@drawbridge/drawbridge-utils 0.0.176 → 0.0.177

package/dist/shopify/billing.js

@@ -0,0 +1,140 @@
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  // THE TRANSPORT, injectable and defaulted to the real one.
+  //
+  // Every other vendor client in this package takes a `fetcher` — it is how
+  // klaviyo, mailchimp and attentive are tested without a network, and it is a
+  // declared HOOK_OPTION. The Shopify client had no seam at all, so the only way
+  // to test a hook that used it was to inject the whole SDK namespace; that
+  // injection existed to work around an import cycle, and when the cycle went
+  // the tests lost their only hold. This is the seam they should have had.
+  fetcher = fetch,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetcher(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/shopify/constants.js
+var SHOPIFY_APP_API_VERSION = "unstable";
+var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || "2026-07";
+
+// lib/shopify/billing.js
+var APP_API = "https://api.shopify.com";
+var APP_API_VERSION = process.env.SHOPIFY_APP_API_VERSION || SHOPIFY_APP_API_VERSION;
+var cachedTokens = {};
+var fetchAppToken = async ({ clientId, clientSecret, fetcher }) => {
+  const data = await request({
+    fetcher,
+    method: "POST",
+    url: APP_API + "/auth/access_token",
+    body: {
+      client_id: clientId,
+      client_secret: clientSecret,
+      grant_type: "client_credentials"
+    }
+  });
+  if (!(data == null ? void 0 : data.access_token)) {
+    throw new Error("Shopify app token request failed: no access token returned");
+  }
+  ;
+  const ttl = data.expires_in ? data.expires_in * 1e3 : 60 * 60 * 1e3;
+  cachedTokens[clientId] = {
+    expiresAt: Date.now() + ttl - 60 * 1e3,
+    token: data.access_token
+  };
+  return data.access_token;
+};
+var getAppToken = async ({ clientId, clientSecret, fetcher }) => {
+  const cached = cachedTokens[clientId];
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.token;
+  }
+  ;
+  return fetchAppToken({ clientId, clientSecret, fetcher });
+};
+var toShopGid = (shopId) => String(shopId).startsWith("gid://") ? String(shopId) : "gid://shopify/Shop/" + shopId;
+var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference, revision, shopId, timestamp, value }) => {
+  if (!shopId || !eventHandle || !(Number(value) > 0)) {
+    throw new Error("sendAppEvent requires shopId, eventHandle, and a positive value");
+  }
+  ;
+  if (!clientId || !clientSecret) {
+    throw new Error("sendAppEvent requires clientId and clientSecret");
+  }
+  ;
+  const suffix = revision ? ".r" + revision : "";
+  const key = idempotencyKey && String(idempotencyKey).slice(0, Math.max(0, 64 - suffix.length)) + suffix;
+  const body = {
+    attributes: {
+      value: Number(value),
+      ...reference && {
+        reference: String(reference).slice(0, 128)
+      }
+    },
+    event_handle: eventHandle,
+    shop_id: toShopGid(shopId),
+    timestamp: timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    ...key && {
+      idempotency_key: key
+    }
+  };
+  const send = async (token) => request({
+    method: "POST",
+    url: APP_API + "/app/" + APP_API_VERSION + "/events",
+    headers: {
+      "Authorization": "Bearer " + token
+    },
+    body
+  });
+  try {
+    return await send(await getAppToken({ clientId, clientSecret, fetcher }));
+  } catch (error) {
+    if ((error == null ? void 0 : error.status) === 401) {
+      delete cachedTokens[clientId];
+      return send(await fetchAppToken({ clientId, clientSecret, fetcher }));
+    }
+    ;
+    throw error;
+  }
+};
+export {
+  sendAppEvent
+};

package/dist/shopify/constants.cjs

@@ -0,0 +1,63 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/shopify/constants.js
+var constants_exports = {};
+__export(constants_exports, {
+  ACCESS_TOKEN_REFRESH_BUFFER_MS: () => ACCESS_TOKEN_REFRESH_BUFFER_MS,
+  PARTNER_API_VERSION: () => PARTNER_API_VERSION,
+  REFRESH_TOKEN_LIFETIME_MS: () => REFRESH_TOKEN_LIFETIME_MS,
+  SHOPIFY_ADMIN_API_VERSION: () => SHOPIFY_ADMIN_API_VERSION,
+  SHOPIFY_APP_API_VERSION: () => SHOPIFY_APP_API_VERSION,
+  SHOPIFY_REQUIRED_SCOPES: () => SHOPIFY_REQUIRED_SCOPES,
+  SHOPIFY_STOREFRONT_API_VERSION: () => SHOPIFY_STOREFRONT_API_VERSION,
+  SHOPIFY_USAGE_ORDERS_EVENT_HANDLE: () => SHOPIFY_USAGE_ORDERS_EVENT_HANDLE
+});
+module.exports = __toCommonJS(constants_exports);
+var SHOPIFY_STOREFRONT_API_VERSION = "2025-01";
+var SHOPIFY_ADMIN_API_VERSION = "2026-04";
+var SHOPIFY_APP_API_VERSION = "unstable";
+var SHOPIFY_USAGE_ORDERS_EVENT_HANDLE = "drawbridge-orders";
+var SHOPIFY_REQUIRED_SCOPES = [
+  "read_customers",
+  "write_customers",
+  "read_discounts",
+  "write_discounts",
+  "read_orders",
+  "read_products",
+  "read_publications",
+  "write_resource_feedbacks",
+  "unauthenticated_read_checkouts",
+  "unauthenticated_read_product_inventory",
+  "unauthenticated_read_product_listings",
+  "unauthenticated_write_checkouts"
+];
+var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || "2026-07";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ACCESS_TOKEN_REFRESH_BUFFER_MS,
+  PARTNER_API_VERSION,
+  REFRESH_TOKEN_LIFETIME_MS,
+  SHOPIFY_ADMIN_API_VERSION,
+  SHOPIFY_APP_API_VERSION,
+  SHOPIFY_REQUIRED_SCOPES,
+  SHOPIFY_STOREFRONT_API_VERSION,
+  SHOPIFY_USAGE_ORDERS_EVENT_HANDLE
+});

package/dist/shopify/constants.d.cts

@@ -0,0 +1,58 @@
+// Shopify API versions — both endpoints follow the same versioning
+// calendar. Bumping these is the single touch-point when migrating to a
+// new quarterly release.
+const SHOPIFY_STOREFRONT_API_VERSION = '2025-01';
+// Admin pinned to 2026-04: the GraphQL webhook + discount + storefront-token
+// operations were schema-validated against this version (and the app config's
+// webhooks api_version matches it).
+const SHOPIFY_ADMIN_API_VERSION = '2026-04';
+
+// App Events API (api.shopify.com) — app-level billing/usage events for
+// Shopify App Pricing. Versioned separately from the shop-scoped APIs above.
+//
+// MUST STAY 'unstable' — DO NOT pin to a dated version. Meter billing is not GA
+// (Darren, 2026-08-25): the stable App Events versions do not carry it, and
+// Shopify's generic "never use unstable in production" advice does not apply
+// here. Pinning silently kills usage billing with a failure mode that is
+// indistinguishable from a missing meter — events still 202, still log as plain
+// APP_EVENT, and nothing accrues. Revisit only when Shopify announces meter
+// billing GA. Env-overridable (SHOPIFY_APP_API_VERSION) for that day.
+const SHOPIFY_APP_API_VERSION = 'unstable';
+
+// The App Pricing usage meter handle the order-conversion commission is billed
+// against. Fixed app identity (not env-specific) — the Partner Dashboard usage
+// meter must be created with this exact handle to turn these events into usage
+// charges.
+const SHOPIFY_USAGE_ORDERS_EVENT_HANDLE = 'drawbridge-orders';
+
+// The canonical scope list every install must have granted. CONTRACT: keep in
+// lockstep with [access_scopes] in drawbridge-shopify-app's shopify.app.*.toml
+// (both files) — a scope added there but not here silently escapes the
+// permissions-outdated check (oauth.js missingScopes). Shopify normalizes
+// grants (write_foo implies read_foo, which then never appears in the granted
+// string); the diff helper accounts for that, so list scopes here exactly as
+// the toml requests them.
+const SHOPIFY_REQUIRED_SCOPES = [
+	'read_customers',
+	'write_customers',
+	'read_discounts',
+	'write_discounts',
+	'read_orders',
+	'read_products',
+	'read_publications',
+	'write_resource_feedbacks',
+	'unauthenticated_read_checkouts',
+	'unauthenticated_read_product_inventory',
+	'unauthenticated_read_product_listings',
+	'unauthenticated_write_checkouts'
+];
+
+// Token lifecycle constants used by oauth.js.
+const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
+const ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+
+// The Partner API version the usage-charge accrual reader speaks.
+// Env-overridable for the same reason as the App Events version.
+const PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || '2026-07';
+
+export { ACCESS_TOKEN_REFRESH_BUFFER_MS, PARTNER_API_VERSION, REFRESH_TOKEN_LIFETIME_MS, SHOPIFY_ADMIN_API_VERSION, SHOPIFY_APP_API_VERSION, SHOPIFY_REQUIRED_SCOPES, SHOPIFY_STOREFRONT_API_VERSION, SHOPIFY_USAGE_ORDERS_EVENT_HANDLE };

package/dist/shopify/constants.d.ts

@@ -0,0 +1,58 @@
+// Shopify API versions — both endpoints follow the same versioning
+// calendar. Bumping these is the single touch-point when migrating to a
+// new quarterly release.
+const SHOPIFY_STOREFRONT_API_VERSION = '2025-01';
+// Admin pinned to 2026-04: the GraphQL webhook + discount + storefront-token
+// operations were schema-validated against this version (and the app config's
+// webhooks api_version matches it).
+const SHOPIFY_ADMIN_API_VERSION = '2026-04';
+
+// App Events API (api.shopify.com) — app-level billing/usage events for
+// Shopify App Pricing. Versioned separately from the shop-scoped APIs above.
+//
+// MUST STAY 'unstable' — DO NOT pin to a dated version. Meter billing is not GA
+// (Darren, 2026-08-25): the stable App Events versions do not carry it, and
+// Shopify's generic "never use unstable in production" advice does not apply
+// here. Pinning silently kills usage billing with a failure mode that is
+// indistinguishable from a missing meter — events still 202, still log as plain
+// APP_EVENT, and nothing accrues. Revisit only when Shopify announces meter
+// billing GA. Env-overridable (SHOPIFY_APP_API_VERSION) for that day.
+const SHOPIFY_APP_API_VERSION = 'unstable';
+
+// The App Pricing usage meter handle the order-conversion commission is billed
+// against. Fixed app identity (not env-specific) — the Partner Dashboard usage
+// meter must be created with this exact handle to turn these events into usage
+// charges.
+const SHOPIFY_USAGE_ORDERS_EVENT_HANDLE = 'drawbridge-orders';
+
+// The canonical scope list every install must have granted. CONTRACT: keep in
+// lockstep with [access_scopes] in drawbridge-shopify-app's shopify.app.*.toml
+// (both files) — a scope added there but not here silently escapes the
+// permissions-outdated check (oauth.js missingScopes). Shopify normalizes
+// grants (write_foo implies read_foo, which then never appears in the granted
+// string); the diff helper accounts for that, so list scopes here exactly as
+// the toml requests them.
+const SHOPIFY_REQUIRED_SCOPES = [
+	'read_customers',
+	'write_customers',
+	'read_discounts',
+	'write_discounts',
+	'read_orders',
+	'read_products',
+	'read_publications',
+	'write_resource_feedbacks',
+	'unauthenticated_read_checkouts',
+	'unauthenticated_read_product_inventory',
+	'unauthenticated_read_product_listings',
+	'unauthenticated_write_checkouts'
+];
+
+// Token lifecycle constants used by oauth.js.
+const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
+const ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+
+// The Partner API version the usage-charge accrual reader speaks.
+// Env-overridable for the same reason as the App Events version.
+const PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || '2026-07';
+
+export { ACCESS_TOKEN_REFRESH_BUFFER_MS, PARTNER_API_VERSION, REFRESH_TOKEN_LIFETIME_MS, SHOPIFY_ADMIN_API_VERSION, SHOPIFY_APP_API_VERSION, SHOPIFY_REQUIRED_SCOPES, SHOPIFY_STOREFRONT_API_VERSION, SHOPIFY_USAGE_ORDERS_EVENT_HANDLE };

package/dist/shopify/constants.js

@@ -0,0 +1,32 @@
+// lib/shopify/constants.js
+var SHOPIFY_STOREFRONT_API_VERSION = "2025-01";
+var SHOPIFY_ADMIN_API_VERSION = "2026-04";
+var SHOPIFY_APP_API_VERSION = "unstable";
+var SHOPIFY_USAGE_ORDERS_EVENT_HANDLE = "drawbridge-orders";
+var SHOPIFY_REQUIRED_SCOPES = [
+  "read_customers",
+  "write_customers",
+  "read_discounts",
+  "write_discounts",
+  "read_orders",
+  "read_products",
+  "read_publications",
+  "write_resource_feedbacks",
+  "unauthenticated_read_checkouts",
+  "unauthenticated_read_product_inventory",
+  "unauthenticated_read_product_listings",
+  "unauthenticated_write_checkouts"
+];
+var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || "2026-07";
+export {
+  ACCESS_TOKEN_REFRESH_BUFFER_MS,
+  PARTNER_API_VERSION,
+  REFRESH_TOKEN_LIFETIME_MS,
+  SHOPIFY_ADMIN_API_VERSION,
+  SHOPIFY_APP_API_VERSION,
+  SHOPIFY_REQUIRED_SCOPES,
+  SHOPIFY_STOREFRONT_API_VERSION,
+  SHOPIFY_USAGE_ORDERS_EVENT_HANDLE
+};