						queue : 'usage'
+					} ]
+					: [];
 
-			// WHETHER THE GRANT IS STILL WIDE ENOUGH. A token can be perfectly valid
-			// and still too narrow — a deploy that adds a scope leaves every existing
-			// install short of it, and no webhook fires to say so.
+				return {
+					enqueues,
+					message : backfill
+						? 'Redemption backfilled for an already-recorded order.'
+						: isConversion ? 'Order recorded.' : 'Discount redemption recorded (fee-free).',
+					request,
+					response : {
+						campaign : orderCampaign,
+						currency : currencyCode,
+						discount,
+						fee,
+						gross,
+						lead : leadId,
+						lines : lines.length,
+						net,
+						orderId : String( orderId )
+					},
+					// ONE TRANSACTION. The order, the redemption and both totals
+					// counters land together or not at all — a half-written attribution
+					// is revenue counted twice or not at all, and neither is
+					// recoverable by hand.
+					transaction : writes.length > 0,
+					writes
+				};
+
+			},
+
+			// A PRODUCT CHANGED AT THE STORE. Upserts the product row and hands it to
+			// the product pipeline; the actual field sync happens there.
 			//
-			// The comparison is the vendor's, so it belongs here. Reading WHICH
-			// scopes a store granted is not: that lives in the `shop` collection and
-			// needs a controller, which is precisely what a hook in a published
-			// package must not be handed. The caller reads the grant and passes the
-			// string; this answers what is missing from it.
+			// The shell has already refused a missing or inactive Shopify connection,
+			// so what is left is the two things only this hook can know are wrong.
+			// A PRODUCT, IN THREE MOVES. Nested by operation rather than by three
+			// slots in the closed vocabulary, the same shape inbound.process uses
+			// for its topic table — they are one subject, and a vendor that syncs
+			// products has to answer all three or none.
 			//
-			// `shopify` is injected for the same reason it is everywhere else — this
-			// package cannot import @drawbridge/shopify, which depends on it.
-			scopes : ( { scope }, { shopify } = {} ) => ({ result : { missing : scope ? shopify.oauth.missingScopes( scope ) : null } }),
-			// Shopify's install grant is exchanged inside its own app flow, not
-			// through the shared OAuth runner.
-			token : false
-		},
-		// THE VENDOR'S OWN WORK, here in full. Every body describes its writes,
-		// enqueues and events for the shell to perform — see contract.js — and
-		// everything it needs arrives as an argument: `read` (the controller's
-		// read methods, nothing that writes), `shopify` (the SDK, injected because
-		// this package cannot import what depends on it), `adminToken` (minted by
-		// the shell, which persists rotations), `mintId` (so one described write
-		// can reference another), `dispatch` (the caller's own coordinator table,
-		// for the hooks that are dispatches).
-		commerce : {
+			//   record     a webhook said a product changed: upsert the row and
+			//              queue the pull
+			//   sync       pull the product from the storefront and write what it
+			//              says, including what it says by NOT answering
+			//   variants   one page of variants, self-chaining
+			//
+			// `sync` and `variants` were 443 lines of drawbridge-sync's
+			// queue/product.js — a shadow implementation of the step this manifest
+			// already declared, importing three of the vendor's client modules from
+			// a worker file.
+			product : async ( { connection, context, settings, workflow }, { adminToken, mintId, read, shopify = client } = {} ) => {
 
-			// NOT YET. The Checkout Kit cart path is `api/route/subdomain.js`, six direct
-			// calls into `@drawbridge/shopify/storefront` that write nothing — which is
-			// exactly why it never became a hook: a hook is reached to have its effects
-			// performed, and this one has none to perform. It moves here when the vendor
-			// client moves into the manifest and `subdomain.js` stops importing the
-			// package directly.
-			cart : false,
+				const operation = context?.operation || 'record';
 
-			// MINT A DISCOUNT CODE against the merchant's chosen discount, mapped to
-			// one lead — which is what lets an order that redeems it be attributed
-			// back.
-			code : async ( { connection, context, step }, { adminToken, shopify } = {} ) => {
+				if( operation === 'sync' ) return syncProduct({ adminToken, connection, context, read, settings, shopify });
 
-				const discount = step.settings?.discount;
+				if( operation === 'variants' ) return syncVariants({ connection, context, read, settings, shopify });
 
-				const request = { email : context?.email || null, lead : context?.lead || null, shop : connection.shop };
 
-				// KEPT even though nothing below sends the address anywhere. A code
-				// that reaches nobody is a wasted action and a merchant's wasted
-				// allowance: issuing is only half a workflow, and the email step after
-				// it needs somewhere to send the code.
-				if( ! context?.email ) return { message : 'Lead email is missing.', request, response : { skipped : true }, skipped : true };
-				if( ! context?.lead ) return { message : 'Lead id is missing.', request, response : { skipped : true }, skipped : true };
-				if( ! discount?.id ) return { message : 'Discount is not configured on this step.', request, response : { skipped : true }, skipped : true };
+				const request = {
+					numericId : context?.id || null,
+					organizationId : workflow?.organization || null,
+					title : context?.title || null
+				};
 
-				const adminAccessToken = await adminToken();
+				if( ! context?.id ) return { message : 'Skipped — product webhook payload had no id.', request, response : { skipped : true }, skipped : true };
 
-				// NOTHING IS SENT TO SHOPIFY TO LINK THE CODE TO THE PERSON, because
-				// there is nothing to send: discountRedeemCodeBulkAdd takes a discount
-				// and a list of codes, and no customer
-				// (shopify.dev/docs/api/admin-graphql/2026-04/mutations/discountRedeemCodeBulkAdd).
-				// The link lives entirely on our side — `lead.shopifyDiscountCode`
-				// below — and attribution happens when the order comes back carrying
-				// the code, matched org-scoped against that field by commerce.order.
+				// The shop domain is half the identity below. Without it the upsert
+				// would match on provider id alone and could collide across stores.
+				if( ! connection.shop ) return { message : 'Skipped — Shopify connection is missing shop domain.', request, response : { skipped : true }, skipped : true };
+
+				const providerId = 'gid://shopify/Product/' + context.id;
+
+				// THE ROW'S OWN ID WHEN IT ALREADY EXISTS, a fresh one only when it
+				// does not.
 				//
-				// This step used to call getOrCreateCustomer first, on the stated
-				// reasoning that "the customer must exist before a code is mapped to
-				// them". No code was ever mapped to them: the result was assigned and
-				// discarded, createDiscountCode never received it, and redemption
-				// attribution never consulted it. All it did was create a customer in
-				// the merchant's store as a side effect of issuing a discount — which
-				// QA reported as surprising, and was right to. A merchant who wants the
-				// buyer to exist at the store adds the Create customer step, which is
-				// what that step is for.
-				const discountCode = await shopify.admin.createDiscountCode({
-					adminAccessToken,
-					code : 'DB-' + generateDiscountCode(),
-					discountId : discount.id,
-					domain : connection.shop
-				});
+				// The write below is an upsert whose `id` sits in $setOnInsert, so a
+				// product we have seen before keeps the id it was first given and a
+				// newly minted one is silently discarded. Minting unconditionally
+				// therefore published an id belonging to no row: the enqueue named a
+				// product the worker then had to fall back off, and the step's
+				// response showed QA a value that matched nothing they could look up
+				// — which is exactly how it was reported.
+				//
+				// Reading first costs one indexed lookup on the same key the upsert
+				// matches. A concurrent redelivery can still have both runs miss and
+				// mint, which is why the job carries the PROVIDER identity too and the
+				// worker falls back to provider + shop — stable either way.
+				const query = {
+					'provider.id' : providerId,
+					'provider.slug' : 'shopify',
+					'source.domain' : connection.shop
+				};
 
-				if( ! discountCode ) return { message : 'Shopify did not return a discount code — create failed.', request, response : { skipped : true }, skipped : true };
+				const existing = read?.get ? await read.get({ collection : 'product', query }) : null;
+
+				const mintedProduct = existing?.id ? null : mintId();
+
+				const productId = existing?.id || mintedProduct.id;
 
 				return {
-					context : {
-						shopifyDiscountCode : discountCode.code,
-						shopifyDiscountId : String( discountCode.id )
-					},
-					message : 'Discount code created and linked to lead.',
+					enqueues : [ {
+						data : { product : productId, providerId, shop : connection.shop },
+						name : 'workflow',
+						// The numeric id, not the gid: BullMQ refuses a custom id with a
+					// colon in it, and every gid carries two.
+					options : { jobId : 'product.workflow.shopify.' + context.id + '.' + Date.now() },
+						queue : 'product.shopify'
+					} ],
+					message : 'Product sync queued from Shopify webhook.',
 					request,
-					response : { code : discountCode.code, id : String( discountCode.id ) },
-					// bypassDocumentValidation because these are vendor ids on a
-					// Drawbridge document the schema does not declare — the
-					// canonical-identity work resolves it properly.
+					response : { productId, providerId, title : context?.title || null },
+					// KEYED ON PROVIDER + SHOP, so the same product in two stores stays
+					// two rows. `connections` accumulates rather than replaces: one
+					// store can be linked to several organizations, and each keeps its
+					// own claim on the row.
 					writes : [ {
-						collection : 'lead',
+						collection : 'product',
 						data : {
-							$set : {
-								shopifyDiscountCode : discountCode.code,
-								shopifyDiscountId : String( discountCode.id )
+							$addToSet : { connections : connection.id },
+							$setOnInsert : {
+								...( mintedProduct && { _id : mintedProduct._id }),
+								id : productId,
+								provider : { id : providerId, slug : 'shopify' },
+								'source.id' : connection.id,
+								status : 'active'
 							}
 						},
 						operation : 'update',
-						options : { bypassDocumentValidation : true },
-						query : { id : context.lead }
+						options : { upsert : true },
+						query
 					} ]
 				};
 
-			},
+			}
+
+		},
+		contacts : { remove : false, sync : false },
+
+		// THE EMBEDDED-APP SURFACE. Only a vendor whose merchants arrive from its
+		// own app store has one, and these thirteen slots are the thirteen routes
+		// that used to live in api/route/shopify-embedded.js.
+		//
+		// A HOOK DESCRIBES ITS WRITES and the shell performs them, so none of these
+		// holds a controller — `read` is the controller's read methods and nothing
+		// else. Where one REFUSES it throws with a status, and the route answers
+		// what it said. The helpers they share are above the manifest.
+		install : {
+
+			account : {
+
+				// ESTABLISH THE DURABLE MERCHANT-TO-STORE LINK. The breakout
+				// authenticates the merchant once, top-level, and stashes their user
+				// token in `install.token.save`; App Bridge has already proven shop
+				// control by the time this runs.
+				//
+				// THE STASHED TOKEN IS THE TRUST ANCHOR, not merely any valid user
+				// token: the presented one must BE this shop's one-shot handoff token,
+				// unexpired, and an access or pat record — a refresh or oauth-state
+				// token that happens to resolve to a user must not qualify, which is
+				// the rule a session is held to in drawbridge-api's middleware.
+				link : async ( { context }, { read } = {} ) => {
 
-			// CREATE THE BUYER AT THE STORE, so an order can be attributed to them.
-			//
-			// IDEMPOTENT THREE WAYS, because this runs on every entry and a duplicate
-			// customer at the store is a support ticket: the context may already
-			// carry the id from an earlier step, the lead may already be linked from
-			// an earlier run, and Shopify's own get-or-create settles the rest.
-			customer : async ( { connection, context }, { adminToken, read, shopify } = {} ) => {
+					const shop = sanitizeDomain( context?.shop );
+					const token = context?.token;
 
-				const request = { email : context?.email || null, lead : context?.lead || null, shop : connection.shop };
+					if( ! shop || ! token ) throw refusal( 'shop and token are required', 400 );
 
-				if( ! context?.email ) return { message : 'Lead email is missing — cannot create Shopify customer.', request, response : { skipped : true }, skipped : true };
-				if( ! context?.lead ) return { message : 'Lead id is missing — cannot create Shopify customer.', request, response : { skipped : true }, skipped : true };
+					const now = new Date();
 
-				// Already known from an earlier step in this run.
-				if( context.shopifyCustomerId ){
+					const record = await read.get({ collection : 'shop', query : { shop } });
+
+					const stashed = record?.linkToken ? decrypt( record.linkToken )?.token : null;
+					const expired = ! record?.linkTokenExpiresAt || new Date( record.linkTokenExpiresAt ) <= now;
+
+					if( ! stashed || expired || stashed !== token ) throw refusal( 'Invalid or expired link token', 401 );
+
+					const granted = await read.get({
+						collection : 'token',
+						query : {
+							revoked : false,
+							tokenHash : hashToken( token ),
+							type : { $in : [ tokenTypes.access, tokenTypes.pat ] }
+						}
+					});
+
+					if( ! granted?.user || ( granted.expiresAt && new Date( granted.expiresAt ) <= now ) ){
+
+						throw refusal( 'Invalid or expired link token', 401 );
+
+					}
+
+					// RE-LINKING TO A DIFFERENT ACCOUNT TEARS THE OLD LINK DOWN. The
+					// store's existing org connections belong to the outgoing user, who
+					// can no longer see or manage them from the embedded app. Left in
+					// place they keep serving that user's campaigns off this store while
+					// the merchant is told they are connected as somebody else. Dependent
+					// cleanup fires from drawbridge-sync's connection change stream, the
+					// single home for that cascade.
+					const switching = Boolean( record?.user ) && record.user !== granted.user;
+
+					const connections = switching
+						? await read.aggregate({
+							collection : 'connection',
+							pipeline : [
+								{ $match : { shop, slug : 'shopify' } },
+								{ $project : { _id : 0, id : 1 } }
+							]
+						})
+						: [];
 
 					return {
-						context : { shopifyCustomerId : context.shopifyCustomerId },
-						message : 'Trigger data already includes a Shopify customer id — reusing.',
-						request,
-						response : { shopifyCustomerId : context.shopifyCustomerId },
-						// Reusing an id is not a creation, so it does not bill.
-						skipped : true
+						message : switching ? 'Linked to a different Drawbridge account.' : 'Linked.',
+						request : { shop },
+						result : { connected : true, switched : switching },
+						// ALL OR NONE. A half-done switch is a store linked to the new
+						// account while the old account's connections still serve from it.
+						transaction : true,
+						writes : [
+							...( connections || [] ).map( ( connection ) => ({
+								collection : 'connection',
+								operation : 'delete',
+								query : { id : connection.id }
+							}) ),
+							{
+								collection : 'shop',
+								data : { $set : { linkToken : null, linkTokenExpiresAt : null, user : granted.user } },
+								operation : 'update',
+								query : { shop }
+							}
+						]
 					};
 
-				}
+				},
 
-				const lead = await read.get({ collection : 'lead', query : { id : context.lead } });
+				// DISCONNECT THE ACCOUNT FROM THE STORE. Every org connection goes and
+				// the durable link clears; the offline token and the shop record stay,
+				// because the app is still installed and the merchant may link a
+				// different account next.
+				unlink : async ( { context }, { read } = {} ) => {
 
-				// Already linked by an earlier run.
-				if( lead?.shopifyCustomerId ){
+					const shop = sanitizeDomain( context?.shop );
+
+					if( ! shop ) throw refusal( 'shop is required', 400 );
+
+					const connections = await read.aggregate({
+						collection : 'connection',
+						pipeline : [
+							{ $match : { shop, slug : 'shopify' } },
+							{ $project : { _id : 0, id : 1 } }
+						]
+					});
 
 					return {
-						context : { shopifyCustomerId : lead.shopifyCustomerId },
-						message : 'Lead already has a Shopify customer id — reusing.',
-						request,
-						response : { shopifyCustomerId : lead.shopifyCustomerId },
-						skipped : true
+						message : 'Unlinked ' + ( connections || [] ).length + ' connection(s).',
+						request : { shop },
+						result : { ok : true },
+						transaction : true,
+						writes : [
+							...( connections || [] ).map( ( connection ) => ({
+								collection : 'connection',
+								operation : 'delete',
+								query : { id : connection.id }
+							}) ),
+							{
+								collection : 'shop',
+								data : { $set : { linkToken : null, linkTokenExpiresAt : null, user : null } },
+								operation : 'update',
+								query : { shop }
+							}
+						]
 					};
 
 				}
 
-				const adminAccessToken = await adminToken();
+			},
 
-				// Shopify keeps first and last separately; Drawbridge keeps one name.
-				// Split on the first space and give everything after it to the
-				// surname, which is wrong for some names and is what the vendor's
-				// shape allows.
-				const parts = ( lead?.name || '' ).trim().split( /\s+/ ).filter( Boolean );
+			organizations : {
 
-				const customer = await shopify.admin.getOrCreateCustomer({
-					adminAccessToken,
-					domain : connection.shop,
-					email : context.email,
-					firstName : parts.length ? parts[ 0 ] : null,
-					lastName : parts.length > 1 ? parts.slice( 1 ).join( ' ' ) : null,
-					source : 'drawbridge'
-				});
+				// BIND ONE ORGANIZATION TO THIS STORE. The longest slot here, and every
+				// gate in it came from a line in the route it replaces.
+				add : async ( { context }, { currencies, mintId, read, shopify = client } = {} ) => {
 
-				if( ! customer?.id ) return { message : 'Shopify did not return a customer id — create/lookup failed.', request, response : { skipped : true }, skipped : true };
+					const organization = context?.organization;
+					const shop = sanitizeDomain( context?.shop );
 
-				return {
-					context : { shopifyCustomerId : customer.id },
-					message : 'Shopify customer created/linked to lead.',
-					request,
-					response : { shopifyCustomerId : customer.id },
-					// The hook's own result, described beside the call that produced it.
-					writes : [ {
-						collection : 'lead',
-						data : { $set : { shopifyCustomerId : customer.id } },
-						operation : 'update',
-						options : { bypassDocumentValidation : true },
-						query : { id : context.lead }
-					} ]
-				};
+					if( ! shop ) throw refusal( 'shop is required', 400 );
+					if( ! organization ) throw refusal( 'organization is required', 400 );
 
-			},
+					const record = await read.get({ collection : 'shop', query : { shop } });
 
-			// AN ORDER ARRIVED AT THE STORE. The largest hook in the family, because
-			// attribution genuinely is: an order can reach Drawbridge two ways and
-			// they bill differently.
-			//
-			//   CONVERSION — a `_drwbrdg_ca` line-item property, injected at
-			//                add-to-cart. Causal: the campaign produced the sale, so
-			//                it carries a fee.
-			//   REDEMPTION — a DB- discount code matched to a lead. Associative: we
-			//                cannot claim we caused the purchase, so it is fee-free.
-			//
-			// Both can be true, and an order already recorded as a conversion can
-			// later have a redemption backfilled onto it — `backfill` below.
-			//
-			// IDEMPOTENT THROUGH THE RETRY, one layer up: two deliveries of the same
-			// order race, the loser's transaction hits a duplicate key, the step
-			// fails and BullMQ redelivers — and the re-run's read at the top finds
-			// what the winner wrote and skips instead of double-billing a merchant
-			// for one purchase. The hook used to loop for this itself; describing
-			// the writes moved the retry to the queue, with the same guarantee.
-			order : async ( { connection, context }, { conversionRate, logger, mintId, read } = {} ) => {
+					if( ! record?.user ) throw refusal( 'Account is not connected for this store', 409 );
 
-				const {
-					advertisement,
-					created_at : createdAt,
-					currency,
-					customer : orderCustomer,
-					email,
-					id : orderId,
-					line_items : lineItems = [],
-					organization,
-					phone
-				} = context || {};
+					// The linked merchant may only add orgs they own or hold the
+					// connections capability on.
+					const owned = await merchantOrganizations({ read, user : record.user });
+					const org = ( owned || [] ).find( ( entry ) => entry.id === organization );
 
-				const request = { orderId : orderId ? String( orderId ) : null, organization };
+					if( ! org ) throw refusal( 'No access to this organization', 403 );
 
-				const [ existingOrder, existingRedemption ] = await Promise.all([
-					read.get({ collection : 'order', query : { 'provider.id' : String( orderId ), 'provider.slug' : 'shopify' } }),
-					read.get({ collection : 'redemption', query : { 'provider.id' : String( orderId ), 'provider.slug' : 'shopify' } })
-				]);
+					// The dashboard's connection-write gate, applied to the embedded path
+					// too: a locked, suspended, past-due, unpaid or paused org cannot take
+					// a new revenue connection either way in.
+					if( ! CONNECTABLE_STATUSES.includes( org.billingStatus ) ){
 
-				// Already fully recorded. This is the branch the redelivery exists to
-				// reach.
-				if( existingRedemption ){
+						throw refusal( 'This organization can\'t accept connections right now — check its billing status in the dashboard', 403 );
 
-					return {
-						message : 'Order/redemption already recorded — skipping duplicate.',
-						request,
-						response : {
-							existingOrderId : existingOrder?.id || null,
-							existingRedemptionId : existingRedemption.id,
-							skipped : true
-						},
-						skipped : true
-					};
+					}
 
-				}
+					// ONE STORE PER ORGANIZATION. The write below keys on
+					// { organization, slug }, so without this a second store would
+					// silently re-point the org's existing connection at itself.
+					// Re-adding from the SAME store stays allowed. A connection carrying
+					// no `shop` is a legacy dashboard link and counts as another store.
+					if( org.connection && org.connection.shop !== shop ){
 
-				const backfill = ! ! existingOrder;
+						throw refusal( 'This organization is already connected to another Shopify store', 409 );
 
-				// ONLY `_drwbrdg_ca`-TAGGED LINES COUNT toward attributed gross.
-				const { attrMap, attributedGross, attributedLines } = attributeLineItems( lineItems );
+					}
 
-				const campaign = attrMap[ '_drwbrdg_ca' ] || null;
+					const settings = record?.settings ? decrypt( record.settings ) : null;
 
-				const discountCodes = Array.isArray( context?.discount_codes ) ? context.discount_codes : [];
-				const codes = [ ...new Set( discountCodes.map( ( dc ) => dc?.code ).filter( Boolean ) ) ];
+					if( ! settings?.accessToken ){
 
-				const matchedLeads = codes.length
-					? await read.aggregate({
-						collection : 'lead',
-						pipeline : [ { $match : { organization, shopifyDiscountCode : { $in : codes } } } ]
-					})
-					: [];
+						throw refusal( 'Store is not installed — open the app in the Shopify admin first', 409 );
 
-				const codeToLead = {};
+					}
 
-				for( const found of matchedLeads ){
+					const plan = await storePlan({ record, shopify });
 
-					if( found.shopifyDiscountCode ) codeToLead[ found.shopifyDiscountCode ] = found;
+					if( plan.unavailable ) throw refusal( 'Couldn\'t verify the store\'s plan — try again shortly', 502 );
 
-				}
+					if( ! plan.active ) throw refusal( 'Approve a plan before connecting organizations', 402 );
 
-				const matchedDiscounts = discountCodes
-					.filter( ( dc ) => dc?.code && codeToLead[ dc.code ] )
-					.map( ( dc ) => ({
-						amount : parseFloat( dc.amount ) || 0,
-						code : dc.code,
-						id : codeToLead[ dc.code ].shopifyDiscountId || null
-					}) );
+					// THE STOREFRONT TOKEN IS MINTED ONCE PER STORE. Product sync and
+					// storefront reads need it and token exchange only yields the admin
+					// token. It lives in its own field because a session refresh
+					// overwrites `settings` wholesale. BEST-EFFORT: a miss must not block
+					// the link, and the next add re-mints it.
+					let storefront = null;
 
-				const matchedLead = matchedDiscounts.length ? codeToLead[ matchedDiscounts[ 0 ].code ] : null;
+					if( ! record.storefront ){
+
+						try {
+
+							const minted = await shopify.oauth.createStorefrontToken({
+								adminAccessToken : settings.accessToken,
+								shop
+							});
+
+							if( minted ) storefront = encrypt({ token : minted });
+
+						} catch ( _ ) {
+
+							// re-minted on a later add
+
+						}
 
-				const discount = matchedDiscounts.length
-					? {
-						amount : matchedDiscounts.reduce( ( sum, entry ) => sum + entry.amount, 0 ),
-						codes : matchedDiscounts
 					}
-					: null;
 
-				const matchedCodes = new Set( matchedDiscounts.map( ( entry ) => entry.code ) );
+					// LIVE SHOP METADATA. `source.id` is required for App Pricing
+					// commission billing. Best-effort again — a fetch miss links with
+					// whatever the shop record already held.
+					let currency = record?.currency || null;
+					let source = record?.source || null;
 
-				// A DB- code we minted that matched no lead. Logged rather than
-				// ignored: it means a code went out and its lead link was lost, which
-				// is revenue we cannot attribute and nobody would otherwise notice.
-				const unmatched = codes.filter( ( code ) => code.startsWith( 'DB-' ) && ! matchedCodes.has( code ) );
+					try {
 
-				if( unmatched.length ){
+						const shopData = await shopify.oauth.getShop({ adminAccessToken : settings.accessToken, shop });
 
-					logger?.warn?.( 'shopify.order.discount.unmatched', {
-						campaign : campaign || null,
-						codes : JSON.stringify( unmatched ),
-						isConversion : ! ! campaign,
-						orderId : String( orderId ),
-						organization
-					});
+						if( shopData ){
 
-				}
+							currency = String( shopData.currency || '' ).toLowerCase() || null;
+							source = { domain : shopData.myshopifyDomain, id : String( shopData.id ), label : shopData.name };
 
-				if( ( ! campaign && ! discount ) || ( backfill && ! discount ) ){
+						}
 
-					return {
-						message : backfill
-							? 'Order already recorded and no Drawbridge discount code matched — nothing to backfill.'
-							: 'Order has no Drawbridge attribution — not recording.',
-						request,
-						response : { skipped : true },
-						skipped : true
-					};
+					} catch ( _ ) {
 
-				}
+						// keep what the shop record had
 
-				let advertisementId = null;
-				let affiliateId = null;
-				let campaignOrganization = organization;
-				let gross = 0;
-				let leadId = null;
-				let lines = [];
-				let orderCampaign = null;
-				let pageId = null;
+					}
 
-				const isConversion = ! ! campaign;
+					// A STORE SETTLING OUTSIDE THE BILLING-FX SET would fail the
+					// connection validator INSIDE the transaction below, which surfaces
+					// as an opaque 500. Said plainly here instead. `currencies` is
+					// injected rather than imported: which currencies Drawbridge can bill
+					// is not a fact about Shopify.
+					if( currency && currencies && ! currencies.includes( currency ) ){
 
-				const customerPhone = toE164( orderCustomer?.phone || phone ) || null;
+						throw refusal( 'This store settles in a currency we can\'t bill yet. Connect a store with a supported settlement currency.', 422 );
 
-				const matchPhones = [ ...new Set([
-					customerPhone,
-					toE164( context?.billing_address?.phone ),
-					toE164( context?.shipping_address?.phone )
-				].filter( Boolean ) ) ];
+					}
+
+					// THE CONNECTION'S ID, KNOWN BEFORE THE WRITE THAT CREATES IT,
+					// because the organization's own refs have to name it inside the same
+					// transaction. An existing connection already has one.
+					const minted = org.connection?.id ? null : mintId();
+					const connectionId = org.connection?.id || minted.id;
+
+					return {
+						message : 'Connected ' + org.name + ' to ' + shop + '.',
+						request : { organization, shop },
+						result : { ok : true },
+						transaction : true,
+						writes : [
+							...( storefront ? [ {
+								collection : 'shop',
+								data : { $set : { storefront } },
+								operation : 'update',
+								query : { shop }
+							} ] : [] ),
+							{
+								collection : 'connection',
+								data : {
+									$set : {
+										currency,
+										errors : [],
+										// The token of record lives on the shared `shop` row; this
+										// is the pointer that satisfies the required `settings`
+										// string, and `auth.install.shared` declares how to read it.
+										settings : encrypt({ ref : 'shop', shop }),
+										shop,
+										status : 'pending',
+										...( source && { source })
+									},
+									$setOnInsert : {
+										...( minted && { _id : minted._id, id : minted.id }),
+										feature : 'organization:connection:shopify',
+										organization,
+										slug : 'shopify'
+									}
+								},
+								operation : 'update',
+								options : { upsert : true },
+								query : { organization, slug : 'shopify' }
+							},
+							{
+								collection : 'organization',
+								data : {
+									// $addToSet UNCONDITIONALLY. The route this replaces only
+									// registered the refs when the upsert INSERTED, which meant an
+									// org whose refs had drifted stayed drifted through every
+									// re-link. Adding a member that is already there is a no-op,
+									// so doing it every time costs nothing and repairs the drift.
+									$addToSet : {
+										'connections.groups' : 'ecommerce',
+										'connections.ids' : connectionId,
+										'connections.keys' : 'shopify'
+									},
+									$set : { billingProvider : 'shopify' }
+								},
+								operation : 'update',
+								query : { id : organization }
+							}
+						]
+					};
+
+				},
+
+				// WHAT THIS STORE CAN SEE: the linked merchant's organizations, the
+				// store's live plan, and the products the merchant has to act on.
+				//
+				// AN ORG CONNECTED TO A DIFFERENT STORE IS OMITTED ENTIRELY, because
+				// `add` would refuse it — a list that offers what the next call rejects
+				// is worse than a shorter one.
+				list : async ( { context }, { conversionRate, planTitle, read, shopify = client } = {} ) => {
+
+					const shop = sanitizeDomain( context?.shop );
 
-				if( isConversion ){
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-					const campaignDoc = await read.get({ collection : 'campaign', query : { id : campaign } });
+					const record = await read.get({ collection : 'shop', query : { shop } });
 
-					// THE CAMPAIGN MUST BELONG TO THE DELIVERING SHOP'S OWN ORG.
-					//
-					// `_drwbrdg_ca` is a line-item property, and on most Shopify themes
-					// a buyer can attach arbitrary line-item properties via cart
-					// permalinks or the AJAX cart API — and campaign ids are
-					// discoverable from public campaign links. Without this check, a $1
-					// order on ANY connected store carrying another org's campaign id
-					// records a conversion under that org: its revenue totals climb,
-					// its usage document is incremented, and its matching leads gain
-					// order counts — a cross-tenant write driven entirely by the buyer.
-					//
-					// A stale or garbage id lands here too, so this is also the null
-					// check: either way the order simply has no Drawbridge attribution.
-					if( ! campaignDoc || campaignDoc.organization !== organization ){
+					if( ! record?.user ){
 
 						return {
-							message : 'Order carried a campaign attribution that does not belong to this store — not recording.',
-							request,
-							response : { skipped : true },
-							skipped : true
+							message : 'No account linked to this store.',
+							request : { shop },
+							result : {
+								account : null,
+								connected : false,
+								organizations : [],
+								plan : { active : false, name : null },
+								unavailableProducts : [],
+								unavailableProductsTotal : 0
+							}
 						};
 
 					}
 
-					advertisementId = attrMap[ '_drwbrdg_ad' ] || advertisement || null;
-					affiliateId = attrMap[ '_drwbrdg_af' ] || null;
-					campaignOrganization = campaignDoc.organization;
-					gross = attributedGross;
-					lines = attributedLines;
-					orderCampaign = campaign;
-					pageId = attrMap[ '_drwbrdg_pg' ] || null;
-
-					// MATCHED ON EVERY IDENTITY WE HOLD, canonical forms included,
-					// because the address on an order is often not the one they entered
-					// with.
-					const identifiers = [];
+					const owned = await merchantOrganizations({ read, user : record.user });
+
+					const organizations = ( owned || [] )
+						.filter( ( org ) => ! org.connection || org.connection.shop === shop )
+						.map( ( org ) => ({
+							// The org's OWN billing status decides whether `add` accepts it.
+							// Sent up so the app can disable Connect and name the reason
+							// rather than letting the merchant click into a 403 —
+							// listed-but-blocked beats hidden, because an org vanishing from
+							// the list is indistinguishable from a bug.
+							billingStatus : org.billingStatus || null,
+							connectable : CONNECTABLE_STATUSES.includes( org.billingStatus ),
+							connected : Boolean( org.connection ),
+							conversion : conversionRate( org.subscription ),
+							id : org.id,
+							name : org.name,
+							plan : planTitle( org.subscription ),
+							status : org.connection?.status || null
+						}) );
 
-					const canonicalEmail = toCanonicalEmail( email );
+					// PRODUCTS THE MERCHANT MUST ACT ON, for the app's publishing section
+					// — App Store 5.7.8 and 5.7.11: a sales channel reports its own
+					// publishing problems rather than pushing them to the product page.
+					// `status : 'inactive'` is exactly the set drawbridge-sync deactivated
+					// because the Storefront API could not see them. Scoped to THIS store,
+					// so one shop never sees another org's titles.
+					const connections = ( owned || [] )
+						.filter( ( org ) => org.connection?.shop === shop && org.connection.id )
+						.map( ( org ) => org.connection.id );
+
+					const [ account, plan, unavailable ] = await Promise.all([
+						read.get({ collection : 'user', query : { id : record.user } }),
+						storePlan({ record, shopify }),
+						connections.length
+							? read.aggregate({
+								collection : 'product',
+								pipeline : [
+									{ $match : { connections : { $in : connections }, 'source.domain' : shop, status : 'inactive' } },
+									// $facet so the app can name the first 25 AND report a
+									// truthful total: listing 25 of 40 under "25 products need
+									// attention" would understate the problem.
+									{
+										$facet : {
+											items : [ { $sort : { title : 1 } }, { $limit : 25 }, { $project : { _id : 0, id : 1, title : 1 } } ],
+											total : [ { $count : 'count' } ]
+										}
+									}
+								]
+							})
+							: []
+					]);
 
-					if( email ) identifiers.push({ email : email.toLowerCase() });
-					if( canonicalEmail ) identifiers.push({ 'canonical.email.value' : canonicalEmail });
-					if( matchPhones.length ) identifiers.push({ 'phone.number' : { $in : matchPhones } });
-					if( matchPhones.length ) identifiers.push({ 'canonical.phone.value' : { $in : matchPhones } });
+					const facet = ( unavailable || [] )[ 0 ] || {};
 
-					if( identifiers.length ){
+					// THE STAMP OVERLAYS THE BLIND PROBE. storePlan can only see line
+					// items, which managed pricing never populates — the truth-based
+					// verdict lives on the connections, written from Partner-ledger
+					// accrual by sync. A charge id is proof; an explicit null is billed
+					// orders with nothing accrued, which is what makes the banner render.
+					if( plan.active && plan.metered !== true ){
 
-						// Narrowed to the campaign first; an org-wide match is the
-						// fallback, because a buyer who entered a different campaign is
-						// still the same person and still worth linking.
-						const lead = await read.get({
-							collection : 'lead',
-							query : {
-								campaigns : { $in : [ campaign ] },
-								organization : campaignOrganization,
-								$or : identifiers
-							}
+						const stamped = await read.aggregate({
+							collection : 'connection',
+							pipeline : [
+								{ $match : { shop, slug : 'shopify' } },
+								{ $project : { _id : 0, 'source.metered' : 1 } }
+							]
 						});
 
-						leadId = lead?.id || null;
-
-						if( ! leadId ){
+						const verdicts = ( stamped || [] ).map( ( row ) => row?.source?.metered );
 
-							const orgLead = await read.get({
-								collection : 'lead',
-								query : { organization : campaignOrganization, $or : identifiers }
-							});
+						if( verdicts.some( ( verdict ) => typeof verdict === 'string' ) ) plan.metered = true;
+						else if( verdicts.some( ( verdict ) => verdict === null ) ) plan.metered = false;
 
-							leadId = orgLead?.id || null;
+					}
 
+					return {
+						message : organizations.length + ' organization(s) for this store.',
+						request : { shop },
+						result : {
+							account : { email : account?.email || null },
+							connected : true,
+							organizations,
+							plan,
+							unavailableProducts : ( facet.items || [] ).map( ( product ) => ({
+								id : product.id,
+								title : product.title || 'Untitled product'
+							}) ),
+							// The total can exceed the 25 listed above, and has to.
+							unavailableProductsTotal : ( facet.total || [] )[ 0 ]?.count || 0
 						}
+					};
 
-					}
+				},
 
-				} else {
+				// DISCONNECT ONE ORGANIZATION. The connection is deleted and nothing
+				// else: every dependent — products, ads, steps, workflows, and the org's
+				// own connection refs — is torn down by drawbridge-sync's connection
+				// change stream. The shared token and the other orgs are untouched.
+				remove : async ( { context }, { read } = {} ) => {
 
-					// REDEMPTION. The lead is known from the code, and the whole order
-					// counts as gross — there are no tagged lines to narrow it to.
-					leadId = matchedLead.id;
-					orderCampaign = ( matchedLead.campaigns || [] ).length === 1 ? matchedLead.campaigns[ 0 ] : null;
-					gross = lineItems.reduce( ( sum, item ) => {
+					const organization = context?.organization;
+					const shop = sanitizeDomain( context?.shop );
 
-						const line = toLine( item );
+					if( ! shop ) throw refusal( 'shop is required', 400 );
+					if( ! organization ) throw refusal( 'organization is required', 400 );
 
-						return sum + ( line.price * line.quantity );
+					const record = await read.get({ collection : 'shop', query : { shop } });
 
-					}, 0 );
-					lines = lineItems.map( toLine );
+					if( ! record?.user ) throw refusal( 'Account is not connected for this store', 409 );
 
-				}
+					// The same gate as `add`: whoever drives the Shopify admin acts as
+					// the linked account, and removes only orgs that account can manage.
+					const owned = await merchantOrganizations({ read, user : record.user });
 
-				const org = await read.get({ collection : 'organization', query : { id : campaignOrganization } });
+					if( ! ( owned || [] ).some( ( entry ) => entry.id === organization ) ){
 
-				let rate = 0;
+						throw refusal( 'No access to this organization', 403 );
 
-				// THE FEE IS THE CONVERSION FEE, and only a conversion carries one. A
-				// redemption is associative — we cannot claim we caused the purchase —
-				// so it is recorded fee-free.
-				//
-				// `conversionRate` IS INJECTED rather than imported, and that is not
-				// ceremony. This file used to `import { conversionRate } from
-				// '../../plans.js'`, which made a VENDOR MANIFEST depend on
-				// DRAWBRIDGE'S PLAN CATALOGUE — backwards, and a genuine import cycle
-				// (features -> connections -> shopify -> plans -> features) that no
-				// derived feature list could be added around. What a merchant is
-				// charged is Drawbridge's business, not Shopify's; the manifest reads
-				// the subscription and asks.
-				if( isConversion ){
+					}
 
-					const subscription = await read.get({ collection : 'subscription', query : { id : org?.subscription } });
+					const connection = await read.get({
+						collection : 'connection',
+						query : { organization, shop, slug : 'shopify' }
+					});
 
-					rate = conversionRate( subscription );
+					if( ! connection ) throw refusal( 'No connection to remove', 404 );
+
+					return {
+						message : 'Disconnected.',
+						request : { organization, shop },
+						result : { ok : true },
+						writes : [ { collection : 'connection', operation : 'delete', query : { id : connection.id } } ]
+					};
 
 				}
 
-				const fee = isConversion ? Math.round( gross * rate ) / 100 : 0;
-				const net = Math.round( ( gross - fee ) * 100 ) / 100;
+			},
 
-				const currencyCode = ( currency || 'usd' ).toLowerCase();
-				const purchasedAt = new Date( createdAt || Date.now() );
+			plan : {
+
+				// RELEASE EVERY ACTIVE APPROVAL. The App Home then re-checks the plan
+				// and falls back to "Choose a plan".
+				cancel : ( { context }, { read, shopify = client } = {} ) => releaseApprovals({ context, read, shopify }),
+
+				// ONE ATTRIBUTED ORDER'S USAGE CHARGE. Enqueued per conversion by the
+				// order step and run on a retrying queue, so this may be called
+				// several times for one order — which is safe because the idempotency
+				// key is PERMANENT for billing events and Shopify settles the repeat.
+				//
+				// THE HANDLE IS CHECKED AGAINST THE MANIFEST'S OWN DECLARATION, which
+				// is a real strengthening of what it replaced: drawbridge-sync compared
+				// the job's `handle` against the job's `transaction` — two fields from
+				// the same enqueuer, so a drifted enqueuer agreed with itself. The
+				// handle is the one string that decides whether the event bills at all,
+				// and this is the file that publishes it.
+				//
+				// REFUSE BEFORE SENDING, because sending burns the order's PERMANENT
+				// idempotency key on an event that misclassifies or mistraces. The
+				// throw rides the queue's normal retry path and the abandoned-job alert
+				// pages on exhaustion.
+				//
+				// DELIBERATELY NO TIMESTAMP. sendAppEvent defaults to the SEND time,
+				// which is always inside the merchant's current billing cycle at the
+				// moment of sending and so can never hit PERIOD_CLOSED. Pinning the
+				// purchase time reads more correct and is strictly worse: a retry
+				// backoff crossing a cycle boundary would carry a closed-cycle
+				// timestamp, Shopify would 202-accept, silently drop it, and the
+				// commission would be lost. Send-time's worst case is benign — the
+				// charge lands in the next cycle, but it lands.
+				charge : async ( { clientId, clientSecret, context, manifest }, { shopify = client } = {} ) => {
+
+					const { idempotencyKey, order, orderId, rate, revision, shopId, timestamp, transaction, value } = context || {};
+
+					// THE MANIFEST'S HANDLE, unless an operator overrode it on the
+					// provider row — which is the same precedence the automatic path
+					// mints against, and the recovery migration is the only caller that
+					// can supply one. The GUARD holds either way: whichever handle is
+					// in force, the transaction has to carry it, which is what keeps
+					// the event's classifier and its trace id telling one story.
+					const handle = context?.handle || manifest.auth.install.billing.handle;
+
+					if( ! transaction || ! String( transaction ).startsWith( handle + '.' ) ){
+
+						throw new Error( 'shopify.usage.billing.handle.mismatch on order ' + orderId + ': transaction '
+							+ ( transaction || 'null' ) + ' does not carry handle ' + handle + ' — refusing to send' );
 
-				const customer = ( orderCustomer || email || phone )
-					? {
-						acceptsMarketing : orderCustomer?.email_marketing_consent?.state
-							? orderCustomer.email_marketing_consent.state === 'subscribed'
-							: ( typeof orderCustomer?.accepts_marketing === 'boolean' ? orderCustomer.accepts_marketing : null ),
-						email : orderCustomer?.email || email || null,
-						firstName : orderCustomer?.first_name || null,
-						id : orderCustomer?.id ? String( orderCustomer.id ) : null,
-						lastName : orderCustomer?.last_name || null,
-						phone : customerPhone
 					}
-					: null;
 
-				const source = connection?.source
-					? { domain : connection.source.domain, id : connection.source.id }
-					: undefined;
+					await shopify.billing.sendAppEvent({
+						clientId,
+						clientSecret,
+						eventHandle : handle,
+						idempotencyKey,
+						// The Shopify-side event record names the order that produced it.
+						reference : transaction,
+						// OPERATOR-ONLY, BOTH OF THEM, and absent on every automatic
+						// send. `revision` suffixes the idempotency key, which is what
+						// makes a second attempt possible once a key has been consumed;
+						// the encoding is owned by sendAppEvent so no caller builds keys
+						// itself. `timestamp` pins the PURCHASE time, which the automatic
+						// path must never do — see the note above — and the recovery
+						// migration must, because it is resending orders from a closed
+						// window and bounds its own run to the merchant's current cycle.
+						...( revision && { revision }),
+						...( timestamp && { timestamp }),
+						shopId,
+						value
+					});
 
-				// EVERY PURCHASE GETS AN ORDER DOCUMENT, whichever way it reached us.
+					return {
+						message : 'Usage charge sent for order ' + orderId + '.',
+						request : { order : order || null, orderId : orderId || null, shopId : shopId || null, value },
+						result : { transaction : String( transaction ) },
+						// TRACEABILITY. The App Events API returns no event id, so the
+						// trace key into Shopify's event logs is the transaction id the
+						// commerce.order hook minted and this sent as `reference`.
+						// `amount` is the per-order usage value in cents, mirroring the
+						// Stripe path's marker.
+						...( order && { writes : [ {
+							collection : 'order',
+							data : {
+								$set : {
+									billed : {
+										amount : value,
+										date : new Date(),
+										rate : rate || 0,
+										transaction : String( transaction )
+									}
+								}
+							},
+							operation : 'update',
+							query : { id : order }
+						} ] })
+					};
+
+				},
+
+				// RESELECT, NOT CANCEL. The same mechanics — the current approval has to
+				// be released before the pricing page will offer the plan again — but
+				// the intent is a thirty-second round trip rather than a departure.
 				//
-				// A redemption used to write only a redemption row, which meant the
-				// money existed on the Redemptions page and nowhere else: contact
-				// totals are summed from the ORDER collection, so a real purchase by a
-				// known entrant contributed nothing to their revenue and was invisible
-				// to every revenue segment. `type` keeps the two kinds apart for the
-				// figures that must stay causal (the fee, the Revenue page's
-				// conversion column) without splitting the source of truth in two.
-				const createsOrder = ! backfill && ( isConversion || Boolean( discount ) );
+				// `mark` IS A DECLARED CAPABILITY, and this is the only slot here that
+				// needs one. The marker has to be persisted BEFORE the approval is
+				// released: it is what tells sync's CANCELLED handler to hold the pause
+				// — no connection error, no owner email — and start a timed recheck that
+				// pauses honestly if the merchant abandons. A described write lands
+				// after the hook returns, which is after the cancel, and a marker
+				// written then can race the very webhook it exists to soften. Same
+				// precedent as `resolveContact`: the one write a description cannot
+				// carry.
+				reselect : async ( { context }, { mark, read, shopify = client } = {} ) => {
 
-				// MINTED HERE, because the redemption names its order and the usage
-				// job names both — a description cannot read a write's result, so the
-				// id exists before either does. Minted for the redemption too, so the
-				// order can name it back.
-				// MINTED AS A PAIR. `mintId` hands back both halves — the driver's `_id` and
-				// its string `id` — because this package has no mongodb dependency and
-				// cannot construct one. The string is what every reference below uses; the
-				// `_id` goes on the create so the document is born with the pair the
-				// controller would otherwise derive.
-				const mintedOrder = ! existingOrder?.id && createsOrder ? mintId() : null;
+					const shop = sanitizeDomain( context?.shop );
 
-				const orderDocId = existingOrder?.id || mintedOrder?.id || null;
-				const mintedRedemption = discount ? mintId() : null;
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-				const redemptionDocId = mintedRedemption?.id || null;
+					await mark({ shop });
 
-				const writes = [];
+					return releaseApprovals({ context, read, shopify });
 
-				if( createsOrder ){
+				},
 
-					writes.push({
-						collection : 'order',
-						data : {
-							advertisement : advertisementId,
-							affiliate : affiliateId,
-							campaign : orderCampaign,
-							currency : currencyCode,
-							customer,
-							discount,
-							fee,
-							gross,
-							_id : mintedOrder?._id,
-							id : orderDocId,
-							lead : leadId,
-							lines,
-							net,
-							organization : campaignOrganization,
-							page : pageId,
-							provider : { id : String( orderId ), slug : 'shopify' },
-							purchasedAt,
-							rate,
-							// Null on a conversion that matched no code of ours; the
-							// backfill branch below sets it when one arrives later.
-							redemption : redemptionDocId,
-							source,
-							status : 'completed',
-							type : isConversion ? 'conversion' : 'redemption'
-						},
-						operation : 'create'
-					});
+				// IS THIS STORE'S ORDER BILLING ACTUALLY METERED? Not a merchant
+				// action — the other two slots here are — but the same subject, and
+				// the reason it is a declared hook rather than a helper is that the
+				// answer was being derived in two places: `lifecycle.health` below,
+				// and drawbridge-sync's app_subscriptions/update handler, whose copy
+				// stated in its own comment that it matched this one and did not.
+				//
+				// THREE ANSWERS, and the caller must keep them apart:
+				//
+				//   a string     PROVEN. The charge id or usage line id, stamped on
+				//                the connection as the evidence.
+				//   null         PROBED, and nothing is accruing.
+				//   undefined    NO VERDICT — the probe could not run. `probed` says
+				//                which, because undefined does not survive JSON.
+				verify : async ( { context }, { adminToken, read, shopify = client } = {} ) => {
 
-					if( org?.usage ){
+					const shop = sanitizeDomain( context?.shop );
 
-						writes.push({
-							collection : 'usage',
-							// TWO METERS, NOT ONE SUMMED. `revenue` has always meant
-							// conversion revenue and is the figure the fee is charged
-							// against, so redemption money gets its own key rather than
-							// changing what an existing number means.
-							data : { $inc : isConversion
-								? { 'totals.revenue' : gross }
-								: { 'totals.redemptionRevenue' : gross }
-							},
-							operation : 'update',
-							query : { id : org.usage }
-						});
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-					}
+					const adminAccessToken = await adminToken();
 
-					if( leadId ){
+					if( ! adminAccessToken ){
 
-						writes.push({
-							collection : 'lead',
-							// Same grouped shape the contact carries, so a lead and the
-							// contact built from it cannot be read two different ways.
-							data : { $inc : {
-								'totals.orders.total' : 1,
-								...( isConversion
-									? { 'totals.orders.conversions' : 1 }
-									: { 'totals.orders.redemptions' : 1 }
-								)
-							} },
-							operation : 'update',
-							options : { bypassDocumentValidation : true },
-							query : { id : leadId }
-						});
+						return { message : 'No admin token for this store — no verdict.', request : { shop }, result : { metered : null, probed : false }, skipped : true };
 
 					}
 
-				}
-
-				if( discount ){
+					const partnerRow = read?.get ? await read.get({ collection : 'provider', query : { slug : 'shopify' } }) : null;
+					const partner = partnerRow?.settings ? decrypt( partnerRow.settings ) : {};
 
-					writes.push({
-						collection : 'redemption',
-						data : {
-							advertisement : advertisementId,
-							affiliate : affiliateId,
-							campaign : orderCampaign,
-							code : matchedDiscounts[ 0 ]?.code || null,
-							currency : currencyCode,
-							customer,
-							discount,
-							gross,
-							_id : mintedRedemption?._id,
-							id : redemptionDocId,
-							lead : leadId,
-							order : orderDocId,
-							organization : campaignOrganization,
-							page : pageId,
-							provider : { id : String( orderId ), slug : 'shopify' },
-							purchasedAt,
-							source,
-							status : 'completed'
-						},
-						operation : 'create'
+					const { ledger, metered } = await meterVerdict({
+						adminAccessToken,
+						ledgerFloor : new Date( Date.now() - LEDGER_WINDOW_MS ),
+						partner,
+						shop,
+						shopId : context?.shopId || null,
+						shopify
 					});
 
-					if( org?.usage ){
+					return {
+						message : typeof metered === 'string' ? 'Billing is metered.' : 'No meter evidence for this store.',
+						request : { shop },
+						// `probed` is the LEDGER, not the call: a store whose Partner
+						// credentials are absent was not asked, and reporting that as
+						// "probed, nothing accruing" would stamp an unmetered verdict on
+						// a store nobody looked at.
+						result : { metered : metered ?? null, probed : ledger || typeof metered === 'string' }
+					};
 
-						writes.push({
-							collection : 'usage',
-							data : { $inc : { 'totals.redemptions' : 1 } },
-							operation : 'update',
-							query : { id : org.usage }
-						});
+				}
 
-					}
+			},
 
-					if( leadId ){
+			// THE EMBEDDED APP'S SESSION STORE. The @shopify/shopify-app library
+			// persists the offline session on token exchange and refresh; it lives
+			// encrypted on the shared `shop` record, which is the same row every
+			// organization's connection to this store points at.
+			session : {
 
-						writes.push({
-							collection : 'lead',
-							data : { $inc : { 'totals.redemptions' : 1 } },
-							operation : 'update',
-							options : { bypassDocumentValidation : true },
-							query : { id : leadId }
-						});
+				// SOFT-CLEAR, NEVER A DELETE. The library calls this on session
+				// invalidation and not only on uninstall, so hard-deleting the record
+				// would orphan every org connection pointing at it — token resolution
+				// silently nulls — and destroy the durable account link and the
+				// storefront token with it. The next embedded load re-runs token
+				// exchange. The full record delete belongs to the uninstall webhook.
+				clear : async ({ context }) => {
 
-					}
+					const shop = sanitizeDomain( context?.shop );
 
-					// THE BACKFILL LEG: a conversion recorded earlier, matched to one of
-					// our codes now. The order already exists, so nothing above created
-					// it and nothing has told it which redemption it belongs to — this
-					// is the only write that closes that link. Skipped when the order
-					// was created in this same run, because it was minted carrying the
-					// id already.
-					if( backfill && orderDocId && redemptionDocId ){
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-						writes.push({
-							collection : 'order',
-							data : { $set : { redemption : redemptionDocId } },
+					return {
+						message : 'Session cleared.',
+						request : { shop },
+						result : { ok : true },
+						writes : [ {
+							collection : 'shop',
+							data : { $set : { settings : null } },
 							operation : 'update',
-							query : { id : orderDocId }
-						});
+							query : { shop }
+						} ]
+					};
 
-					}
+				},
 
-				}
+				read : async ( { context }, { read } = {} ) => {
 
-				// SHOPIFY-BILLED ORGS ARE CHARGED THROUGH SHOPIFY, keyed on the order
-				// id so a redelivery cannot charge twice. Never on a backfill: the fee
-				// was charged when the order was first recorded. Enqueues run after
-				// the transaction commits, so the job can never observe rows that
-				// roll back.
-				const billable = org?.billingProvider === 'shopify' && fee > 0 && ! backfill;
+					const shop = sanitizeDomain( context?.shop );
 
-				// THE EFFECTIVE METER HANDLE. The provider row's orderEventHandle
-				// (admin-editable, for the day the plan config's meter changes)
-				// overrides the built-in default; slugified again on read as belt
-				// and braces with the save-side formatter, since a drifted stored
-				// value would mint transactions no meter classifies. Read directly
-				// (not via providerSettings — that module imports this one) and
-				// only for a billable order, which keeps the cost off every
-				// ordinary redemption.
-				const providerRow = billable
-					? await read.get({ collection : 'provider', query : { slug : 'shopify' } })
-					: null;
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-				const { orderEventHandle } = providerRow?.settings ? decrypt( providerRow.settings ) : {};
+					const record = await read.get({ collection : 'shop', query : { shop } });
 
-				const handle = ( typeof orderEventHandle === 'string' && slugify( orderEventHandle ) ) || ORDER_EVENT_HANDLE;
+					if( ! record?.settings ) throw refusal( 'No session for this store', 404 );
 
-				// A billable order with no shop id is revenue lost SILENTLY — the
-				// gate below just yields no job, the order records normally, and the
-				// connection looks healthy. An Error (not a warn) because this is
-				// money: the order id goes in the MESSAGE, since Sentry matches
-				// titles, and the health check's source self-heal is what makes the
-				// state rare enough to page on.
-				if( billable && ! connection?.source?.id ){
+					return {
+						message : 'Session read.',
+						request : { shop },
+						result : { session : decrypt( record.settings ) }
+					};
 
-					logger?.error?.( new Error(
-						'shopify.usage.billing.skipped on order ' + orderId + ': '
-						+ Math.round( fee * 100 ) + ' cents not billed — connection '
-						+ connection?.id + ' has no source.id'
-					), {
-						extra : {
-							connectionId : connection?.id,
-							fee,
-							orderDocId,
-							orderId : String( orderId )
-						}
-					});
+				},
 
-				}
+				save : async ({ context }) => {
 
-				const enqueues = ( billable && connection?.source?.id )
-					? [ {
-						data : {
-							// The meter handle travels WITH the job so the sender can
-							// verify it against the transaction prefix and refuse a
-							// drifted pair — idempotency keys are permanent, so a
-							// mistraceable event can never be resent under its own key.
-							handle,
-							idempotencyKey : String( orderId ),
-							orderDocId,
-							orderId : String( orderId ),
-							rate,
-							shopId : connection.source.id,
-							// The App Events API returns no event id, so one is generated
-							// here — the event handle plus the order id — and sent as the
-							// event's `reference`. queue/usage.js stamps the same id onto
-							// the order as billed.transaction.
-							transaction : handle + '.' + orderId,
-							value : Math.round( fee * 100 )
-						},
-						name : 'billing',
-						options : { jobId : 'shopify.usage.' + orderId },
-						queue : 'usage'
-					} ]
-					: [];
+					const session = context?.session;
+					const shop = sanitizeDomain( session?.shop );
 
-				return {
-					enqueues,
-					message : backfill
-						? 'Redemption backfilled for an already-recorded order.'
-						: isConversion ? 'Order recorded.' : 'Discount redemption recorded (fee-free).',
-					request,
-					response : {
-						campaign : orderCampaign,
-						currency : currencyCode,
-						discount,
-						fee,
-						gross,
-						lead : leadId,
-						lines : lines.length,
-						net,
-						orderId : String( orderId )
-					},
-					// ONE TRANSACTION. The order, the redemption and both totals
-					// counters land together or not at all — a half-written attribution
-					// is revenue counted twice or not at all, and neither is
-					// recoverable by hand.
-					transaction : writes.length > 0,
-					writes
-				};
+					if( ! shop || ! session?.accessToken ) throw refusal( 'session.shop and session.accessToken are required', 400 );
+
+					return {
+						message : 'Session saved.',
+						request : { shop },
+						result : { ok : true },
+						writes : [ {
+							collection : 'shop',
+							data : {
+								$set : { settings : encrypt( session ), shop },
+								$setOnInsert : { status : 'pending' }
+							},
+							operation : 'update',
+							options : { upsert : true },
+							query : { shop }
+						} ]
+					};
+
+				}
 
 			},
 
-			// A PRODUCT CHANGED AT THE STORE. Upserts the product row and hands it to
-			// the product pipeline; the actual field sync happens there.
+			// THE LINK-TOKEN HANDOFF. The breakout callback runs top-level and can set
+			// a first-party cookie; the embedded App Home cannot read that cookie from
+			// inside the Shopify admin iframe. So the callback stashes the merchant's
+			// user token here keyed by shop, and App Home reads it once and clears it.
 			//
-			// The shell has already refused a missing or inactive Shopify connection,
-			// so what is left is the two things only this hook can know are wrong.
-			product : async ( { connection, context, workflow }, { mintId, read } = {} ) => {
+			// DURABLE RATHER THAN IN REDIS: a restart must not strand a merchant
+			// mid-handoff. Short-lived and encrypted.
+			token : {
 
-				const request = {
-					numericId : context?.id || null,
-					organizationId : workflow.organization,
-					title : context?.title || null
-				};
+				clear : async ({ context }) => {
 
-				if( ! context?.id ) return { message : 'Skipped — product webhook payload had no id.', request, response : { skipped : true }, skipped : true };
+					const shop = sanitizeDomain( context?.shop );
 
-				// The shop domain is half the identity below. Without it the upsert
-				// would match on provider id alone and could collide across stores.
-				if( ! connection.shop ) return { message : 'Skipped — Shopify connection is missing shop domain.', request, response : { skipped : true }, skipped : true };
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-				const providerId = 'gid://shopify/Product/' + context.id;
+					return {
+						message : 'Link token cleared.',
+						request : { shop },
+						result : { ok : true },
+						writes : [ {
+							collection : 'shop',
+							data : { $set : { linkToken : null, linkTokenExpiresAt : null } },
+							operation : 'update',
+							query : { shop }
+						} ]
+					};
 
-				// THE ROW'S OWN ID WHEN IT ALREADY EXISTS, a fresh one only when it
-				// does not.
-				//
-				// The write below is an upsert whose `id` sits in $setOnInsert, so a
-				// product we have seen before keeps the id it was first given and a
-				// newly minted one is silently discarded. Minting unconditionally
-				// therefore published an id belonging to no row: the enqueue named a
-				// product the worker then had to fall back off, and the step's
-				// response showed QA a value that matched nothing they could look up
-				// — which is exactly how it was reported.
-				//
-				// Reading first costs one indexed lookup on the same key the upsert
-				// matches. A concurrent redelivery can still have both runs miss and
-				// mint, which is why the job carries the PROVIDER identity too and the
-				// worker falls back to provider + shop — stable either way.
-				const query = {
-					'provider.id' : providerId,
-					'provider.slug' : 'shopify',
-					'source.domain' : connection.shop
-				};
+				},
 
-				const existing = read?.get ? await read.get({ collection : 'product', query }) : null;
+				read : async ( { context }, { read } = {} ) => {
 
-				const mintedProduct = existing?.id ? null : mintId();
+					const shop = sanitizeDomain( context?.shop );
 
-				const productId = existing?.id || mintedProduct.id;
+					if( ! shop ) throw refusal( 'shop is required', 400 );
 
-				return {
-					enqueues : [ {
-						data : { product : productId, providerId, shop : connection.shop },
-						name : 'workflow',
-						// The numeric id, not the gid: BullMQ refuses a custom id with a
-					// colon in it, and every gid carries two.
-					options : { jobId : 'product.workflow.shopify.' + context.id + '.' + Date.now() },
-						queue : 'product.shopify'
-					} ],
-					message : 'Product sync queued from Shopify webhook.',
-					request,
-					response : { productId, providerId, title : context?.title || null },
-					// KEYED ON PROVIDER + SHOP, so the same product in two stores stays
-					// two rows. `connections` accumulates rather than replaces: one
-					// store can be linked to several organizations, and each keeps its
-					// own claim on the row.
-					writes : [ {
-						collection : 'product',
-						data : {
-							$addToSet : { connections : connection.id },
-							$setOnInsert : {
-								...( mintedProduct && { _id : mintedProduct._id }),
-								id : productId,
-								provider : { id : providerId, slug : 'shopify' },
-								'source.id' : connection.id,
-								status : 'active'
-							}
-						},
-						operation : 'update',
-						options : { upsert : true },
-						query
-					} ]
-				};
+					const record = await read.get({ collection : 'shop', query : { shop } });
+
+					const expiresAt = record?.linkTokenExpiresAt ? new Date( record.linkTokenExpiresAt ) : null;
+
+					// EXPIRY IS CHECKED ON READ, not by a sweep. The token is one-shot
+					// and short-lived, so the read is the only moment anyone cares.
+					if( ! record?.linkToken || ! expiresAt || expiresAt <= new Date() ){
+
+						throw refusal( 'No link token for this store', 404 );
+
+					}
+
+					return {
+						message : 'Link token read.',
+						request : { shop },
+						result : { token : decrypt( record.linkToken )?.token ?? null }
+					};
+
+				},
+
+				save : async ({ context }) => {
+
+					const shop = sanitizeDomain( context?.shop );
+					const token = context?.token;
+
+					if( ! shop || ! token ) throw refusal( 'shop and token are required', 400 );
+
+					return {
+						message : 'Link token saved.',
+						request : { shop },
+						result : { ok : true },
+						writes : [ {
+							collection : 'shop',
+							data : {
+								$set : {
+									linkToken : encrypt({ token }),
+									linkTokenExpiresAt : new Date( Date.now() + LINK_TOKEN_TTL_MS )
+								}
+							},
+							operation : 'update',
+							query : { shop }
+						} ]
+					};
+
+				}
 
 			}
 
 		},
-		contacts : { remove : false, sync : false },
-
-		// The embedded-app surface. Only a vendor whose merchants arrive from its
-		// own app store has one.
-		install : false,
 
 		// Drawbridge sends its own notification email and SMS — see the private
 		// `drawbridge` manifest. A vendor answering these would be a second sender,
@@ -8731,7 +10646,7 @@ var shopify = {
 			// access token still works, reconciles the scopes the store granted
 			// against the ones the app now needs, and queues a webhook
 			// reconciliation.
-			health : async ( { connection, workflow }, { adminToken, logger, read, reconcileScopes, resolveSettings, rotateToken, shopify } = {} ) => {
+			health : async ( { connection, workflow }, { adminToken, logger, read, reconcileScopes, resolveSettings, rotateToken, shopify = client } = {} ) => {
 
 				const request = {
 					connectionId : workflow.connection,
@@ -8833,62 +10748,27 @@ var shopify = {
 
 						}
 
-						const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
-							adminAccessToken,
-							domain : connection.shop
-						});
-
-						// A usage line on the approval is POSITIVE evidence and gets
-						// stamped. Its ABSENCE proves nothing: measured 2026-09-04
-						// (both 2026-04 and unstable, against a plan whose meter
-						// exists), managed-pricing App-Events meters never
-						// materialize as subscription line items — AppUsagePricing is
-						// the legacy usage-charge model. Reading absence as
-						// "unmetered" flagged healthy stores, so absence is NO
-						// VERDICT: the stamp, the Issue, the card and the
-						// meter-missing pager all stay silent until a signal that can
-						// actually observe the meter exists (Partner API
-						// USAGE_CHARGE_APPLIED accrual events are that signal).
-						const usageLine = subscriptions.find( ( subscription ) => subscription.usageLineItemId )?.usageLineItemId;
-
-						if( usageLine ) metered = usageLine;
-
-						// THE REAL METER SIGNAL — Partner API accrual. A CHARGE_USAGE
-						// event for this shop is proof billing works: its charge id
-						// becomes the stamp (overriding the line-item probe, which
-						// managed pricing keeps blind), and each charge row is a
-						// billing BOUNDARY the reconciler below balances the books
-						// against. Off entirely until the provider row carries the
-						// credentials.
+						// ONE READING OF THE TWO SIGNALS, shared with the approval
+						// webhook in drawbridge-sync, which used to hand-copy it.
 						const partnerRow = read?.get ? await read.get({ collection : 'provider', query : { slug : 'shopify' } }) : null;
 						const partner = partnerRow?.settings ? decrypt( partnerRow.settings ) : {};
 
-						if( partner.partnerToken && partner.partnerOrgId && partner.partnerAppId && source?.id && shopify.partner?.getUsageChargeEvents ){
+						const ledgerFloor = new Date( Date.now() - LEDGER_WINDOW_MS );
 
-							const ledgerFloor = new Date( Date.now() - 30 * 24 * 60 * 60 * 1000 );
-
-							const accruals = await shopify.partner.getUsageChargeEvents({
-								appId : 'gid://shopify/App/' + partner.partnerAppId,
-								first : 10,
-								occurredAtMin : ledgerFloor.toISOString(),
-								organizationId : partner.partnerOrgId,
-								partnerToken : partner.partnerToken,
-								shopId : 'gid://shopify/Shop/' + source.id
-							});
+						const verdict = await meterVerdict({
+							adminAccessToken,
+							ledgerFloor,
+							partner,
+							shop : connection.shop,
+							shopId : source?.id,
+							shopify
+						});
 
-							// Oldest first: each charge row is a boundary that closes
-							// the window since the row before it.
-							const boundaries = accruals
-								.filter( ( event ) => event.occurredAt )
-								.sort( ( a, b ) => new Date( a.occurredAt ) - new Date( b.occurredAt ) );
+						if( verdict.metered !== undefined ) metered = verdict.metered;
 
-							// A usage ROW exists per subscription even before anything
-							// accrues (measured: a pre-meter approval shows qty 0), so
-							// the row is not the proof — a POSITIVE usageQuantity is.
-							// The LATEST positive row is the stamp.
-							const accrued = [ ...boundaries ].reverse().find( ( event ) => Number( event.usageQuantity ) > 0 );
+						const { boundaries } = verdict;
 
-							if( accrued ) metered = String( accrued.chargeId || accrued.id );
+						if( boundaries.length ){
 
 							// THE BOUNDARY RECONCILER. Money truth lives at boundaries:
 							// each charge row states what Shopify actually charged for
@@ -9227,13 +11107,13 @@ var shopify = {
 			// They are the same two questions every other vendor answers through
 			// resources.*, so they answer them the same way now.
 			//
-			// `shopify` is INJECTED: this package cannot import @drawbridge/shopify,
+			// `shopify` DEFAULTS to the client this file imports; nothing injects it,
 			// which depends on it. What arrives is the SDK's pure HTTP namespaces
 			// and nothing else — no controller, no collection access. Resolving the
 			// credential is the caller's job because it is Drawbridge's job: the
 			// admin token refreshes and writes itself back, which is service work,
 			// not vendor work.
-			products : async ( { cursor, limit = 100, search, settings, sort }, { shopify } = {} ) => {
+			products : async ( { cursor, limit = 100, search, settings, sort }, { shopify = client } = {} ) => {
 
 				const products = await shopify.storefront.getProducts({
 					cursor,
@@ -9258,7 +11138,7 @@ var shopify = {
 
 			},
 
-			promotions : async ( { cursor, limit = 100, search, settings }, { shopify } = {} ) => {
+			promotions : async ( { cursor, limit = 100, search, settings }, { shopify = client } = {} ) => {
 
 				const discounts = await shopify.admin.getDiscounts({
 					adminAccessToken : settings?.adminAccessToken,
@@ -9683,14 +11563,15 @@ var webhook = {
 			'Drawbridge can POST event payloads to your endpoint as activity happens in your account, so your own systems can react to it.',
 			'Generate a signing secret and Drawbridge signs every request with it. Your endpoint recomputes the signature to confirm each payload genuinely came from Drawbridge before acting on it.'
 		],
-		// NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-		// The dashboard already carries generic reasons for every way an
-		// authorization can fail — declined, expired state, a vendor we are not set
-		// up for — and a sentence here is an ADDITION to those, for a vendor whose
-		// failures need saying differently. This one's do not.
+		// THERE IS NO CONSENT SCREEN TO FAIL. Connecting mints a signing secret;
+		// nothing is authorized against a third party, so neither `denied` nor
+		// `invalid` has a state it could describe. The failures this connection
+		// really has are at DELIVERY — a merchant's endpoint refusing a POST — and
+		// those reach them through the connection's own errors rather than through
+		// connect copy.
 		//
-		// Answered rather than omitted, because `errors` existed on two of six
-		// manifests and there was no way to tell "nothing to add" from "nobody
+		// `false` is the recorded decision, not silence: `errors` existed on two of
+		// six manifests and there was no way to tell "nothing to add" from "nobody
 		// wrote it".
 		errors : false,
 		excerpt : 'Sign outgoing webhook payloads with an HMAC secret to verify authenticity.',
@@ -11925,4 +13806,4 @@ const resolveConnection = ( item, data, env = {} ) => {
 
 };
 
-export { tokenSettings as $, ANSWER_KEYS as A, hookSupport as B, isStale as C, isStatus as D, ERROR_SOURCES as E, mergeSettings as F, GROUPS as G, HOOKS as H, INPUTS as I, projectConnection as J, publicConnectionKeys as K, publicSettingsBySlug as L, redactSettings as M, resolveConnection as N, OAUTH_ENDPOINTS as O, PLATFORM_CREDENTIALS as P, runHook as Q, RETIRED as R, STATUSES as S, TRIGGERS as T, scopesMessage as U, stepLabels as V, WRITE_OPERATIONS as W, stepQueues as X, stepRoutes as Y, surviving as Z, systemSteps as _, AUTH_KINDS as a, vendors as a0, AUTH_TYPES as b, HOOK_CONFIG as c, HOOK_EFFECTS as d, HOOK_NAMES as e, HOOK_OPTIONS as f, HOOK_PROPS as g, HOOK_SLOT_PROPS as h, OAUTH_FIELDS as i, OUTCOMES as j, STEPS as k, STEP_TYPES as l, TRIGGER_TYPES as m, accessToken as n, answerOf as o, assess as p, availableConnections as q, build as r, buildVendor as s, catalogConnections as t, channels as u, connectFields as v, connectionSteps as w, connections as x, effectsOf as y, ensureSystemWorkflows as z };
+export { stepRoutes as $, ANSWER_KEYS as A, ensureSystemWorkflows as B, hookSupport as C, isStale as D, ERROR_SOURCES as E, isStatus as F, GROUPS as G, HOOKS as H, INPUTS as I, mergeSettings as J, perform as K, projectConnection as L, publicConnectionKeys as M, publicSettingsBySlug as N, OAUTH_ENDPOINTS as O, PLATFORM_CREDENTIALS as P, reconcileConnectionScopes as Q, RETIRED as R, STATUSES as S, TRIGGERS as T, redactSettings as U, resolveConnection as V, WRITE_OPERATIONS as W, runHook as X, scopesMessage as Y, stepLabels as Z, stepQueues as _, AUTH_KINDS as a, surviving as a0, systemSteps as a1, tokenSettings as a2, vendors as a3, AUTH_TYPES as b, HOOK_CONFIG as c, HOOK_EFFECTS as d, HOOK_NAMES as e, HOOK_OPTIONS as f, HOOK_PROPS as g, HOOK_SLOT_PROPS as h, OAUTH_FIELDS as i, OUTCOMES as j, STEPS as k, STEP_TYPES as l, TRIGGER_TYPES as m, accessToken as n, answerOf as o, assess as p, availableConnections as q, build as r, buildVendor as s, catalogConnections as t, channels as u, connectFields as v, connectionSettings as w, connectionSteps as x, connections as y, effectsOf as z };