@drawbridge/drawbridge-utils 0.0.176 → 0.0.178

package/dist/connections/index.js

@@ -1,3 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // lib/connections/contract.js
 var HOOKS = Object.freeze({
   // Proving and holding the credential.
@@ -124,6 +130,10 @@ var HOOKS = Object.freeze({
     "code",
     // Create the buyer at the vendor, so an order can be attributed to them.
     "customer",
+    // HOW MANY OF THIS PRODUCT ARE LEFT, at the vendor. Read at the moment a
+    // campaign's product list is rendered rather than stored, because stock is
+    // the one product fact that is stale the instant it is written down.
+    "inventory",
     // An order arrived at the vendor: attribute it, record it, update totals.
     "order",
     // Pull product data across on a vendor update.
@@ -191,7 +201,19 @@ var HOOKS = Object.freeze({
     organizations: Object.freeze(["add", "list", "remove"]),
     // What the merchant pays the VENDOR. Pairs with auth.install.billing, which
     // declares the plan they are being charged on.
-    plan: Object.freeze(["cancel", "reselect"]),
+    //
+    // `verify` is the odd one of the three: not something a merchant does, but
+    // the question "is this store's billing actually metered right now". It is
+    // here because it is the same subject — and because the answer was being
+    // derived in TWO places, the vendor's health check and drawbridge-sync's
+    // approval webhook, whose copy said in its own comment that it matched the
+    // other and did not.
+    // `charge` and `verify` are the two that are not merchant actions: one
+    // sends a usage charge to the vendor's meter, the other asks whether that
+    // meter is actually working. Both are here because both are the same
+    // subject — what the merchant pays the vendor — and both were being done
+    // from drawbridge-sync with a direct import of the vendor's client.
+    plan: Object.freeze(["cancel", "charge", "reselect", "verify"]),
     // The embedded app's own session, stored by us on the vendor's behalf.
     session: Object.freeze(["clear", "read", "save"]),
     // The one-time code that hands a merchant from the embedded app into
@@ -288,7 +310,7 @@ var answerOf = (answer) => {
   return effectsOf(answer);
 };
 var WRITE_OPERATIONS = Object.freeze(["create", "delete", "update"]);
-var INSTALL_SIGNATURE = Object.freeze({ options: ["read", "request"], props: ["context"] });
+var INSTALL_SIGNATURE = Object.freeze({ options: ["read"], props: ["context"] });
 var LIFECYCLE_SIGNATURE = Object.freeze({ options: ["dispatch"], props: ["context"] });
 var RESOURCE_SIGNATURE = Object.freeze({
   options: ["fetcher", "shopify"],
@@ -305,15 +327,30 @@ var HOOK_SLOT_PROPS = Object.freeze({
   // the second bag would be silently discarded, which is exactly the
   // stubbed-fetcher-reaches-production failure the split exists to prevent.
   "auth.token": false,
-  // COMMERCE. `cart` is declared and unimplemented — the Checkout Kit path in
-  // api/route/subdomain.js writes nothing, which is why it never became a hook
-  // — so its signature mirrors `code`, its nearest sibling, and moving the
-  // route here is a deliberate widening of this line rather than a silent one.
-  "commerce.cart": Object.freeze({ options: ["adminToken", "shopify"], props: ["connection", "context", "step"] }),
+  // COMMERCE. `cart` is the odd one: it runs for a SHOPPER on a public page,
+  // not for an organization inside a workflow, so it takes no `connection` and
+  // no `step`. It reads the storefront with the store's own storefront token
+  // and mints a checkout token from DRAWBRIDGE'S app credentials, which is why
+  // `clientId`/`clientSecret` are here — as props, the way auth.disconnect
+  // already carries them, because a credential is a fact of the run rather
+  // than a service.
+  "commerce.cart": Object.freeze({
+    options: ["fetcher", "shopify"],
+    props: ["clientId", "clientSecret", "context", "settings"]
+  }),
   "commerce.code": Object.freeze({ options: ["adminToken", "shopify"], props: ["connection", "context", "step"] }),
   "commerce.customer": Object.freeze({ options: ["adminToken", "read", "shopify"], props: ["connection", "context"] }),
+  "commerce.inventory": Object.freeze({ options: ["adminToken", "shopify"], props: ["connection", "context"] }),
   "commerce.order": Object.freeze({ options: ["conversionRate", "logger", "mintId", "read"], props: ["connection", "context"] }),
-  "commerce.product": Object.freeze({ options: ["mintId", "read"], props: ["connection", "context", "workflow"] }),
+  // THREE OPERATIONS, one slot — record, sync, variants. `settings` and
+  // `adminToken` arrived with the pull half: the storefront read needs the
+  // store's storefront token and the product-feedback send needs its admin one,
+  // and both are resolved by the caller because minting either needs a
+  // controller.
+  "commerce.product": Object.freeze({
+    options: ["adminToken", "mintId", "read", "shopify"],
+    props: ["connection", "context", "settings", "workflow"]
+  }),
   // THE ADDRESS IS `contact` IN BOTH, and the shell already says why: it is the
   // person, not the lead document. `remove` called it `email` and `sync` called
   // it `doc` on one vendor and `lead` on three — three names for two facts.
@@ -326,19 +363,58 @@ var HOOK_SLOT_PROPS = Object.freeze({
   "inbound.process": Object.freeze({ options: ["dispatch"], props: ["context"] }),
   "inbound.receive": Object.freeze({ options: [], props: ["channel", "event", "headers", "payload"] }),
   "inbound.verify": Object.freeze({ options: [], props: ["body", "channel", "headers", "secret", "url"] }),
-  // INSTALL — thirteen slots, none implemented yet. They are what the thirteen
-  // routes in api/route/shopify-embedded.js become, and the signature is
-  // deliberately narrow: `context` is the request's own body, `read` and
-  // `request` are the only services an install surface has been shown to need.
-  // A route that cannot be expressed inside this line is a finding to bring
-  // back here, not a name to add at the call site.
+  // INSTALL — thirteen slots, and they are the thirteen routes that used to be
+  // api/route/shopify-embedded.js. `context` is the request's own body in all
+  // of them; the options are where they differ, and every difference below was
+  // forced by a line in those routes rather than chosen.
+  //
+  // SEVEN NEED NOTHING BUT `read`. The two session slots that write, the two
+  // token slots that write, the two clears, and both account slots answer from
+  // the shared install record alone.
+  //
+  // SIX TAKE MORE, and the widenings are worth naming because each is a fact
+  // Drawbridge owns that the manifest must not:
+  //
+  //   conversionRate, planTitle   what Drawbridge charges this organization.
+  //                               The org list renders both, and importing the
+  //                               plan catalogue here is the cycle
+  //                               features -> connections -> shopify -> plans
+  //                               -> features that was just broken.
+  //   currencies                  which settlement currencies Drawbridge can
+  //                               bill. A store outside them fails the
+  //                               connection validator INSIDE the transaction,
+  //                               which surfaces as an opaque 500, so `add`
+  //                               checks first and says so.
+  //   mintId                      the connection's id, known before the write
+  //                               that creates it, because the organization's
+  //                               own refs have to name it in the same
+  //                               transaction.
+  //   shopify                     the vendor. Four slots call the store: two
+  //                               read the live plan, two release it.
+  //   mark                        THE ONE WRITE A DESCRIPTION CANNOT CARRY, and
+  //                               `reselect` is the only slot with one. See its
+  //                               implementation for why the order is the point.
   "install.account.link": INSTALL_SIGNATURE,
   "install.account.unlink": INSTALL_SIGNATURE,
-  "install.organizations.add": INSTALL_SIGNATURE,
-  "install.organizations.list": INSTALL_SIGNATURE,
+  "install.organizations.add": Object.freeze({
+    options: ["currencies", "mintId", "read", "shopify"],
+    props: ["context"]
+  }),
+  "install.organizations.list": Object.freeze({
+    options: ["conversionRate", "planTitle", "read", "shopify"],
+    props: ["context"]
+  }),
   "install.organizations.remove": INSTALL_SIGNATURE,
-  "install.plan.cancel": INSTALL_SIGNATURE,
-  "install.plan.reselect": INSTALL_SIGNATURE,
+  "install.plan.cancel": Object.freeze({ options: ["read", "shopify"], props: ["context"] }),
+  // `manifest` because the handle this charge bills under is the vendor's own
+  // declaration (auth.install.billing.handle), and checking the job against the
+  // declaration is what the enqueuer-checks-itself version could not do.
+  "install.plan.charge": Object.freeze({
+    options: ["shopify"],
+    props: ["clientId", "clientSecret", "context", "manifest"]
+  }),
+  "install.plan.reselect": Object.freeze({ options: ["mark", "read", "shopify"], props: ["context"] }),
+  "install.plan.verify": Object.freeze({ options: ["adminToken", "read", "shopify"], props: ["context"] }),
   "install.session.clear": INSTALL_SIGNATURE,
   "install.session.read": INSTALL_SIGNATURE,
   "install.session.save": INSTALL_SIGNATURE,
@@ -425,6 +501,16 @@ var TRIGGERS = Object.freeze({
   "range.ended": Object.freeze({ event: "range.ended", type: "range" }),
   "range.started": Object.freeze({ event: "range.started", type: "range" }),
   "schedule.day": Object.freeze({ event: "day", type: "schedule" }),
+  // THE THREE SHOPIFY TRIGGERS, which were never in this vocabulary because the
+  // four workflows they fire were hand-written in drawbridge-sync's register job
+  // rather than provisioned from the manifest. `webhook` is a fourth trigger
+  // TYPE, and it is the honest name: these fire when the vendor calls us, which
+  // is neither an event Drawbridge raised nor a schedule it keeps.
+  "shopify.order.create": Object.freeze({ event: "shopify.order.create", type: "webhook" }),
+  "shopify.product.update": Object.freeze({ event: "shopify.product.update", type: "webhook" }),
+  // The token audit, dispatched programmatically by the register job when a
+  // store's grant is exchanged or rotated.
+  "shopify.token": Object.freeze({ event: "shopify.token", type: "event" }),
   "schedule.month": Object.freeze({ event: "month", type: "schedule" }),
   "schedule.week": Object.freeze({ event: "week", type: "schedule" }),
   "segment.contact.add": Object.freeze({ event: "segment.contact.add", type: "event" }),
@@ -477,7 +563,7 @@ var OUTCOMES = Object.freeze({
   unimplemented: "unimplemented",
   unsupported: "unsupported"
 });
-var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var STATUSES = Object.freeze(["active", "error", "pending"]);
 var PLATFORM_CREDENTIALS = Object.freeze([
   // Seals a merchant's stored connection settings. The webhook connection is
   // gated on it because its whole credential is a secret WE mint and store, so
@@ -534,16 +620,188 @@ var ERROR_SOURCES = Object.freeze({
   "shopify.register.webhooks": true
 });
 var bearing = (entry) => ERROR_SOURCES[entry == null ? void 0 : entry.source] !== false;
-var assess = ({ errors = [], status = null } = {}) => {
-  if (status === "disconnected") return status;
-  return (errors || []).some(bearing) ? "error" : "active";
-};
+var assess = ({ errors = [] } = {}) => (errors || []).some(bearing) ? "error" : "active";
 var surviving = ({ errors = [], proved = [] } = {}) => (errors || []).filter((entry) => !proved.includes(entry == null ? void 0 : entry.source));
 var isStatus = (status) => STATUSES.includes(status);
 
 // lib/usage.js
 var isDuplicateKey = (error) => (error == null ? void 0 : error.code) === 11e3 || (error == null ? void 0 : error.code) === "11000" || /E11000|duplicate key/i.test((error == null ? void 0 : error.message) || "");
 
+// lib/connections/perform.js
+var perform = async ({ answer, controller, emit, enqueue }) => {
+  const { enqueues, events, transaction, writes } = answerOf(answer) || {};
+  const write = async ({ collection, data, ignoreDuplicate, multiple, operation, options, query }, session) => {
+    try {
+      await controller[operation]({
+        collection,
+        data,
+        // The controller takes `multiple` beside options — an update that
+        // means every matching document must say so explicitly.
+        ...multiple && { multiple: true },
+        ...(options || session) && { options: { ...options, ...session && { session } } },
+        ...query && { query }
+      });
+    } catch (error) {
+      if (!(ignoreDuplicate && isDuplicateKey(error))) throw error;
+    }
+  };
+  if (transaction) {
+    await controller.transaction(async (session) => {
+      for (const descriptor of writes) await write(descriptor, session);
+    });
+  } else {
+    for (const descriptor of writes) await write(descriptor);
+  }
+  for (const { data, name, options, queue: target } of enqueues) {
+    if (!enqueue) throw new Error("A hook described an enqueue and this caller supplied no enqueuer");
+    await enqueue({ data, name, options, queue: target });
+  }
+  for (const descriptor of events) {
+    if (!emit) throw new Error("A hook described a socket event and this caller supplied no emitter");
+    emit(descriptor);
+  }
+};
+
+// lib/encrypt.js
+import crypto2 from "crypto";
+
+// lib/token.js
+import crypto from "crypto";
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = crypto.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return crypto.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return crypto.createHash("sha256").update(String(value)).digest("base64url");
+};
+
+// lib/encrypt.js
+var ALGORITHM = "aes-256-gcm";
+var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
+var encrypt = (value) => {
+  const iv = generate(12, null);
+  const cipher = crypto2.createCipheriv(ALGORITHM, getKey(), iv);
+  const data = Buffer.concat([
+    cipher.update(JSON.stringify(value), "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return [iv, tag, data].map((b) => b.toString("hex")).join(":");
+};
+var decrypt = (value) => {
+  if (typeof value !== "string") return value;
+  const [ivHex, tagHex, dataHex] = value.split(":");
+  const decipher = crypto2.createDecipheriv(
+    ALGORITHM,
+    getKey(),
+    Buffer.from(ivHex, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  const result = Buffer.concat([
+    decipher.update(Buffer.from(dataHex, "hex")),
+    decipher.final()
+  ]);
+  return JSON.parse(result.toString("utf8"));
+};
+
+// lib/connections/reconcile.js
+var connectionSettings = async ({ controller, query }) => {
+  const connection = await controller.get({ collection: "connection", query });
+  if (!connection) return { connection: null, settings: null };
+  return { connection, settings: decrypt(connection.settings) };
+};
+var SCOPES_ERROR_SOURCE = "scopes";
+var SCOPES_ERROR_MESSAGE = "Shopify permissions are out of date. Open the Drawbridge app in your Shopify admin to approve the updated permissions.";
+var reconcileConnectionScopes = async ({
+  controller,
+  enqueue,
+  granted = null,
+  logger,
+  shop,
+  slug: slug2 = "shopify"
+}) => {
+  var _a, _b, _c;
+  if (granted === null) {
+    const record = await controller.get({ collection: "shop", query: { shop } });
+    const session = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : null;
+    granted = (session == null ? void 0 : session.scope) || null;
+  }
+  if (!granted) return null;
+  const answered = await runHook(slug2, "auth.scopes", { scope: granted });
+  const missing2 = answered.outcome === "answered" ? (_a = answered.answer.result) == null ? void 0 : _a.missing : null;
+  if (!Array.isArray(missing2)) {
+    (_b = logger == null ? void 0 : logger.warn) == null ? void 0 : _b.call(logger, "connection.scopes.unreadable", { shop, slug: slug2 });
+    return null;
+  }
+  const connections2 = await controller.aggregate({
+    collection: "connection",
+    pipeline: [{ $match: { shop, slug: slug2 } }]
+  });
+  let hadScopesError = false;
+  for (const connection of connections2) {
+    const others = (connection.errors || []).filter((entry) => entry.source !== SCOPES_ERROR_SOURCE);
+    const hasScopesError = others.length !== (connection.errors || []).length;
+    hadScopesError = hadScopesError || hasScopesError;
+    if (missing2.length) {
+      await controller.update({
+        collection: "connection",
+        data: {
+          $set: {
+            errors: [...others, { message: SCOPES_ERROR_MESSAGE, source: SCOPES_ERROR_SOURCE }],
+            status: "error"
+          }
+        },
+        query: { id: connection.id }
+      });
+    } else if (hasScopesError) {
+      await controller.update({
+        collection: "connection",
+        data: {
+          $set: {
+            errors: others,
+            ...connection.status === "error" && !others.length && { status: "active" }
+          }
+        },
+        query: { id: connection.id }
+      });
+    }
+  }
+  const products = connections2.length ? await controller.aggregate({
+    collection: "product",
+    pipeline: [{ $match: { "provider.slug": slug2, "source.domain": shop } }]
+  }) : [];
+  if (missing2.length && products.length) {
+    const productIds = products.map((product) => product.id);
+    await controller.update({
+      collection: "product",
+      data: { $set: { status: "inactive" } },
+      multiple: true,
+      query: { id: { $in: productIds } }
+    });
+    await controller.update({
+      collection: "advertisement",
+      data: { $set: { status: "drafted" } },
+      multiple: true,
+      query: { product: { $in: productIds } }
+    });
+  } else if (!missing2.length && hadScopesError && enqueue) {
+    for (const product of products) {
+      await enqueue({
+        data: { product: product.id },
+        name: "sync",
+        options: { jobId: "product." + slug2 + "." + product.id + "." + Date.now() },
+        queue: "product." + slug2
+      });
+    }
+  }
+  (_c = logger == null ? void 0 : logger.info) == null ? void 0 : _c.call(logger, "connection.scopes.reconciled", { connections: connections2.length, missing: missing2, shop });
+  return missing2;
+};
+
 // lib/connections/workflows.js
 var systemSteps = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => {
@@ -554,16 +812,28 @@ var systemSteps = (node, path = []) => Object.entries(node || {}).flatMap(
     return value && typeof value === "object" ? systemSteps(value, [...path, key]) : [];
   }
 );
+var systemWorkflows = (manifest) => {
+  var _a, _b, _c;
+  const grouped = /* @__PURE__ */ new Map();
+  for (const [type, declared] of systemSteps(manifest == null ? void 0 : manifest.steps)) {
+    const trigger = ((_a = declared.workflow) == null ? void 0 : _a.trigger) || declared.trigger;
+    if (!(trigger == null ? void 0 : trigger.event) || !(trigger == null ? void 0 : trigger.type)) continue;
+    const title = ((_b = declared.workflow) == null ? void 0 : _b.key) || declared.key;
+    if (!title) continue;
+    if (!grouped.has(title)) grouped.set(title, { steps: [], title, trigger });
+    grouped.get(title).steps.push({ order: ((_c = declared.workflow) == null ? void 0 : _c.order) ?? 0, type });
+  }
+  return [...grouped.values()].map((workflow) => ({
+    ...workflow,
+    steps: workflow.steps.slice().sort((a, b) => a.order - b.order)
+  }));
+};
 var ensureSystemWorkflows = async ({ connections: registry = connections, controller, doc }) => {
-  var _a, _b;
-  if (!(doc == null ? void 0 : doc.id) || doc.slug === "shopify") return [];
+  if (!(doc == null ? void 0 : doc.id)) return [];
   const manifest = registry[doc.slug];
   if (!manifest) return [];
   const provisioned = [];
-  for (const [type, declared] of systemSteps(manifest.steps)) {
-    if (!((_a = declared.trigger) == null ? void 0 : _a.event) || !((_b = declared.trigger) == null ? void 0 : _b.type)) continue;
-    const title = declared.key;
-    if (!title) continue;
+  for (const { steps: members, title, trigger } of systemWorkflows(manifest)) {
     const existing = await controller.count({
       collection: "workflow",
       query: {
@@ -580,13 +850,10 @@ var ensureSystemWorkflows = async ({ connections: registry = connections, contro
       connection: doc.id,
       organization: doc.organization,
       status: "active",
-      steps: [{
-        settings: {},
-        type
-      }],
+      steps: members.map(({ type }) => ({ settings: {}, type })),
       system: true,
       title,
-      trigger: declared.trigger
+      trigger
     };
     let created;
     try {
@@ -603,6 +870,135 @@ var ensureSystemWorkflows = async ({ connections: registry = connections, contro
   return provisioned;
 };
 
+// lib/connections/reference.js
+var MARKER = {
+  end: "<!-- /generated -->",
+  start: "<!-- generated: drawbridge-utils lib/connections/reference.js \u2014 do not edit by hand -->"
+};
+var slugs = () => Object.keys(connections).sort();
+var slots = (node = HOOKS, path = []) => Object.entries(node).flatMap(
+  ([key, value]) => Array.isArray(value) ? value.map((verb) => [...path, key, verb].join(".")) : slots(value, [...path, key])
+);
+var implemented = (hooks, name) => {
+  const found = name.split(".").reduce(
+    (node, key) => node && typeof node === "object" && Object.hasOwn(node, key) ? node[key] : void 0,
+    hooks
+  );
+  if (typeof found === "function") return "yes";
+  if (found && typeof found === "object") return "elsewhere";
+  return "no";
+};
+var table = (header, rows) => [
+  "| " + header.join(" | ") + " |",
+  "|" + header.map(() => "---").join("|") + "|",
+  ...rows.map((row2) => "| " + row2.join(" | ") + " |")
+].join("\n");
+var matrix = () => {
+  const columns = slugs();
+  return table(
+    ["Hook", ...columns],
+    slots().map((name) => [
+      "`" + name + "`",
+      ...columns.map((slug2) => implemented(connections[slug2].hooks, name))
+    ])
+  );
+};
+var vocabularies = () => {
+  const list2 = (values) => values.map((value) => "`" + value + "`").join(", ");
+  return table(
+    ["Vocabulary", "Values"],
+    [
+      ["`AUTH_KINDS`", list2(AUTH_KINDS)],
+      ["`GROUPS`", list2(GROUPS)],
+      ["`INPUTS`", list2(INPUTS)],
+      ["`STATUSES`", list2(STATUSES)],
+      ["`TRIGGERS`", list2(Object.keys(TRIGGERS).sort())],
+      ["`TRIGGER_TYPES`", list2(TRIGGER_TYPES)]
+    ]
+  );
+};
+var steps = () => {
+  const rows = [];
+  const walk = (node, path, slug2) => {
+    var _a;
+    if (!node || typeof node !== "object") return;
+    for (const [key, value] of Object.entries(node)) {
+      if (typeof value === "function") {
+        let declared;
+        try {
+          declared = value({});
+        } catch {
+          continue;
+        }
+        if (!(declared == null ? void 0 : declared.type)) continue;
+        const fires = ((_a = declared.workflow) == null ? void 0 : _a.trigger) || declared.trigger;
+        rows.push([
+          "`" + declared.type + "`",
+          slug2,
+          declared.hook ? "`" + declared.hook + "`" : "\u2014",
+          declared.queue,
+          declared.system ? "system" : declared.withdrawn ? "withdrawn" : "builder",
+          fires ? "`" + fires.event + "` / `" + fires.type + "`" : (declared.triggers || []).map((t) => "`" + t + "`").join(", ") || "\u2014"
+        ]);
+        continue;
+      }
+      walk(value, [...path, key], slug2);
+    }
+  };
+  for (const slug2 of slugs()) walk(connections[slug2].steps, [], slug2);
+  return table(["Step", "Connection", "Hook", "Queue", "Shape", "Fired by"], rows.sort((a, b) => a[0].localeCompare(b[0]) || a[1].localeCompare(b[1])));
+};
+var workflows = () => table(
+  ["Workflow", "Connection", "Steps", "Trigger"],
+  slugs().flatMap((slug2) => systemWorkflows(connections[slug2]).map((workflow) => [
+    workflow.title,
+    slug2,
+    workflow.steps.map((step) => "`" + step.type + "`").join(" \u2192 "),
+    "`" + workflow.trigger.event + "` / `" + workflow.trigger.type + "`"
+  ]))
+);
+var reference = () => [
+  MARKER.start,
+  "",
+  "### The support matrix",
+  "",
+  "`yes` is a body in this package. `elsewhere` is declared here and implemented in the repo holding the dependencies \u2014 a different fact from `no`, and collapsing the two is how a table tells a reader the package can do something it cannot.",
+  "",
+  matrix(),
+  "",
+  "### The closed vocabularies",
+  "",
+  vocabularies(),
+  "",
+  "### Every step",
+  "",
+  "A step with no hook is real: Shopify's token-audit pair is declared so a stray dispatch lands on a real queue, and is never fired.",
+  "",
+  steps(),
+  "",
+  "### The system workflows a connection is provisioned with",
+  "",
+  "Idempotent on (connection, system, title), so the TITLE is load-bearing \u2014 one that varied by account would provision a second workflow every time it changed.",
+  "",
+  workflows(),
+  "",
+  "### Counts",
+  "",
+  "- **" + slugs().length + "** connections",
+  "- **" + slots().length + "** hook slots",
+  "- **" + Object.keys(STEPS).length + "** step types",
+  "- **" + Object.keys(TRIGGERS).length + "** triggers",
+  "",
+  MARKER.end
+].join("\n");
+var spliced = (document) => {
+  const from = document.indexOf(MARKER.start);
+  const to = document.indexOf(MARKER.end);
+  if (from < 0 || to < 0) return document;
+  return document.slice(0, from) + reference() + document.slice(to + MARKER.end.length);
+};
+var MARKERS = MARKER;
+
 // lib/connections/oauth.js
 import { createHash, randomBytes } from "crypto";
 var credentials = ({ basic, clientId, clientSecret }) => basic ? {
@@ -657,10 +1053,10 @@ var authToken = async ({
   const renewing = !code;
   if (renewing && !refreshToken) throw new Error("Nothing has been consented to yet, so there is no refresh token to spend");
   if (!renewing && descriptor.pkce && !verifier) throw new Error("This connection requires PKCE, so the code verifier is not optional");
-  const client = credentials({ basic, clientId, clientSecret });
+  const client2 = credentials({ basic, clientId, clientSecret });
   const response = await fetcher(descriptor.endpoints.token, {
     body: new URLSearchParams({
-      ...client.body,
+      ...client2.body,
       ...renewing ? { grant_type: "refresh_token", refresh_token: refreshToken } : {
         code: decodeURIComponent(String(code || "").trim()),
         grant_type: "authorization_code",
@@ -668,7 +1064,7 @@ var authToken = async ({
         ...descriptor.pkce && { code_verifier: verifier }
       }
     }),
-    headers: { "content-type": "application/x-www-form-urlencoded", ...client.headers },
+    headers: { "content-type": "application/x-www-form-urlencoded", ...client2.headers },
     method: "POST",
     signal: AbortSignal.timeout(15e3)
   });
@@ -1124,9 +1520,18 @@ var scaffold_default = {
     commerce: {
       // NEW in phase 1 — the Checkout Kit cart path, which writes nothing and is
       // the last api surface Shopify owns outside a hook.
-      cart: async ({ connection, context }, { read } = {}) => ANSWER,
+      // NO `connection` AND NO `step`: this one runs for a SHOPPER on a public
+      // page, not for an organization inside a workflow. It reads the storefront
+      // with the store's storefront token and mints a checkout token from
+      // DRAWBRIDGE'S app credentials, which is why the credential pair rides in
+      // as props — the way auth.disconnect already carries it.
+      cart: async ({ clientId, clientSecret, context, settings }, { fetcher, shopify } = {}) => ANSWER,
       code: async ({ connection, context, step }, { adminToken, shopify } = {}) => ANSWER,
       customer: async ({ connection, context }, { adminToken, read, shopify } = {}) => ANSWER,
+      // STOCK, READ AT RENDER TIME rather than stored. It is the one product
+      // fact that is stale the instant it is written down, so the campaign
+      // product list asks the vendor and caches the answer for a minute.
+      inventory: async ({ connection, context }, { adminToken, shopify } = {}) => ANSWER,
       order: async ({ connection, context }, { logger, mintId, read } = {}) => ANSWER,
       // THIS IS WHERE `product.insert` LANDS.
       //
@@ -1148,7 +1553,7 @@ var scaffold_default = {
       // nothing and shows up only as `workflow.dispatch.candidates matched : 0` in
       // a log. Phase 1 closes it and build() checks every trigger against it.
       product: {
-        hook: async ({ connection, context, workflow }, { mintId, read } = {}) => ANSWER,
+        hook: async ({ connection, context, settings, workflow }, { adminToken, mintId, read, shopify } = {}) => ANSWER,
         step: () => ({
           description: "Syncs product data from the vendor when a product changes.",
           key: "Vendor Product Sync",
@@ -1296,8 +1701,19 @@ var scaffold_default = {
       // Vendor billing, the only group that is not generic. Pairs with
       // auth.install.billing, which declares what the merchant is being charged.
       plan: {
-        cancel: async ({ context }, { dispatch, read } = {}) => ANSWER,
-        reselect: async ({ context }, { dispatch, read } = {}) => ANSWER
+        cancel: async ({ context }, { read, shopify } = {}) => ANSWER,
+        // NOT A MERCHANT ACTION EITHER — one attributed order's usage charge,
+        // sent to the vendor's meter. The credential pair rides in as props
+        // because the charge authenticates as the APP, not as the store.
+        charge: async ({ clientId, clientSecret, context, manifest }, { shopify } = {}) => ANSWER,
+        // `mark` is the one write a description cannot carry: the marker must
+        // be persisted BEFORE the approval is released, and a described write
+        // lands after the hook returns.
+        reselect: async ({ context }, { mark, read, shopify } = {}) => ANSWER,
+        // NOT A MERCHANT ACTION — the question "is this store's billing
+        // actually metered right now", asked by the daily health check and by
+        // the vendor's own approval webhook, which used to hand-copy it.
+        verify: async ({ context }, { adminToken, read, shopify } = {}) => ANSWER
       },
       // The embedded app's own session, stored by us on the vendor's behalf.
       session: {
@@ -1783,16 +2199,19 @@ var attentive_default2 = {
       "Anyone who has opted out in Drawbridge is sent to Attentive as an unsubscribe rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
       "Attentive accepts these updates and applies them in the background, so a contact appears in your segment shortly after the sync rather than the instant it runs."
     ],
-    // NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-    // The dashboard already carries generic reasons for every way an
-    // authorization can fail — declined, expired state, a vendor we are not set
-    // up for — and a sentence here is an ADDITION to those, for a vendor whose
-    // failures need saying differently. This one's do not.
+    // WHAT THE MERCHANT READS WHEN A CONNECT FAILS. Two states, because the
+    // consent screen has two ways to end: they said no, or something between
+    // here and the vendor went wrong.
     //
-    // Answered rather than omitted, because `errors` existed on two of six
-    // manifests and there was no way to tell "nothing to add" from "nobody
-    // wrote it".
-    errors: false,
+    // THE VENDOR IS NAMED IN BOTH. The dashboard's generic copy says "the
+    // authorization"; a merchant connecting two accounts in one sitting needs
+    // to know which one this was.
+    errors: {
+      connect: {
+        denied: "The Attentive authorization was declined, so nothing was connected.",
+        invalid: "We couldn't complete the Attentive connection. Try connecting again."
+      }
+    },
     excerpt: "Sync your Drawbridge contacts into an Attentive segment.",
     // NAMES THE SEGMENT STEP, because `status` below gates on it: a grant with
     // no segment chosen sits at Pending, and a guide that stops at the consent
@@ -2320,6 +2739,15 @@ var readEventHeader = ({ descriptor, headers }) => ({ result: { event: headers[d
 var DEFAULT_TIMEOUT_MS = 15e3;
 var request = async ({
   body,
+  // THE TRANSPORT, injectable and defaulted to the real one.
+  //
+  // Every other vendor client in this package takes a `fetcher` — it is how
+  // klaviyo, mailchimp and attentive are tested without a network, and it is a
+  // declared HOOK_OPTION. The Shopify client had no seam at all, so the only way
+  // to test a hook that used it was to inject the whole SDK namespace; that
+  // injection existed to work around an import cycle, and when the cycle went
+  // the tests lost their only hold. This is the seam they should have had.
+  fetcher = fetch,
   headers = {},
   method = "GET",
   query,
@@ -2333,7 +2761,7 @@ var request = async ({
   }
   ;
   const isForm = type === "form";
-  const response = await fetch(fullUrl.toString(), {
+  const response = await fetcher(fullUrl.toString(), {
     method,
     headers: {
       "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
@@ -2790,15 +3218,12 @@ var drawbridge_default2 = {
     description: [
       "Drawbridge sends your notification emails and your entrants' emails, and recalculates segment membership on a schedule. It is always on and needs nothing connected."
     ],
-    // NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-    // The dashboard already carries generic reasons for every way an
-    // authorization can fail — declined, expired state, a vendor we are not set
-    // up for — and a sentence here is an ADDITION to those, for a vendor whose
-    // failures need saying differently. This one's do not.
+    // NOTHING IS EVER CONNECTED, so no connect can fail. This is the platform's
+    // own manifest — always on, private, never in the catalogue — and it exists
+    // to give Drawbridge's own steps a hook to point at. `denied` and `invalid`
+    // describe a consent screen this connection does not have.
     //
-    // Answered rather than omitted, because `errors` existed on two of six
-    // manifests and there was no way to tell "nothing to add" from "nobody
-    // wrote it".
+    // `false` is the recorded decision, not silence.
     errors: false,
     excerpt: "The steps Drawbridge runs itself.",
     guide: [
@@ -3558,10 +3983,10 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 
 // lib/connections/scopes.js
 var list = (value) => (Array.isArray(value) ? value.flatMap((entry) => String(entry).split(/\s+/)) : String(value ?? "").split(/\s+/)).map((entry) => entry.trim()).filter(Boolean);
-var missingScopes = ({ granted, required }) => {
+var missingScopes = ({ granted, required: required2 }) => {
   if (granted === null || granted === void 0 || granted === "") return null;
   const held = new Set(list(granted));
-  return list(required).filter((scope) => !held.has(scope));
+  return list(required2).filter((scope) => !held.has(scope));
 };
 
 // lib/connections/manifests/klaviyo.js
@@ -4460,16 +4885,19 @@ var mailchimp_default2 = {
       "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
       "Someone who unsubscribed inside Mailchimp keeps that choice: a resync only sets the status of a subscriber Mailchimp has never seen before."
     ],
-    // NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-    // The dashboard already carries generic reasons for every way an
-    // authorization can fail — declined, expired state, a vendor we are not set
-    // up for — and a sentence here is an ADDITION to those, for a vendor whose
-    // failures need saying differently. This one's do not.
+    // WHAT THE MERCHANT READS WHEN A CONNECT FAILS. Two states, because the
+    // consent screen has two ways to end: they said no, or something between
+    // here and the vendor went wrong.
     //
-    // Answered rather than omitted, because `errors` existed on two of six
-    // manifests and there was no way to tell "nothing to add" from "nobody
-    // wrote it".
-    errors: false,
+    // THE VENDOR IS NAMED IN BOTH. The dashboard's generic copy says "the
+    // authorization"; a merchant connecting two accounts in one sitting needs
+    // to know which one this was.
+    errors: {
+      connect: {
+        denied: "The Mailchimp authorization was declined, so nothing was connected.",
+        invalid: "We couldn't complete the Mailchimp connection. Try connecting again."
+      }
+    },
     excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
     // NAMES THE AUDIENCE STEP, because `status` below gates on it: a grant with
     // no audience chosen sits at Pending, and a guide that stops at the consent
@@ -4568,7 +4996,7 @@ var mailchimp_default2 = {
         if (!audience) return { message: "No Mailchimp audience is chosen for this connection.", request: request2, skipped: true };
         const email = ((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.email) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", request: request2, skipped: true };
-        const hash = subscriberHash(email);
+        const hash2 = subscriberHash(email);
         const [firstName, ...restOfName] = String((lead == null ? void 0 : lead.name) || "").trim().split(/\s+/).filter(Boolean);
         const lastName = restOfName.join(" ");
         const phone = ((_e = lead == null ? void 0 : lead.phone) == null ? void 0 : _e.number) || null;
@@ -4577,7 +5005,7 @@ var mailchimp_default2 = {
           ...lastName && { LNAME: lastName },
           ...phone && { PHONE: phone }
         };
-        const member = await api3("/lists/" + audience + "/members/" + hash, {
+        const member = await api3("/lists/" + audience + "/members/" + hash2, {
           dc: settings == null ? void 0 : settings.dc,
           fetcher,
           method: "PUT",
@@ -4618,7 +5046,7 @@ var mailchimp_default2 = {
             status: joined.has(entry.id) ? "active" : "inactive"
           }));
           if (tags.length > 0) {
-            await api3("/lists/" + audience + "/members/" + hash + "/tags", {
+            await api3("/lists/" + audience + "/members/" + hash2 + "/tags", {
               dc: settings == null ? void 0 : settings.dc,
               fetcher,
               method: "POST",
@@ -4629,12 +5057,12 @@ var mailchimp_default2 = {
         }
         return {
           // Merged into `context` for later steps in this run.
-          context: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash },
+          context: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash2 },
           message: suppressed ? "Synced to Mailchimp as unsubscribed \u2014 this contact has opted out." : "Synced to the Mailchimp audience.",
           request: request2,
           // Recorded on the run for support to read back, not a write
           // instruction — the hook has already written what it needed to.
-          response: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash }
+          response: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash2 }
         };
       }
     },
@@ -5004,139 +5432,2030 @@ var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M300.325 382.771L368 365.96C368 365.96 338.904 169.185 338.689 167.892C338.473 166.599 337.396 165.737 336.318 165.737C335.24 165.737 316.274 165.306 316.274 165.306C316.274 165.306 304.636 154.099 300.325 149.788V382.771Z" fill="white"/>
 </svg>`;
 
-// lib/email.js
-var GMAIL_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
-var toCanonicalEmail = (value) => {
-  if (!value || typeof value !== "string") return null;
-  const email = value.trim().toLowerCase();
-  const at = email.lastIndexOf("@");
-  if (at < 1 || at === email.length - 1) return null;
-  let local = email.slice(0, at);
-  const domain = email.slice(at + 1);
-  const plus = local.indexOf("+");
-  if (plus > 0) local = local.slice(0, plus);
-  if (GMAIL_DOMAINS.has(domain)) local = local.replaceAll(".", "");
-  if (!local) return null;
-  return local + "@" + domain;
-};
+// lib/shopify/admin.js
+var admin_exports = {};
+__export(admin_exports, {
+  adminFetch: () => adminFetch,
+  createDiscountCode: () => createDiscountCode,
+  createUsageRecord: () => createUsageRecord,
+  createUsageSubscription: () => createUsageSubscription,
+  getActiveAppSubscriptions: () => getActiveAppSubscriptions,
+  getDiscounts: () => getDiscounts,
+  getOrCreateCustomer: () => getOrCreateCustomer,
+  getProductInventory: () => getProductInventory,
+  sendProductResourceFeedback: () => sendProductResourceFeedback
+});
 
-// lib/encrypt.js
-import crypto from "crypto";
-var ALGORITHM = "aes-256-gcm";
-var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
-var decrypt = (value) => {
-  if (typeof value !== "string") return value;
-  const [ivHex, tagHex, dataHex] = value.split(":");
-  const decipher = crypto.createDecipheriv(
-    ALGORITHM,
-    getKey(),
-    Buffer.from(ivHex, "hex")
-  );
-  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
-  const result = Buffer.concat([
-    decipher.update(Buffer.from(dataHex, "hex")),
-    decipher.final()
-  ]);
-  return JSON.parse(result.toString("utf8"));
-};
+// lib/shopify/constants.js
+var SHOPIFY_STOREFRONT_API_VERSION = "2025-01";
+var SHOPIFY_ADMIN_API_VERSION = "2026-04";
+var SHOPIFY_APP_API_VERSION = "unstable";
+var SHOPIFY_REQUIRED_SCOPES = [
+  "read_customers",
+  "write_customers",
+  "read_discounts",
+  "write_discounts",
+  "read_orders",
+  "read_products",
+  "read_publications",
+  "write_resource_feedbacks",
+  "unauthenticated_read_checkouts",
+  "unauthenticated_read_product_inventory",
+  "unauthenticated_read_product_listings",
+  "unauthenticated_write_checkouts"
+];
+var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || "2026-07";
 
-// lib/slugify.js
-import slug from "slugify";
-var slugify = (value, nochars = false) => {
-  const remove = nochars ? /[-?*+~.()'"!:@#^_{}\[\];,/\\]/g : /[?*+~.()'"!:@#^_{}\[\];,/\\]/g;
-  const replacement = nochars ? "" : "-";
-  return slug(
-    value,
-    {
-      remove,
-      replacement,
-      lower: true,
-      trim: true
+// lib/shopify/admin.js
+var adminUrl = (domain) => `https://${domain}/admin/api/${SHOPIFY_ADMIN_API_VERSION}`;
+var adminFetch = async ({ adminAccessToken, domain, fetcher, query, variables }) => {
+  var _a;
+  const { data, errors } = await request({
+    fetcher,
+    method: "POST",
+    url: adminUrl(domain) + "/graphql.json",
+    headers: {
+      "X-Shopify-Access-Token": adminAccessToken
+    },
+    body: {
+      query,
+      ...variables && { variables }
     }
-  );
+  });
+  if (errors) {
+    throw new Error("Shopify GraphQL error: " + ((_a = errors[0]) == null ? void 0 : _a.message));
+  }
+  ;
+  return data;
 };
-
-// lib/connections/manifests/shopify.js
-var toLine = ({
-  price,
-  product_id: productId,
-  quantity,
-  title,
-  variant_id: variantId,
-  variant_title: variantTitle
-}) => ({
-  price: parseFloat(price) || 0,
-  productId: productId ? "gid://shopify/Product/" + productId : null,
-  quantity: quantity || 1,
-  title: title || null,
-  variantId: variantId ? "gid://shopify/ProductVariant/" + variantId : null,
-  variantTitle: variantTitle || null
-});
-var attributeLineItems = (lineItems = []) => lineItems.reduce(
-  (acc, item) => {
-    const attrs = (item.properties || []).reduce(
-      (map, { name, value }) => {
-        map[name] = value;
-        return map;
-      },
-      {}
-    );
-    if (!attrs["_drwbrdg_ca"]) return acc;
-    if (!Object.keys(acc.attrMap).length) acc.attrMap = attrs;
-    const line = toLine(item);
-    acc.attributedGross += line.price * line.quantity;
-    acc.attributedLines.push(line);
-    return acc;
-  },
-  { attrMap: {}, attributedGross: 0, attributedLines: [] }
-);
-var generateDiscountCode = customAlphabet("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
-var blockedReason = (discount) => {
-  var _a;
-  if ((discount == null ? void 0 : discount.status) === "EXPIRED") return "This discount has expired.";
-  const buyers = (_a = discount == null ? void 0 : discount.context) == null ? void 0 : _a.__typename;
-  if (buyers && buyers !== "DiscountBuyerSelectionAll") {
-    return "This discount is limited to specific buyers in Shopify, so a code issued to an entrant won't work. Set it to all customers to use it here.";
+var DISCOUNT_FIELDS = `
+	title
+	status
+	startsAt
+	endsAt
+	usageLimit
+	asyncUsageCount
+	appliesOncePerCustomer
+	context { __typename }
+`;
+var discountsQuery = (search, cursor, limit) => `{
+	codeDiscountNodes(first: ${limit}${search ? `, query: "title:*${search}*"` : ""}${cursor ? `, after: "${cursor}"` : ""}) {
+		edges {
+			node {
+				id
+				codeDiscount {
+					... on DiscountCodeBasic { ${DISCOUNT_FIELDS} }
+					... on DiscountCodeBxgy { ${DISCOUNT_FIELDS} }
+					... on DiscountCodeFreeShipping { ${DISCOUNT_FIELDS} }
+					... on DiscountCodeApp { ${DISCOUNT_FIELDS} }
+				}
+			}
+		}
+		pageInfo {
+			endCursor
+			hasNextPage
+			hasPreviousPage
+			startCursor
+		}
+	}
+}`;
+var getDiscounts = async ({ fetcher, adminAccessToken, domain, search, cursor, limit }) => {
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: discountsQuery(search, cursor, limit)
+  });
+  return data == null ? void 0 : data.codeDiscountNodes;
+};
+var discountGid = (id) => String(id).startsWith("gid://") ? String(id) : "gid://shopify/DiscountCodeNode/" + id;
+var createDiscountCode = async ({ fetcher, adminAccessToken, domain, discountId, code }) => {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  const added = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `
+			mutation DiscountRedeemCodeBulkAdd($discountId: ID!, $codes: [DiscountRedeemCodeInput!]!) {
+				discountRedeemCodeBulkAdd(discountId: $discountId, codes: $codes) {
+					bulkCreation {
+						id
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      codes: [{ code }],
+      discountId: discountGid(discountId)
+    }
+  });
+  const addErrors = (_a = added == null ? void 0 : added.discountRedeemCodeBulkAdd) == null ? void 0 : _a.userErrors;
+  if (addErrors == null ? void 0 : addErrors.length) {
+    throw new Error("Shopify discount code create failed: " + addErrors[0].message);
   }
   ;
-  if (typeof (discount == null ? void 0 : discount.usageLimit) === "number" && discount.usageLimit > 0 && ((discount == null ? void 0 : discount.asyncUsageCount) || 0) >= discount.usageLimit) {
-    return "This discount has reached its total usage limit.";
+  const bulkCreationId = (_c = (_b = added == null ? void 0 : added.discountRedeemCodeBulkAdd) == null ? void 0 : _b.bulkCreation) == null ? void 0 : _c.id;
+  if (!bulkCreationId) {
+    throw new Error("Shopify discount code create failed: no bulk creation id returned");
   }
   ;
-  return null;
-};
-var discountWarning = (discount) => {
-  if ((discount == null ? void 0 : discount.status) === "SCHEDULED") {
-    return "This discount hasn't started yet, so codes issued before it does won't work until then.";
+  for (let attempt = 0; attempt < 15; attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 1e3));
+    const polled = await adminFetch({
+      fetcher,
+      adminAccessToken,
+      domain,
+      query: `
+				query DiscountRedeemCodeBulkCreationPoll($id: ID!) {
+					discountRedeemCodeBulkCreation(id: $id) {
+						done
+						codes(first: 1) {
+							nodes {
+								code
+								discountRedeemCode {
+									id
+								}
+								errors {
+									message
+								}
+							}
+						}
+					}
+				}
+			`,
+      variables: {
+        id: bulkCreationId
+      }
+    });
+    const creation = polled == null ? void 0 : polled.discountRedeemCodeBulkCreation;
+    if (!(creation == null ? void 0 : creation.done)) continue;
+    const node = (_e = (_d = creation.codes) == null ? void 0 : _d.nodes) == null ? void 0 : _e[0];
+    if (!((_f = node == null ? void 0 : node.discountRedeemCode) == null ? void 0 : _f.id)) {
+      throw new Error("Shopify discount code create failed: " + (((_h = (_g = node == null ? void 0 : node.errors) == null ? void 0 : _g[0]) == null ? void 0 : _h.message) || "code was not created"));
+    }
+    ;
+    return {
+      code: node.code,
+      // Numeric tail keeps the stored shopifyDiscountId in the shape the
+      // legacy REST endpoint returned — it feeds a merchant-visible
+      // workflow template variable, so no gid:// leakage.
+      id: node.discountRedeemCode.id.split("/").pop()
+    };
   }
   ;
-  if (discount == null ? void 0 : discount.appliesOncePerCustomer) return "Each customer can use this discount only once.";
-  return null;
+  throw new Error("Shopify discount code create timed out waiting for bulk creation " + bulkCreationId);
 };
-var ORDER_EVENT_HANDLE = slugify("drawbridge-orders");
-var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
-var OAUTH_ERROR_SOURCE = "oauth";
-var BILLING_ERROR_SOURCE = "billing";
-var BILLING_ERROR_MESSAGE = "Order billing isn't set up for this store \u2014 reselect and approve the plan from the Shopify connection page.";
-var OAUTH_GRANT_REVOKED_CODES = ["application_cannot_be_found", "invalid_grant"];
-var inbound = {
-  headers: {
-    event: "x-shopify-topic",
-    id: "x-shopify-webhook-id",
-    shop: "x-shopify-shop-domain",
-    signature: "x-shopify-hmac-sha256"
-  },
-  signature: {
-    algorithm: "sha256",
-    encoding: "base64",
-    secret: "SHOPIFY_API_SECRET"
+var getOrCreateCustomer = async ({ fetcher, adminAccessToken, domain, email, firstName, lastName, source }) => {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  const lookupQuery = `
+		query customerByEmail( $query : String! ) {
+			customers( first : 1, query : $query ) {
+				edges {
+					node {
+						id
+					}
+				}
+			}
+		}
+	`;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: lookupQuery,
+    variables: { query: "email:" + email }
+  });
+  const existing = (_c = (_b = (_a = data == null ? void 0 : data.customers) == null ? void 0 : _a.edges) == null ? void 0 : _b[0]) == null ? void 0 : _c.node;
+  if (existing) return existing;
+  const input = { email };
+  if (firstName) input.firstName = firstName;
+  if (lastName) input.lastName = lastName;
+  if (source) {
+    input.metafields = [{
+      namespace: "drwbrdg",
+      key: "source",
+      type: "single_line_text_field",
+      value: source
+    }];
   }
-};
+  ;
+  const result = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `
+			mutation customerCreate( $input : CustomerInput! ) {
+				customerCreate( input : $input ) {
+					customer {
+						id
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: { input }
+  });
+  const userErrors = (_d = result == null ? void 0 : result.customerCreate) == null ? void 0 : _d.userErrors;
+  if (userErrors == null ? void 0 : userErrors.length) {
+    const emailTaken = userErrors.some((e) => {
+      var _a2;
+      return (_a2 = e.message) == null ? void 0 : _a2.includes("Email has already been taken");
+    });
+    if (emailTaken) {
+      const retry = await adminFetch({
+        fetcher,
+        adminAccessToken,
+        domain,
+        query: lookupQuery,
+        variables: { query: "email:" + email }
+      });
+      const found = (_g = (_f = (_e = retry == null ? void 0 : retry.customers) == null ? void 0 : _e.edges) == null ? void 0 : _f[0]) == null ? void 0 : _g.node;
+      if (found) return found;
+    }
+    ;
+    throw new Error("Shopify customer create failed: " + userErrors[0].message);
+  }
+  ;
+  return (_h = result == null ? void 0 : result.customerCreate) == null ? void 0 : _h.customer;
+};
+var getActiveAppSubscriptions = async ({ fetcher, adminAccessToken, domain }) => {
+  var _a, _b;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `{
+			currentAppInstallation {
+				activeSubscriptions {
+					id
+					name
+					status
+					test
+					lineItems {
+						id
+						plan {
+							pricingDetails {
+								__typename
+							}
+						}
+					}
+				}
+			}
+			shop {
+				myshopifyDomain
+			}
+		}`
+  });
+  return {
+    shopDomain: ((_a = data == null ? void 0 : data.shop) == null ? void 0 : _a.myshopifyDomain) || null,
+    subscriptions: (((_b = data == null ? void 0 : data.currentAppInstallation) == null ? void 0 : _b.activeSubscriptions) || []).map((subscription) => {
+      var _a2;
+      return {
+        ...subscription,
+        metered: ((subscription == null ? void 0 : subscription.lineItems) || []).some(
+          (item) => {
+            var _a3, _b2;
+            return ((_b2 = (_a3 = item == null ? void 0 : item.plan) == null ? void 0 : _a3.pricingDetails) == null ? void 0 : _b2.__typename) === "AppUsagePricing";
+          }
+        ),
+        // The usage line's own id — the address appUsageRecordCreate charges
+        // against. Null when the approval carries no usage component.
+        usageLineItemId: ((_a2 = ((subscription == null ? void 0 : subscription.lineItems) || []).find(
+          (item) => {
+            var _a3, _b2;
+            return ((_b2 = (_a3 = item == null ? void 0 : item.plan) == null ? void 0 : _a3.pricingDetails) == null ? void 0 : _b2.__typename) === "AppUsagePricing";
+          }
+        )) == null ? void 0 : _a2.id) || null
+      };
+    })
+  };
+};
+var createUsageSubscription = async ({ fetcher, adminAccessToken, cappedAmount, currencyCode = "USD", domain, name, recurringPrice = 0, returnUrl, terms, test = false }) => {
+  if (!name || !returnUrl || !terms || !(Number(cappedAmount) > 0)) {
+    throw new Error("createUsageSubscription requires name, returnUrl, terms, and a positive cappedAmount");
+  }
+  ;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `mutation createUsageSubscription( $lineItems : [AppSubscriptionLineItemInput!]!, $name : String!, $returnUrl : URL!, $test : Boolean ) {
+			appSubscriptionCreate( lineItems : $lineItems, name : $name, returnUrl : $returnUrl, test : $test ) {
+				appSubscription { id name status test lineItems { id plan { pricingDetails { __typename } } } }
+				confirmationUrl
+				userErrors { field message }
+			}
+		}`,
+    variables: {
+      lineItems: [
+        {
+          plan: {
+            appRecurringPricingDetails: {
+              interval: "EVERY_30_DAYS",
+              price: { amount: Number(recurringPrice), currencyCode }
+            }
+          }
+        },
+        {
+          plan: {
+            appUsagePricingDetails: {
+              cappedAmount: { amount: Number(cappedAmount), currencyCode },
+              terms
+            }
+          }
+        }
+      ],
+      name,
+      returnUrl,
+      test
+    }
+  });
+  const payload = data == null ? void 0 : data.appSubscriptionCreate;
+  const userErrors = (payload == null ? void 0 : payload.userErrors) || [];
+  if (userErrors.length) {
+    throw new Error("Shopify subscription create failed: " + userErrors.map((entry) => entry.message).join("; "));
+  }
+  ;
+  if (!(payload == null ? void 0 : payload.confirmationUrl)) {
+    throw new Error("Shopify subscription create failed: no confirmation url returned");
+  }
+  ;
+  return {
+    confirmationUrl: payload.confirmationUrl,
+    subscription: payload.appSubscription
+  };
+};
+var createUsageRecord = async ({ fetcher, adminAccessToken, amount, currencyCode = "USD", description, domain, idempotencyKey, subscriptionLineItemId }) => {
+  var _a;
+  if (!subscriptionLineItemId || !description || !(Number(amount) > 0)) {
+    throw new Error("createUsageRecord requires subscriptionLineItemId, description, and a positive amount");
+  }
+  ;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `mutation createUsageRecord( $description : String!, $idempotencyKey : String, $price : MoneyInput!, $subscriptionLineItemId : ID! ) {
+			appUsageRecordCreate( description : $description, idempotencyKey : $idempotencyKey, price : $price, subscriptionLineItemId : $subscriptionLineItemId ) {
+				appUsageRecord { id }
+				userErrors { field message }
+			}
+		}`,
+    variables: {
+      description,
+      idempotencyKey: idempotencyKey ? String(idempotencyKey) : null,
+      price: { amount: Number(amount), currencyCode },
+      subscriptionLineItemId
+    }
+  });
+  const payload = data == null ? void 0 : data.appUsageRecordCreate;
+  const userErrors = (payload == null ? void 0 : payload.userErrors) || [];
+  if (userErrors.length || !((_a = payload == null ? void 0 : payload.appUsageRecord) == null ? void 0 : _a.id)) {
+    throw new Error("Shopify usage record failed: " + (userErrors.map((entry) => entry.message).join("; ") || "no record returned"));
+  }
+  ;
+  return { id: payload.appUsageRecord.id };
+};
+var getProductInventory = async ({ fetcher, adminAccessToken, domain, productId }) => {
+  var _a, _b;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `{
+			product( id : "${productId}" ) {
+				variants( first : 100 ) {
+					edges {
+						node {
+							id
+							inventoryQuantity
+						}
+					}
+				}
+			}
+		}`
+  });
+  const edges = ((_b = (_a = data == null ? void 0 : data.product) == null ? void 0 : _a.variants) == null ? void 0 : _b.edges) || [];
+  return edges.reduce((accumulator, edge) => {
+    var _a2, _b2;
+    const id = (_a2 = edge == null ? void 0 : edge.node) == null ? void 0 : _a2.id;
+    const quantity = (_b2 = edge == null ? void 0 : edge.node) == null ? void 0 : _b2.inventoryQuantity;
+    if (id) {
+      accumulator[id] = Number.isFinite(quantity) ? quantity : 0;
+    }
+    ;
+    return accumulator;
+  }, {});
+};
+var getProductUpdatedAt = async ({ adminAccessToken, domain, fetcher, productId }) => {
+  var _a;
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain,
+    query: `
+			query ProductUpdatedAt($id: ID!) {
+				product(id: $id) {
+					updatedAt
+				}
+			}
+		`,
+    variables: { id: productId }
+  });
+  return ((_a = data == null ? void 0 : data.product) == null ? void 0 : _a.updatedAt) || null;
+};
+var NOT_ON_CHANNEL = "not available to the channel";
+var OUTDATED_FEEDBACK = "later version";
+var sendProductResourceFeedback = async ({ fetcher, adminAccessToken, domain, productId, state, messages = [] }) => {
+  var _a, _b, _c;
+  const productUpdatedAt = await getProductUpdatedAt({ adminAccessToken, domain, fetcher, productId });
+  if (!productUpdatedAt) return null;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const submit = async (version) => {
+    const data = await adminFetch({
+      fetcher,
+      adminAccessToken,
+      domain,
+      query: `
+				mutation ProductFeedback($feedbackInput: [ProductResourceFeedbackInput!]!) {
+					bulkProductResourceFeedbackCreate(feedbackInput: $feedbackInput) {
+						feedback {
+							productId
+							state
+						}
+						userErrors {
+							field
+							message
+						}
+					}
+				}
+			`,
+      variables: {
+        feedbackInput: [
+          {
+            productId,
+            state,
+            feedbackGeneratedAt: now,
+            productUpdatedAt: version,
+            messages
+          }
+        ]
+      }
+    });
+    return data == null ? void 0 : data.bulkProductResourceFeedbackCreate;
+  };
+  let result = await submit(productUpdatedAt);
+  if ((((_b = (_a = result == null ? void 0 : result.userErrors) == null ? void 0 : _a[0]) == null ? void 0 : _b.message) || "").toLowerCase().includes(OUTDATED_FEEDBACK)) {
+    result = await submit(now);
+  }
+  ;
+  const feedbackErrors = result == null ? void 0 : result.userErrors;
+  if (feedbackErrors == null ? void 0 : feedbackErrors.length) {
+    const message = feedbackErrors[0].message || "";
+    if (message.toLowerCase().includes(NOT_ON_CHANNEL)) return null;
+    throw new Error("Shopify product feedback failed: " + message);
+  }
+  ;
+  return ((_c = result == null ? void 0 : result.feedback) == null ? void 0 : _c[0]) || null;
+};
+
+// lib/shopify/billing.js
+var billing_exports = {};
+__export(billing_exports, {
+  sendAppEvent: () => sendAppEvent
+});
+var APP_API = "https://api.shopify.com";
+var APP_API_VERSION = process.env.SHOPIFY_APP_API_VERSION || SHOPIFY_APP_API_VERSION;
+var cachedTokens = {};
+var fetchAppToken = async ({ clientId, clientSecret, fetcher }) => {
+  const data = await request({
+    fetcher,
+    method: "POST",
+    url: APP_API + "/auth/access_token",
+    body: {
+      client_id: clientId,
+      client_secret: clientSecret,
+      grant_type: "client_credentials"
+    }
+  });
+  if (!(data == null ? void 0 : data.access_token)) {
+    throw new Error("Shopify app token request failed: no access token returned");
+  }
+  ;
+  const ttl = data.expires_in ? data.expires_in * 1e3 : 60 * 60 * 1e3;
+  cachedTokens[clientId] = {
+    expiresAt: Date.now() + ttl - 60 * 1e3,
+    token: data.access_token
+  };
+  return data.access_token;
+};
+var getAppToken = async ({ clientId, clientSecret, fetcher }) => {
+  const cached = cachedTokens[clientId];
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.token;
+  }
+  ;
+  return fetchAppToken({ clientId, clientSecret, fetcher });
+};
+var toShopGid = (shopId) => String(shopId).startsWith("gid://") ? String(shopId) : "gid://shopify/Shop/" + shopId;
+var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference: reference2, revision, shopId, timestamp, value }) => {
+  if (!shopId || !eventHandle || !(Number(value) > 0)) {
+    throw new Error("sendAppEvent requires shopId, eventHandle, and a positive value");
+  }
+  ;
+  if (!clientId || !clientSecret) {
+    throw new Error("sendAppEvent requires clientId and clientSecret");
+  }
+  ;
+  const suffix = revision ? ".r" + revision : "";
+  const key = idempotencyKey && String(idempotencyKey).slice(0, Math.max(0, 64 - suffix.length)) + suffix;
+  const body = {
+    attributes: {
+      value: Number(value),
+      ...reference2 && {
+        reference: String(reference2).slice(0, 128)
+      }
+    },
+    event_handle: eventHandle,
+    shop_id: toShopGid(shopId),
+    timestamp: timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    ...key && {
+      idempotency_key: key
+    }
+  };
+  const send2 = async (token) => request({
+    method: "POST",
+    url: APP_API + "/app/" + APP_API_VERSION + "/events",
+    headers: {
+      "Authorization": "Bearer " + token
+    },
+    body
+  });
+  try {
+    return await send2(await getAppToken({ clientId, clientSecret, fetcher }));
+  } catch (error) {
+    if ((error == null ? void 0 : error.status) === 401) {
+      delete cachedTokens[clientId];
+      return send2(await fetchAppToken({ clientId, clientSecret, fetcher }));
+    }
+    ;
+    throw error;
+  }
+};
+
+// lib/shopify/oauth.js
+var oauth_exports = {};
+__export(oauth_exports, {
+  SHOPIFY_REQUIRED_SCOPES: () => SHOPIFY_REQUIRED_SCOPES,
+  createStorefrontToken: () => createStorefrontToken,
+  getAdminToken: () => getAdminToken,
+  getShop: () => getShop,
+  missingScopes: () => missingScopes2,
+  ping: () => ping,
+  refreshAdminToken: () => refreshAdminToken,
+  resolveConnectionSettings: () => resolveConnectionSettings
+});
+var required = (name, value) => {
+  if (!value) {
+    throw new Error("Shopify " + name + " is required");
+  }
+  ;
+  return value;
+};
+var missingScopes2 = (granted) => {
+  const grantedSet = new Set(
+    (Array.isArray(granted) ? granted : String(granted || "").split(",")).map((scope) => scope.trim()).filter(Boolean)
+  );
+  const satisfied = (scope) => grantedSet.has(scope) || grantedSet.has(scope.replace(/(^|_)read_/, "$1write_"));
+  return SHOPIFY_REQUIRED_SCOPES.filter((scope) => !satisfied(scope));
+};
+var ping = async ({ fetcher, adminAccessToken, domain }) => {
+  var _a;
+  const response = await fetch(
+    `https://${domain}/admin/api/${SHOPIFY_ADMIN_API_VERSION}/graphql.json`,
+    {
+      body: JSON.stringify({ query: "{ shop { name } }" }),
+      headers: {
+        "Content-Type": "application/json",
+        "X-Shopify-Access-Token": adminAccessToken
+      },
+      method: "POST"
+    }
+  );
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    const error = new Error(response.status + ": " + text);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const { errors } = await response.json().catch(() => ({}));
+  if (errors == null ? void 0 : errors.length) {
+    throw new Error("GraphQL: " + (((_a = errors[0]) == null ? void 0 : _a.message) || "unknown error"));
+  }
+  ;
+};
+var OAUTH_ERROR_TITLE_PATTERN = /Oauth error (\w+)/i;
+var parseOAuthErrorCode = (text) => {
+  var _a;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed == null ? void 0 : parsed.error) return parsed.error;
+  } catch {
+  }
+  ;
+  return ((_a = text.match(OAUTH_ERROR_TITLE_PATTERN)) == null ? void 0 : _a[1]) || null;
+};
+var shopifyOAuthFetch = async (url, body) => {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    const error = new Error(response.status + ": " + text);
+    error.status = response.status;
+    error.code = parseOAuthErrorCode(text);
+    throw error;
+  }
+  ;
+  return response.json();
+};
+var getShop = async ({ fetcher, adminAccessToken, shop }) => {
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain: shop,
+    query: `{
+			shop {
+				currencyCode
+				id
+				myshopifyDomain
+				name
+			}
+		}`
+  });
+  const shopData = data == null ? void 0 : data.shop;
+  if (!(shopData == null ? void 0 : shopData.id)) {
+    throw new Error("Shopify shop lookup failed: no shop returned");
+  }
+  ;
+  return {
+    currency: shopData.currencyCode || null,
+    id: shopData.id.split("/").pop(),
+    myshopifyDomain: shopData.myshopifyDomain,
+    name: shopData.name
+  };
+};
+var createStorefrontToken = async ({ fetcher, adminAccessToken, shop }) => {
+  var _a, _b, _c, _d, _e;
+  try {
+    const listed = await adminFetch({
+      fetcher,
+      adminAccessToken,
+      domain: shop,
+      query: `{
+				shop {
+					storefrontAccessTokens(first: 100) {
+						edges {
+							node {
+								id
+								title
+							}
+						}
+					}
+				}
+			}`
+    });
+    const existing = (((_b = (_a = listed == null ? void 0 : listed.shop) == null ? void 0 : _a.storefrontAccessTokens) == null ? void 0 : _b.edges) || []).map((edge) => edge == null ? void 0 : edge.node);
+    const orphaned = existing.filter((token) => (token == null ? void 0 : token.title) === "Drawbridge");
+    await Promise.allSettled(
+      orphaned.map((token) => adminFetch({
+        adminAccessToken,
+        domain: shop,
+        query: `
+					mutation StorefrontAccessTokenDelete($input: StorefrontAccessTokenDeleteInput!) {
+						storefrontAccessTokenDelete(input: $input) {
+							deletedStorefrontAccessTokenId
+							userErrors {
+								field
+								message
+							}
+						}
+					}
+				`,
+        variables: {
+          input: {
+            id: token.id
+          }
+        }
+      }))
+    );
+  } catch {
+  }
+  const created = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain: shop,
+    query: `
+			mutation StorefrontAccessTokenCreate($input: StorefrontAccessTokenInput!) {
+				storefrontAccessTokenCreate(input: $input) {
+					storefrontAccessToken {
+						accessToken
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      input: {
+        title: "Drawbridge"
+      }
+    }
+  });
+  const createErrors = (_c = created == null ? void 0 : created.storefrontAccessTokenCreate) == null ? void 0 : _c.userErrors;
+  if (createErrors == null ? void 0 : createErrors.length) {
+    throw new Error("Shopify storefront token create failed: " + createErrors[0].message);
+  }
+  ;
+  return ((_e = (_d = created == null ? void 0 : created.storefrontAccessTokenCreate) == null ? void 0 : _d.storefrontAccessToken) == null ? void 0 : _e.accessToken) || null;
+};
+var resolveTokenContext = async ({ connection, controller }) => {
+  const decrypted = (connection == null ? void 0 : connection.settings) ? decrypt(connection.settings) : {};
+  if ((decrypted == null ? void 0 : decrypted.ref) !== "shop") {
+    return {
+      raw: (connection == null ? void 0 : connection.settings) || null,
+      session: null,
+      settings: decrypted,
+      shop: null,
+      target: "connection"
+    };
+  }
+  ;
+  const shop = decrypted.shop;
+  if (!controller || !shop) {
+    return { raw: null, session: {}, settings: {}, shop, target: "shop" };
+  }
+  ;
+  const record = await controller.get({ collection: "shop", query: { shop } });
+  const session = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : {};
+  const storefront = (record == null ? void 0 : record.storefront) ? decrypt(record.storefront) : null;
+  return {
+    raw: (record == null ? void 0 : record.settings) || null,
+    session,
+    settings: {
+      adminAccessToken: session.accessToken || null,
+      refreshToken: session.refreshToken || null,
+      refreshTokenExpiresAt: session.refreshTokenExpires || null,
+      storefrontAccessToken: (storefront == null ? void 0 : storefront.token) || null,
+      tokenExpiresAt: session.expires || null
+    },
+    shop,
+    target: "shop"
+  };
+};
+var resolveConnectionSettings = async ({ fetcher, connection, controller }) => {
+  const { settings } = await resolveTokenContext({ connection, controller });
+  return settings;
+};
+var refreshAdminToken = async ({ fetcher, clientId, clientSecret, connection, controller }) => {
+  var _a;
+  const { raw, session, settings, shop, target } = await resolveTokenContext({ connection, controller });
+  const domain = (connection == null ? void 0 : connection.shop) || ((_a = settings.source) == null ? void 0 : _a.domain) || settings.domain || shop;
+  const { refreshToken } = settings;
+  const data = await shopifyOAuthFetch(
+    `https://${domain}/admin/oauth/access_token`,
+    {
+      grant_type: "refresh_token",
+      // Throw before the grant: rotation RETIRES the old pair the moment it
+      // returns, so a credential-less call that Shopify rejects opaquely is
+      // the one failure mode worth being loud about.
+      client_id: required("clientId", clientId),
+      client_secret: required("clientSecret", clientSecret),
+      refresh_token: refreshToken
+    }
+  );
+  const adminAccessToken = data.access_token;
+  const newRefreshToken = data.refresh_token;
+  const expiresIn = data.expires_in;
+  const tokenExpiresAt = expiresIn ? new Date(Date.now() + expiresIn * 1e3) : null;
+  const refreshTokenExpiresAt = new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS);
+  let liveToken = adminAccessToken;
+  if (target === "shop") {
+    const written = await controller.update({
+      collection: "shop",
+      data: {
+        $set: {
+          settings: encrypt({
+            ...session,
+            accessToken: adminAccessToken,
+            expires: tokenExpiresAt,
+            refreshToken: newRefreshToken,
+            refreshTokenExpires: refreshTokenExpiresAt
+          })
+        }
+      },
+      query: {
+        shop,
+        ...raw && { settings: raw }
+      }
+    });
+    if (!written) {
+      const current = await controller.get({ collection: "shop", query: { shop } });
+      if (!(current == null ? void 0 : current.settings)) {
+        throw new Error("Shopify token refresh write-back failed: shop record missing for " + shop);
+      }
+      ;
+      const currentSession = decrypt(current.settings);
+      if ((currentSession == null ? void 0 : currentSession.accessToken) && currentSession.accessToken !== settings.adminAccessToken) {
+        liveToken = currentSession.accessToken;
+      } else {
+        throw new Error("Shopify token refresh write-back failed for " + shop);
+      }
+      ;
+    }
+    ;
+  } else {
+    const written = await controller.update({
+      collection: "connection",
+      data: {
+        $set: {
+          settings: encrypt({
+            ...settings,
+            adminAccessToken,
+            refreshToken: newRefreshToken,
+            refreshTokenExpiresAt,
+            tokenExpiresAt
+          })
+        }
+      },
+      query: {
+        id: connection.id,
+        ...raw && { settings: raw }
+      }
+    });
+    if (!written) {
+      const current = await controller.get({ collection: "connection", query: { id: connection.id } });
+      const currentSettings = (current == null ? void 0 : current.settings) ? decrypt(current.settings) : null;
+      if ((currentSettings == null ? void 0 : currentSettings.adminAccessToken) && currentSettings.adminAccessToken !== settings.adminAccessToken) {
+        liveToken = currentSettings.adminAccessToken;
+      } else {
+        throw new Error("Shopify token refresh write-back failed for connection " + (connection == null ? void 0 : connection.id));
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  await ping({ adminAccessToken: liveToken, domain });
+  return liveToken;
+};
+var getAdminToken = async ({ fetcher, clientId, clientSecret, connection, controller }) => {
+  required("clientId", clientId);
+  required("clientSecret", clientSecret);
+  const settings = await resolveConnectionSettings({ connection, controller });
+  const { adminAccessToken, refreshToken, tokenExpiresAt } = settings;
+  if (!adminAccessToken) {
+    return null;
+  }
+  ;
+  if (!refreshToken) {
+    return adminAccessToken;
+  }
+  ;
+  const needsRefresh = !tokenExpiresAt || new Date(tokenExpiresAt) < new Date(Date.now() + ACCESS_TOKEN_REFRESH_BUFFER_MS);
+  if (needsRefresh) {
+    return refreshAdminToken({ clientId, clientSecret, connection, controller });
+  }
+  ;
+  return adminAccessToken;
+};
+
+// lib/shopify/partner.js
+var partner_exports = {};
+__export(partner_exports, {
+  getUsageChargeEvents: () => getUsageChargeEvents
+});
+var PARTNER_API = "https://partners.shopify.com";
+var getUsageChargeEvents = async ({ fetcher, appId, first = 10, occurredAtMin, organizationId, partnerToken, shopId }) => {
+  var _a, _b, _c;
+  if (!partnerToken || !organizationId || !appId) {
+    throw new Error("getUsageChargeEvents requires partnerToken, organizationId, and appId");
+  }
+  ;
+  const data = await request({
+    fetcher,
+    method: "POST",
+    url: PARTNER_API + "/" + organizationId + "/api/" + PARTNER_API_VERSION + "/graphql.json",
+    headers: {
+      "X-Shopify-Access-Token": partnerToken
+    },
+    body: {
+      query: `query usageCharges( $filter : EventFilterInput!, $first : Int! ) {
+				events( filter : $filter, orderBy : OCCURRED_AT_DESC, first : $first ) {
+					edges {
+						node {
+							id
+							occurredAt
+							eventType
+							shop { id myshopifyDomain }
+							... on Charge {
+								chargeId
+								chargeType
+								amount { amount currencyCode }
+								usageQuantity
+								planHandle
+								description
+							}
+						}
+					}
+					pageInfo { hasNextPage endCursor }
+				}
+			}`,
+      variables: {
+        filter: {
+          eventTypes: ["CHARGE_USAGE"],
+          subjectId: String(appId),
+          ...occurredAtMin && { occurredAtMin },
+          ...shopId && { shopId: String(shopId) }
+        },
+        first
+      }
+    }
+  });
+  if ((_a = data == null ? void 0 : data.errors) == null ? void 0 : _a.length) {
+    throw new Error("Shopify partner events query failed: " + data.errors.map((entry) => entry.message).join("; "));
+  }
+  ;
+  return (((_c = (_b = data == null ? void 0 : data.data) == null ? void 0 : _b.events) == null ? void 0 : _c.edges) || []).map((edge) => {
+    var _a2, _b2, _c2, _d, _e, _f, _g, _h, _i, _j;
+    return {
+      amount: ((_a2 = edge.node) == null ? void 0 : _a2.amount) || null,
+      chargeId: ((_b2 = edge.node) == null ? void 0 : _b2.chargeId) || null,
+      // USAGE vs the recurring plan charge an approval emits — the
+      // disambiguator callers filter on.
+      chargeType: ((_c2 = edge.node) == null ? void 0 : _c2.chargeType) || null,
+      description: ((_d = edge.node) == null ? void 0 : _d.description) || null,
+      eventType: ((_e = edge.node) == null ? void 0 : _e.eventType) || null,
+      id: ((_f = edge.node) == null ? void 0 : _f.id) || null,
+      occurredAt: ((_g = edge.node) == null ? void 0 : _g.occurredAt) || null,
+      planHandle: ((_h = edge.node) == null ? void 0 : _h.planHandle) || null,
+      shop: ((_i = edge.node) == null ? void 0 : _i.shop) || null,
+      usageQuantity: ((_j = edge.node) == null ? void 0 : _j.usageQuantity) ?? null
+    };
+  });
+};
+
+// lib/shopify/storefront.js
+var storefront_exports = {};
+__export(storefront_exports, {
+  cartCreate: () => cartCreate,
+  cartGet: () => cartGet,
+  cartLinesAdd: () => cartLinesAdd,
+  cartLinesRemove: () => cartLinesRemove,
+  cartLinesUpdate: () => cartLinesUpdate,
+  createCheckoutToken: () => createCheckoutToken,
+  getProduct: () => getProduct,
+  getProductVariantsPage: () => getProductVariantsPage,
+  getProducts: () => getProducts,
+  probeVariantsOutOfStock: () => probeVariantsOutOfStock
+});
+var SORT_KEY_MAP = {
+  bestSelling: "BEST_SELLING",
+  createdAt: "CREATED_AT",
+  id: "ID",
+  price: "PRICE",
+  productType: "PRODUCT_TYPE",
+  title: "TITLE",
+  updatedAt: "UPDATED_AT",
+  vendor: "VENDOR"
+};
+var resolveProductSort = (sort) => {
+  const entry = sort && Object.entries(sort)[0];
+  if (!entry) return null;
+  const [field, direction] = entry;
+  const sortKey = SORT_KEY_MAP[field];
+  if (!sortKey) return null;
+  return {
+    sortKey,
+    reverse: Number(direction) < 0
+  };
+};
+var storefrontUrl = (domain) => `https://${domain}/api/${SHOPIFY_STOREFRONT_API_VERSION}/graphql.json`;
+var storefrontFetch = async ({ fetcher, domain, storefrontAccessToken, query, variables }) => {
+  return request({
+    method: "POST",
+    url: storefrontUrl(domain),
+    headers: {
+      "X-Shopify-Storefront-Access-Token": storefrontAccessToken
+    },
+    body: {
+      query,
+      ...variables && { variables }
+    }
+  });
+};
+var shopCountryCache = {};
+var getShopCountry = async ({ domain, fetcher, storefrontAccessToken }) => {
+  var _a, _b;
+  if (shopCountryCache[domain]) return shopCountryCache[domain];
+  const { data } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `{
+			shop {
+				paymentSettings {
+					countryCode
+				}
+			}
+		}`
+  });
+  const countryCode = ((_b = (_a = data == null ? void 0 : data.shop) == null ? void 0 : _a.paymentSettings) == null ? void 0 : _b.countryCode) || null;
+  if (countryCode) shopCountryCache[domain] = countryCode;
+  return countryCode;
+};
+var OUT_OF_STOCK_WARNING_CODES = [
+  "MERCHANDISE_OUT_OF_STOCK",
+  "MERCHANDISE_NOT_ENOUGH_STOCK"
+];
+var probeVariantsOutOfStock = async ({ fetcher, domain, storefrontAccessToken, variantIds, countryCode }) => {
+  var _a, _b;
+  if (!(variantIds == null ? void 0 : variantIds.length)) return [];
+  const resolvedCountry = countryCode || await getShopCountry({ domain, fetcher, storefrontAccessToken });
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			mutation probe( $input : CartInput! ){
+				cartCreate( input : $input ){
+					cart {
+						lines( first : 250 ){
+							edges {
+								node {
+									id
+									merchandise {
+										... on ProductVariant {
+											id
+										}
+									}
+								}
+							}
+						}
+					}
+					warnings {
+						code
+						message
+						target
+					}
+				}
+			}
+		`,
+    variables: {
+      input: {
+        lines: variantIds.map((merchandiseId) => ({
+          merchandiseId,
+          quantity: 1
+        })),
+        ...resolvedCountry && {
+          buyerIdentity: {
+            countryCode: resolvedCountry
+          }
+        }
+      }
+    }
+  });
+  if (errors) return [];
+  const payload = data == null ? void 0 : data.cartCreate;
+  const soldOut = new Set(
+    ((payload == null ? void 0 : payload.warnings) || []).filter((warning) => OUT_OF_STOCK_WARNING_CODES.includes(warning == null ? void 0 : warning.code) && (warning == null ? void 0 : warning.target)).map((warning) => warning.target)
+  );
+  return (((_b = (_a = payload == null ? void 0 : payload.cart) == null ? void 0 : _a.lines) == null ? void 0 : _b.edges) || []).filter(({ node }) => soldOut.has(node.id)).map(({ node }) => {
+    var _a2;
+    return (_a2 = node == null ? void 0 : node.merchandise) == null ? void 0 : _a2.id;
+  }).filter(Boolean);
+};
+var productsQuery = (search, cursor, limit, sort) => {
+  const resolved = resolveProductSort(sort);
+  const sortArgs = resolved ? `, sortKey: ${resolved.sortKey}, reverse: ${resolved.reverse}` : "";
+  return `{
+	products(first: ${limit}${search ? `, query: "title:*${search}*"` : ""}${cursor ? `, after: "${cursor}"` : ""}${sortArgs}) {
+		edges {
+			node {
+				id
+				title
+				description
+				handle
+				productType
+				featuredImage {
+					url
+				}
+				variants(first: 10) {
+					edges {
+						node {
+							id
+							title
+							image {
+								url
+							}
+							price {
+								amount
+								currencyCode
+							}
+							compareAtPrice {
+								amount
+								currencyCode
+							}
+							availableForSale
+							requiresShipping
+						}
+					}
+				}
+			}
+		}
+		pageInfo {
+			endCursor
+			hasNextPage
+			hasPreviousPage
+			startCursor
+		}
+	}
+}`;
+};
+var productQuery = (productId) => `{
+	product(id: "${productId}") {
+		id
+		title
+		description
+		handle
+		productType
+		featuredImage {
+			url
+		}
+		variants(first: 10) {
+			edges {
+				node {
+					id
+					title
+					image {
+						url
+					}
+					price {
+						amount
+						currencyCode
+					}
+					compareAtPrice {
+						amount
+						currencyCode
+					}
+					availableForSale
+					requiresShipping
+				}
+			}
+		}
+	}
+}`;
+var variantsQuery = (productId, cursor) => `{
+	product(id: "${productId}") {
+		variants(first: 250${cursor ? `, after: "${cursor}"` : ""}) {
+			edges {
+				node {
+					id
+					title
+					image {
+						url
+					}
+					price {
+						amount
+						currencyCode
+					}
+					compareAtPrice {
+						amount
+						currencyCode
+					}
+					availableForSale
+					requiresShipping
+				}
+			}
+			pageInfo {
+				hasNextPage
+				endCursor
+			}
+		}
+	}
+}`;
+var getProducts = async ({ fetcher, domain, storefrontAccessToken, search, cursor, limit, sort }) => {
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: productsQuery(search, cursor, limit, sort)
+  });
+  if (errors) {
+    throw new Error("Failed to fetch Shopify products");
+  }
+  ;
+  return data == null ? void 0 : data.products;
+};
+var getProduct = async ({ fetcher, domain, storefrontAccessToken, productId }) => {
+  var _a;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: productQuery(productId)
+  });
+  if (errors) {
+    throw new Error("Shopify storefront error: " + ((_a = errors[0]) == null ? void 0 : _a.message));
+  }
+  ;
+  if (!(data == null ? void 0 : data.product)) {
+    throw new Error("Shopify product not found");
+  }
+  ;
+  return data.product;
+};
+var getProductVariantsPage = async ({ fetcher, domain, storefrontAccessToken, productId, cursor }) => {
+  var _a;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: variantsQuery(productId, cursor)
+  });
+  if (errors) {
+    throw new Error("Shopify storefront error: " + ((_a = errors[0]) == null ? void 0 : _a.message));
+  }
+  ;
+  if (!(data == null ? void 0 : data.product)) {
+    throw new Error("Shopify product not found");
+  }
+  ;
+  return data.product.variants;
+};
+var CART_FIELDS = `
+	id
+	checkoutUrl
+	lines(first: 100) {
+		edges {
+			node {
+				id
+				quantity
+				merchandise {
+					... on ProductVariant {
+						id
+						title
+						availableForSale
+						image {
+							url
+						}
+						price {
+							amount
+							currencyCode
+						}
+						product {
+							title
+						}
+					}
+				}
+			}
+		}
+	}
+`;
+var mapCart = (cart) => {
+  var _a;
+  if (!cart) return null;
+  return {
+    checkoutUrl: cart.checkoutUrl,
+    id: cart.id,
+    lines: (((_a = cart.lines) == null ? void 0 : _a.edges) || []).map(({ node }) => {
+      var _a2, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+      return {
+        availableForSale: ((_a2 = node == null ? void 0 : node.merchandise) == null ? void 0 : _a2.availableForSale) ?? true,
+        currency: ((_c = (_b = node == null ? void 0 : node.merchandise) == null ? void 0 : _b.price) == null ? void 0 : _c.currencyCode) || null,
+        id: node.id,
+        image: ((_e = (_d = node == null ? void 0 : node.merchandise) == null ? void 0 : _d.image) == null ? void 0 : _e.url) || null,
+        price: ((_g = (_f = node == null ? void 0 : node.merchandise) == null ? void 0 : _f.price) == null ? void 0 : _g.amount) || null,
+        productTitle: ((_i = (_h = node == null ? void 0 : node.merchandise) == null ? void 0 : _h.product) == null ? void 0 : _i.title) || null,
+        quantity: node.quantity,
+        variantId: (_j = node == null ? void 0 : node.merchandise) == null ? void 0 : _j.id,
+        variantTitle: ((_k = node == null ? void 0 : node.merchandise) == null ? void 0 : _k.title) || null
+      };
+    })
+  };
+};
+var firstUserError = (userErrors) => {
+  const error = userErrors == null ? void 0 : userErrors[0];
+  if (!error) return null;
+  const message = new Error(error.message || "Shopify cart error");
+  message.userError = true;
+  return message;
+};
+var createCheckoutToken = async ({ fetcher, clientId, clientSecret } = {}) => {
+  if (!clientId || !clientSecret) {
+    throw new Error("createCheckoutToken requires clientId and clientSecret");
+  }
+  ;
+  const response = await request({
+    fetcher,
+    method: "POST",
+    url: "https://api.shopify.com/auth/access_token",
+    body: {
+      client_id: clientId,
+      client_secret: clientSecret,
+      grant_type: "client_credentials"
+    }
+  });
+  const token = response == null ? void 0 : response.access_token;
+  if (!token) {
+    throw new Error("Failed to create Shopify checkout token");
+  }
+  ;
+  return token;
+};
+var cartCreate = async ({ fetcher, domain, storefrontAccessToken, lines }) => {
+  var _a, _b;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			mutation cartCreate($input: CartInput!) {
+				cartCreate(input: $input) {
+					cart {
+						${CART_FIELDS}
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      input: {
+        lines
+      }
+    }
+  });
+  if (errors) {
+    throw new Error("Failed to create Shopify cart");
+  }
+  ;
+  const userError = firstUserError((_a = data == null ? void 0 : data.cartCreate) == null ? void 0 : _a.userErrors);
+  if (userError) throw userError;
+  return mapCart((_b = data == null ? void 0 : data.cartCreate) == null ? void 0 : _b.cart);
+};
+var cartGet = async ({ fetcher, domain, storefrontAccessToken, cartId }) => {
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			query cart($id: ID!) {
+				cart(id: $id) {
+					${CART_FIELDS}
+				}
+			}
+		`,
+    variables: {
+      id: cartId
+    }
+  });
+  if (errors) {
+    throw new Error("Failed to fetch Shopify cart");
+  }
+  ;
+  return mapCart(data == null ? void 0 : data.cart);
+};
+var cartLinesAdd = async ({ fetcher, domain, storefrontAccessToken, cartId, lines }) => {
+  var _a, _b;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			mutation cartLinesAdd($cartId: ID!, $lines: [CartLineInput!]!) {
+				cartLinesAdd(cartId: $cartId, lines: $lines) {
+					cart {
+						${CART_FIELDS}
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      cartId,
+      lines
+    }
+  });
+  if (errors) {
+    throw new Error("Failed to add Shopify cart lines");
+  }
+  ;
+  const userError = firstUserError((_a = data == null ? void 0 : data.cartLinesAdd) == null ? void 0 : _a.userErrors);
+  if (userError) throw userError;
+  return mapCart((_b = data == null ? void 0 : data.cartLinesAdd) == null ? void 0 : _b.cart);
+};
+var cartLinesRemove = async ({ fetcher, domain, storefrontAccessToken, cartId, lineIds }) => {
+  var _a, _b;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			mutation cartLinesRemove($cartId: ID!, $lineIds: [ID!]!) {
+				cartLinesRemove(cartId: $cartId, lineIds: $lineIds) {
+					cart {
+						${CART_FIELDS}
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      cartId,
+      lineIds
+    }
+  });
+  if (errors) {
+    throw new Error("Failed to remove Shopify cart lines");
+  }
+  ;
+  const userError = firstUserError((_a = data == null ? void 0 : data.cartLinesRemove) == null ? void 0 : _a.userErrors);
+  if (userError) throw userError;
+  return mapCart((_b = data == null ? void 0 : data.cartLinesRemove) == null ? void 0 : _b.cart);
+};
+var cartLinesUpdate = async ({ fetcher, domain, storefrontAccessToken, cartId, lines }) => {
+  var _a, _b;
+  const { data, errors } = await storefrontFetch({
+    fetcher,
+    domain,
+    storefrontAccessToken,
+    query: `
+			mutation cartLinesUpdate($cartId: ID!, $lines: [CartLineUpdateInput!]!) {
+				cartLinesUpdate(cartId: $cartId, lines: $lines) {
+					cart {
+						${CART_FIELDS}
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      cartId,
+      lines
+    }
+  });
+  if (errors) {
+    throw new Error("Failed to update Shopify cart lines");
+  }
+  ;
+  const userError = firstUserError((_a = data == null ? void 0 : data.cartLinesUpdate) == null ? void 0 : _a.userErrors);
+  if (userError) throw userError;
+  return mapCart((_b = data == null ? void 0 : data.cartLinesUpdate) == null ? void 0 : _b.cart);
+};
+
+// lib/email.js
+var GMAIL_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
+var toCanonicalEmail = (value) => {
+  if (!value || typeof value !== "string") return null;
+  const email = value.trim().toLowerCase();
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return null;
+  let local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  const plus = local.indexOf("+");
+  if (plus > 0) local = local.slice(0, plus);
+  if (GMAIL_DOMAINS.has(domain)) local = local.replaceAll(".", "");
+  if (!local) return null;
+  return local + "@" + domain;
+};
+
+// lib/oauth/index.js
+var lifetimes = {
+  access: 60 * 60 * 8,
+  // 8 hours
+  authorizationCode: 10 * 60,
+  // 10 minutes
+  code: 15 * 60,
+  // 15 minutes (email OTC)
+  refresh: 30 * 24 * 60 * 60
+  // 30 days
+};
+var tokenTypes = {
+  access: "access",
+  oauthState: "oauth.state",
+  pat: "pat",
+  refresh: "refresh"
+};
+var scopes = [
+  "profile:read",
+  "profile:write",
+  "organization:read",
+  "organization:write",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write",
+  "billing:read",
+  "billing:write",
+  "admin"
+];
+var developer = [
+  "profile:read",
+  "organization:read",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write"
+];
+var scopeLabels = {
+  "profile:read": "Read own profile",
+  "profile:write": "Update own profile",
+  "organization:read": "Read organization info",
+  "organization:write": "Manage organization",
+  "campaigns:read": "Read campaigns",
+  "campaigns:write": "Manage campaigns",
+  "contacts:read": "Read contacts",
+  "contacts:write": "Manage contacts",
+  "workflows:read": "Read workflows",
+  "workflows:write": "Manage workflows",
+  "connections:read": "Read integrations",
+  "connections:write": "Manage integrations",
+  "billing:read": "Read billing",
+  "billing:write": "Manage billing",
+  admin: "Admin access"
+};
+var toOption = (scope) => ({
+  key: scopeLabels[scope] || scope,
+  value: scope
+});
+var developerOptions = developer.map(toOption);
+var scopeOptions = scopes.map(toOption);
+var hashToken = (raw) => hash(raw, process.env.HMAC_OAUTH_TOKEN_KEY);
+
+// lib/sanitize.js
+import disposableDomains from "disposable-email-domains/index.js";
+var disposableBlacklist = new Set(disposableDomains.map((d) => d.toLowerCase()));
+var sanitizeDomain = (value, pattern) => {
+  if (!value) return value;
+  const cleaned = value.trim().toLowerCase().replace(/^https?:\/\//i, "").replace(/\/+$/, "");
+  if (pattern) {
+    const match = cleaned.match(pattern);
+    return match ? match[0] : cleaned;
+  }
+  return cleaned;
+};
+
+// lib/slugify.js
+import slug from "slugify";
+var slugify = (value, nochars = false) => {
+  const remove = nochars ? /[-?*+~.()'"!:@#^_{}\[\];,/\\]/g : /[?*+~.()'"!:@#^_{}\[\];,/\\]/g;
+  const replacement = nochars ? "" : "-";
+  return slug(
+    value,
+    {
+      remove,
+      replacement,
+      lower: true,
+      trim: true
+    }
+  );
+};
+
+// lib/connections/manifests/shopify.js
+var client = Object.freeze({
+  admin: admin_exports,
+  billing: billing_exports,
+  oauth: oauth_exports,
+  partner: partner_exports,
+  storefront: storefront_exports
+});
+var toLine = ({
+  price,
+  product_id: productId,
+  quantity,
+  title,
+  variant_id: variantId,
+  variant_title: variantTitle
+}) => ({
+  price: parseFloat(price) || 0,
+  productId: productId ? "gid://shopify/Product/" + productId : null,
+  quantity: quantity || 1,
+  title: title || null,
+  variantId: variantId ? "gid://shopify/ProductVariant/" + variantId : null,
+  variantTitle: variantTitle || null
+});
+var attributeLineItems = (lineItems = []) => lineItems.reduce(
+  (acc, item) => {
+    const attrs = (item.properties || []).reduce(
+      (map, { name, value }) => {
+        map[name] = value;
+        return map;
+      },
+      {}
+    );
+    if (!attrs["_drwbrdg_ca"]) return acc;
+    if (!Object.keys(acc.attrMap).length) acc.attrMap = attrs;
+    const line = toLine(item);
+    acc.attributedGross += line.price * line.quantity;
+    acc.attributedLines.push(line);
+    return acc;
+  },
+  { attrMap: {}, attributedGross: 0, attributedLines: [] }
+);
+var generateDiscountCode = customAlphabet("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
+var blockedReason = (discount) => {
+  var _a;
+  if ((discount == null ? void 0 : discount.status) === "EXPIRED") return "This discount has expired.";
+  const buyers = (_a = discount == null ? void 0 : discount.context) == null ? void 0 : _a.__typename;
+  if (buyers && buyers !== "DiscountBuyerSelectionAll") {
+    return "This discount is limited to specific buyers in Shopify, so a code issued to an entrant won't work. Set it to all customers to use it here.";
+  }
+  ;
+  if (typeof (discount == null ? void 0 : discount.usageLimit) === "number" && discount.usageLimit > 0 && ((discount == null ? void 0 : discount.asyncUsageCount) || 0) >= discount.usageLimit) {
+    return "This discount has reached its total usage limit.";
+  }
+  ;
+  return null;
+};
+var discountWarning = (discount) => {
+  if ((discount == null ? void 0 : discount.status) === "SCHEDULED") {
+    return "This discount hasn't started yet, so codes issued before it does won't work until then.";
+  }
+  ;
+  if (discount == null ? void 0 : discount.appliesOncePerCustomer) return "Each customer can use this discount only once.";
+  return null;
+};
+var ORDER_EVENT_HANDLE = slugify("drawbridge-orders");
+var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
+var OAUTH_ERROR_SOURCE = "oauth";
+var BILLING_ERROR_SOURCE = "billing";
+var BILLING_ERROR_MESSAGE = "Order billing isn't set up for this store \u2014 reselect and approve the plan from the Shopify connection page.";
+var OAUTH_GRANT_REVOKED_CODES = ["application_cannot_be_found", "invalid_grant"];
+var inbound = {
+  headers: {
+    event: "x-shopify-topic",
+    id: "x-shopify-webhook-id",
+    shop: "x-shopify-shop-domain",
+    signature: "x-shopify-hmac-sha256"
+  },
+  signature: {
+    algorithm: "sha256",
+    encoding: "base64",
+    secret: "SHOPIFY_API_SECRET"
+  }
+};
 var COMPLIANCE_TOPICS = /* @__PURE__ */ new Set([
   "customers/data_request",
   "customers/redact",
   "shop/redact"
 ]);
+var refusal = (message, status) => Object.assign(new Error(message), { status });
+var LINK_TOKEN_TTL_MS = 30 * 60 * 1e3;
+var CONNECTABLE_STATUSES = ["active", "unsubscribed"];
+var merchantOrganizations = ({ read, user }) => read.aggregate({
+  collection: "organization",
+  pipeline: [
+    // A member qualifies only at `manage`; an owner always qualifies.
+    {
+      $lookup: {
+        as: "membership",
+        from: "member",
+        let: { organization: "$id" },
+        pipeline: [
+          {
+            $match: {
+              $expr: { $eq: ["$organization", "$$organization"] },
+              "capabilities.connections": "manage",
+              status: "accepted",
+              user
+            }
+          },
+          { $limit: 1 },
+          { $project: { _id: 0, organization: 1 } }
+        ]
+      }
+    },
+    {
+      $match: {
+        status: { $ne: "canceled" },
+        $or: [{ owner: user }, { "membership.0": { $exists: true } }]
+      }
+    },
+    // `organization.subscription` is a subscription RECORD ID — resolved here so
+    // the list can read the real plan and conversion rate. Without it every org
+    // rendered as free tier.
+    { $lookup: { as: "subscription", foreignField: "id", from: "subscription", localField: "subscription" } },
+    { $unwind: { path: "$subscription", preserveNullAndEmptyArrays: true } },
+    {
+      $lookup: {
+        as: "connection",
+        foreignField: "organization",
+        from: "connection",
+        localField: "id",
+        pipeline: [
+          { $match: { slug: "shopify" } },
+          { $limit: 1 },
+          { $project: { _id: 0, id: 1, shop: 1, status: 1 } }
+        ]
+      }
+    },
+    { $unwind: { path: "$connection", preserveNullAndEmptyArrays: true } },
+    { $project: { _id: 0, billingStatus: "$status", connection: 1, id: 1, name: "$title", subscription: 1 } },
+    { $sort: { name: 1 } }
+  ]
+});
+var storePlan = async ({ record, shopify }) => {
+  var _a;
+  const settings = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : null;
+  if (!(settings == null ? void 0 : settings.accessToken)) return { active: false, name: null };
+  try {
+    const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
+      adminAccessToken: settings.accessToken,
+      domain: record.shop
+    });
+    const active = (subscriptions || []).length > 0;
+    const metered = active && subscriptions.some((subscription) => subscription.metered === true) ? true : null;
+    return { active, metered, name: active ? ((_a = subscriptions[0]) == null ? void 0 : _a.name) || null : null };
+  } catch (_) {
+    return { active: false, name: null, unavailable: true };
+  }
+};
+var releaseApprovals = async ({ context, read, shopify }) => {
+  var _a;
+  const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+  if (!shop) throw refusal("shop is required", 400);
+  const record = await read.get({ collection: "shop", query: { shop } });
+  const settings = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : null;
+  if (!(settings == null ? void 0 : settings.accessToken)) throw refusal("Store is not installed", 409);
+  const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
+    adminAccessToken: settings.accessToken,
+    domain: shop
+  });
+  for (const subscription of subscriptions || []) {
+    const data = await shopify.admin.adminFetch({
+      adminAccessToken: settings.accessToken,
+      domain: shop,
+      query: "mutation appSubscriptionCancel( $id : ID! ) { appSubscriptionCancel( id : $id ) { appSubscription { id status } userErrors { field message } } }",
+      variables: { id: subscription.id }
+    });
+    const [userError] = ((_a = data == null ? void 0 : data.appSubscriptionCancel) == null ? void 0 : _a.userErrors) || [];
+    if (userError) throw refusal(userError.message, 422);
+  }
+  return {
+    message: "Released " + (subscriptions || []).length + " approval(s).",
+    request: { shop },
+    result: { ok: true }
+  };
+};
+var LEDGER_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
+var meterVerdict = async ({ adminAccessToken, ledgerFloor, partner, shop, shopId, shopify }) => {
+  var _a;
+  const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({ adminAccessToken, domain: shop });
+  let metered = (_a = subscriptions.find((subscription) => subscription.usageLineItemId)) == null ? void 0 : _a.usageLineItemId;
+  if (!((partner == null ? void 0 : partner.partnerToken) && (partner == null ? void 0 : partner.partnerOrgId) && (partner == null ? void 0 : partner.partnerAppId) && shopId)) {
+    return { boundaries: [], ledger: false, metered };
+  }
+  const accruals = await shopify.partner.getUsageChargeEvents({
+    appId: "gid://shopify/App/" + partner.partnerAppId,
+    first: 10,
+    occurredAtMin: ledgerFloor.toISOString(),
+    organizationId: partner.partnerOrgId,
+    partnerToken: partner.partnerToken,
+    shopId: "gid://shopify/Shop/" + shopId
+  });
+  const boundaries = (accruals || []).filter((event) => event.occurredAt).sort((a, b) => new Date(a.occurredAt) - new Date(b.occurredAt));
+  const accrued = [...boundaries].reverse().find((event) => Number(event.usageQuantity) > 0);
+  if (accrued) metered = String(accrued.chargeId || accrued.id);
+  return { boundaries, ledger: true, metered };
+};
+var toVariant = (edge) => {
+  var _a, _b, _c, _d;
+  return {
+    availableForSale: edge.node.availableForSale || false,
+    currency: ((_a = edge.node.price) == null ? void 0 : _a.currencyCode) || null,
+    id: edge.node.id,
+    image: ((_b = edge.node.image) == null ? void 0 : _b.url) || null,
+    price: parseFloat((_c = edge.node.price) == null ? void 0 : _c.amount) || null,
+    requiresShipping: edge.node.requiresShipping || false,
+    sale: parseFloat((_d = edge.node.compareAtPrice) == null ? void 0 : _d.amount) || null,
+    title: edge.node.title !== "Default Title" ? edge.node.title : null
+  };
+};
+var applyOutOfStock = async ({ domain, shopify, storefrontAccessToken, variants }) => {
+  try {
+    const outOfStock = new Set(await shopify.storefront.probeVariantsOutOfStock({
+      domain,
+      storefrontAccessToken,
+      variantIds: variants.map((variant) => variant.id)
+    }));
+    return variants.map((variant) => ({
+      ...variant,
+      availableForSale: variant.availableForSale && !outOfStock.has(variant.id)
+    }));
+  } catch (_) {
+    return variants;
+  }
+};
+var sendFeedback = async ({ adminToken, connection, messages, productId, shopify, state }) => {
+  try {
+    await shopify.admin.sendProductResourceFeedback({
+      adminAccessToken: await adminToken(),
+      domain: connection.shop,
+      messages,
+      productId,
+      state
+    });
+    return null;
+  } catch (error) {
+    return error;
+  }
+};
+var resolveProduct = async ({ connection, context, read }) => {
+  const byId = (context == null ? void 0 : context.product) ? await read.get({ collection: "product", query: { id: context.product } }) : null;
+  const row2 = byId || ((context == null ? void 0 : context.providerId) && ((context == null ? void 0 : context.shop) || (connection == null ? void 0 : connection.shop)) ? await read.get({
+    collection: "product",
+    query: {
+      "provider.id": context.providerId,
+      "provider.slug": "shopify",
+      "source.domain": context.shop || connection.shop
+    }
+  }) : null);
+  return row2;
+};
+var UNAVAILABLE_FEEDBACK = "Drawbridge can't display this product. Check it is active and available in the United States.";
+var NOT_FOUND = "Shopify product not found";
+var syncProduct = async ({ adminToken, connection, context, read, settings, shopify }) => {
+  var _a, _b, _c;
+  const row2 = await resolveProduct({ connection, context, read });
+  if (!row2) return { message: "No product row to sync.", request: { product: (context == null ? void 0 : context.product) || null }, skipped: true };
+  const domain = connection.shop;
+  const providerId = (_a = row2.provider) == null ? void 0 : _a.id;
+  const request2 = { product: row2.id, providerId: providerId || null, shop: domain };
+  let product;
+  try {
+    product = await shopify.storefront.getProduct({
+      domain,
+      productId: providerId,
+      storefrontAccessToken: settings == null ? void 0 : settings.storefrontAccessToken
+    });
+  } catch (error) {
+    if (error.message !== NOT_FOUND) throw error;
+    const failed2 = await sendFeedback({
+      adminToken,
+      connection,
+      messages: [UNAVAILABLE_FEEDBACK],
+      productId: providerId,
+      shopify,
+      state: "REQUIRES_ACTION"
+    });
+    return {
+      failed: failed2 ? [failed2.message] : void 0,
+      message: "Storefront cannot see this product \u2014 deactivated.",
+      request: request2,
+      result: { status: "inactive" },
+      writes: [
+        {
+          collection: "product",
+          data: { $set: { status: "inactive" } },
+          operation: "update",
+          query: { id: row2.id }
+        },
+        {
+          collection: "advertisement",
+          data: { $set: { status: "drafted" } },
+          multiple: true,
+          operation: "update",
+          query: { product: row2.id }
+        }
+      ]
+    };
+  }
+  const variants = await applyOutOfStock({
+    domain,
+    shopify,
+    storefrontAccessToken: settings == null ? void 0 : settings.storefrontAccessToken,
+    variants: (((_b = product == null ? void 0 : product.variants) == null ? void 0 : _b.edges) || []).map(toVariant)
+  });
+  const failed = await sendFeedback({
+    adminToken,
+    connection,
+    messages: [],
+    productId: providerId,
+    shopify,
+    state: "ACCEPTED"
+  });
+  return {
+    // EVERYTHING PAST THE FIRST PAGE, filled in silently. The first page is
+    // written above; a product with thousands of variants becomes N short
+    // sequential jobs rather than one long loop that risks a BullMQ stall.
+    enqueues: [{
+      data: { operation: "variants", product: row2.id },
+      name: "sync",
+      options: { jobId: "product.shopify.variants." + row2.id + "." + Date.now() },
+      queue: "product.shopify.variants"
+    }],
+    failed: failed ? [failed.message] : void 0,
+    message: "Synced " + (product.title || "product") + ".",
+    request: request2,
+    result: { status: "active", variants: variants.length },
+    writes: [{
+      collection: "product",
+      data: {
+        $set: {
+          description: product.description || null,
+          image: ((_c = product.featuredImage) == null ? void 0 : _c.url) || null,
+          // A successful sync PROVES channel visibility, which reverses the
+          // deactivation above. Ads stay drafted.
+          status: "active",
+          title: product.title || null,
+          type: product.productType || null,
+          url: domain && product.handle ? "https://" + domain + "/products/" + product.handle : null,
+          variants
+        }
+      },
+      operation: "update",
+      query: { id: row2.id }
+    }]
+  };
+};
+var syncVariants = async ({ connection, context, read, settings, shopify }) => {
+  var _a, _b, _c;
+  const row2 = await resolveProduct({ connection, context, read });
+  if (!row2) return { message: "No product row to paginate.", request: { product: (context == null ? void 0 : context.product) || null }, skipped: true };
+  const cursor = (context == null ? void 0 : context.cursor) || null;
+  const request2 = { cursor, product: row2.id };
+  let page;
+  try {
+    page = await shopify.storefront.getProductVariantsPage({
+      cursor,
+      domain: connection.shop,
+      productId: (_a = row2.provider) == null ? void 0 : _a.id,
+      storefrontAccessToken: settings == null ? void 0 : settings.storefrontAccessToken
+    });
+  } catch (error) {
+    if (error.message !== NOT_FOUND) throw error;
+    return { message: "Storefront lost this product mid-pagination \u2014 stopping.", request: request2, skipped: true };
+  }
+  const variants = await applyOutOfStock({
+    domain: connection.shop,
+    shopify,
+    storefrontAccessToken: settings == null ? void 0 : settings.storefrontAccessToken,
+    variants: (page.edges || []).map(toVariant)
+  });
+  return {
+    ...((_b = page.pageInfo) == null ? void 0 : _b.hasNextPage) && { enqueues: [{
+      data: { cursor: page.pageInfo.endCursor, operation: "variants", product: row2.id },
+      name: "page",
+      options: { jobId: "product.shopify.variants." + row2.id + "." + Date.now() },
+      queue: "product.shopify.variants"
+    }] },
+    message: variants.length + " variant(s) on this page.",
+    request: request2,
+    result: { hasNextPage: Boolean((_c = page.pageInfo) == null ? void 0 : _c.hasNextPage), variants: variants.length },
+    writes: [{
+      collection: "product",
+      data: cursor ? { $push: { variants: { $each: variants } } } : { $set: { variants } },
+      operation: "update",
+      query: { id: row2.id }
+    }]
+  };
+};
 var shopify_default2 = {
   // THE WORDS ON THE BUTTONS. `listing` was `content.redirect.title`, which put
   // a BUTTON LABEL inside the copy object next to a url — the title and the
@@ -5323,8 +7642,8 @@ var shopify_default2 = {
       // string; this answers what is missing from it.
       //
       // `shopify` is injected for the same reason it is everywhere else — this
-      // package cannot import @drawbridge/shopify, which depends on it.
-      scopes: ({ scope }, { shopify } = {}) => ({ result: { missing: scope ? shopify.oauth.missingScopes(scope) : null } }),
+      // client is imported here and defaulted, never wired in by a caller.
+      scopes: ({ scope }, { shopify = client } = {}) => ({ result: { missing: scope ? shopify.oauth.missingScopes(scope) : null } }),
       // Shopify's install grant is exchanged inside its own app flow, not
       // through the shared OAuth runner.
       token: false
@@ -5338,17 +7657,53 @@ var shopify_default2 = {
     // can reference another), `dispatch` (the caller's own coordinator table,
     // for the hooks that are dispatches).
     commerce: {
-      // NOT YET. The Checkout Kit cart path is `api/route/subdomain.js`, six direct
-      // calls into `@drawbridge/shopify/storefront` that write nothing — which is
-      // exactly why it never became a hook: a hook is reached to have its effects
-      // performed, and this one has none to perform. It moves here when the vendor
-      // client moves into the manifest and `subdomain.js` stops importing the
-      // package directly.
-      cart: false,
+      // THE CHECKOUT KIT CART. Six operations that were six direct calls into
+      // the storefront client from api/route/subdomain.js.
+      //
+      // IT WRITES NOTHING, which is exactly why it was the last surface to
+      // become a hook — a hook is usually reached to have its effects performed
+      // and this one has none. That reasoning was wrong: a hook is also the one
+      // place a vendor's client is allowed to be called from, and leaving the
+      // cart out meant a public route importing a vendor SDK directly.
+      //
+      // ONE HOOK, OPERATION IN THE CONTEXT, the same shape `inbound.process`
+      // uses for its topic table. Six slots would be six names in the closed
+      // vocabulary for one question — what does this shopper's cart look like
+      // now — asked six ways.
+      //
+      // A USER ERROR IS A 400 AND THE SHOPPER'S OWN WORDS. Shopify's cart
+      // mutations answer "that variant is sold out" as a userError rather than a
+      // transport failure, and the route it replaced already told the two apart.
+      // runHook carries `status` off a thrown error, so it survives to the
+      // caller; the rest of a thrown error's shape does not.
+      cart: async ({ clientId, clientSecret, context, settings }, { fetcher, shopify = client } = {}) => {
+        const { cartId, lineIds, lines, operation } = context || {};
+        const { domain, storefrontAccessToken } = settings || {};
+        if (operation === "checkout") {
+          const token = await shopify.storefront.createCheckoutToken({ clientId, clientSecret, fetcher });
+          return { message: "Checkout token minted.", result: { token } };
+        }
+        const storefront = { domain, fetcher, storefrontAccessToken };
+        try {
+          const cart = await ({
+            create: () => shopify.storefront.cartCreate({ ...storefront, lines }),
+            get: () => shopify.storefront.cartGet({ ...storefront, cartId }),
+            linesAdd: () => shopify.storefront.cartLinesAdd({ ...storefront, cartId, lines }),
+            linesRemove: () => shopify.storefront.cartLinesRemove({ ...storefront, cartId, lineIds }),
+            linesUpdate: () => shopify.storefront.cartLinesUpdate({ ...storefront, cartId, lines })
+          }[operation] || (() => {
+            throw Object.assign(new Error("Unknown cart operation: " + operation), { status: 400 });
+          }))();
+          return { message: "Cart " + operation + ".", request: { cartId: cartId || null, operation }, result: cart };
+        } catch (error) {
+          if (error == null ? void 0 : error.userError) throw Object.assign(error, { status: 400 });
+          throw error;
+        }
+      },
       // MINT A DISCOUNT CODE against the merchant's chosen discount, mapped to
       // one lead — which is what lets an order that redeems it be attributed
       // back.
-      code: async ({ connection, context, step }, { adminToken, shopify } = {}) => {
+      code: async ({ connection, context, step }, { adminToken, shopify = client } = {}) => {
         var _a;
         const discount = (_a = step.settings) == null ? void 0 : _a.discount;
         const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection.shop };
@@ -5394,7 +7749,7 @@ var shopify_default2 = {
       // customer at the store is a support ticket: the context may already
       // carry the id from an earlier step, the lead may already be linked from
       // an earlier run, and Shopify's own get-or-create settles the rest.
-      customer: async ({ connection, context }, { adminToken, read, shopify } = {}) => {
+      customer: async ({ connection, context }, { adminToken, read, shopify = client } = {}) => {
         const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection.shop };
         if (!(context == null ? void 0 : context.email)) return { message: "Lead email is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
         if (!(context == null ? void 0 : context.lead)) return { message: "Lead id is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
@@ -5444,6 +7799,30 @@ var shopify_default2 = {
           }]
         };
       },
+      // HOW MANY ARE LEFT. Read at the moment a campaign's product list is
+      // rendered rather than stored on the product, because stock is the one
+      // product fact that is stale the instant it is written down.
+      //
+      // SUMMED HERE, not by the caller. Shopify answers per variant and every
+      // caller wanted the total; the one that existed summed it inline, and
+      // summing `Object.values()` over the raw map is how a cache wrapper's own
+      // bookkeeping key got counted as a quantity.
+      inventory: async ({ connection, context }, { adminToken, shopify = client } = {}) => {
+        const productId = context == null ? void 0 : context.product;
+        const request2 = { product: productId || null, shop: connection.shop };
+        if (!productId) return { message: "No product id \u2014 nothing to count.", request: request2, result: { total: null }, skipped: true };
+        const adminAccessToken = await adminToken();
+        const byVariant = await shopify.admin.getProductInventory({
+          adminAccessToken,
+          domain: connection.shop,
+          productId
+        });
+        return {
+          message: "Inventory read.",
+          request: request2,
+          result: { total: Object.values(byVariant || {}).reduce((sum, quantity) => sum + quantity, 0) }
+        };
+      },
       // AN ORDER ARRIVED AT THE STORE. The largest hook in the family, because
       // attribution genuinely is: an order can reach Drawbridge two ways and
       // they bill differently.
@@ -5764,6 +8143,12 @@ var shopify_default2 = {
             orderId: String(orderId),
             rate,
             shopId: connection.source.id,
+            // WHICH VENDOR IS BEING CHARGED, so the sender does not have
+            // to assume. queue/usage.js named the slug itself and
+            // defaults to it for anything already queued when this
+            // shipped — an app-store vendor billing through its own meter
+            // enqueues the same job with its own slug.
+            slug: connection.slug,
             // The App Events API returns no event id, so one is generated
             // here — the event handle plus the order id — and sent as the
             // event's `reference`. queue/usage.js stamps the same id onto
@@ -5803,10 +8188,28 @@ var shopify_default2 = {
       //
       // The shell has already refused a missing or inactive Shopify connection,
       // so what is left is the two things only this hook can know are wrong.
-      product: async ({ connection, context, workflow }, { mintId, read } = {}) => {
+      // A PRODUCT, IN THREE MOVES. Nested by operation rather than by three
+      // slots in the closed vocabulary, the same shape inbound.process uses
+      // for its topic table — they are one subject, and a vendor that syncs
+      // products has to answer all three or none.
+      //
+      //   record     a webhook said a product changed: upsert the row and
+      //              queue the pull
+      //   sync       pull the product from the storefront and write what it
+      //              says, including what it says by NOT answering
+      //   variants   one page of variants, self-chaining
+      //
+      // `sync` and `variants` were 443 lines of drawbridge-sync's
+      // queue/product.js — a shadow implementation of the step this manifest
+      // already declared, importing three of the vendor's client modules from
+      // a worker file.
+      product: async ({ connection, context, settings, workflow }, { adminToken, mintId, read, shopify = client } = {}) => {
+        const operation = (context == null ? void 0 : context.operation) || "record";
+        if (operation === "sync") return syncProduct({ adminToken, connection, context, read, settings, shopify });
+        if (operation === "variants") return syncVariants({ connection, context, read, settings, shopify });
         const request2 = {
           numericId: (context == null ? void 0 : context.id) || null,
-          organizationId: workflow.organization,
+          organizationId: (workflow == null ? void 0 : workflow.organization) || null,
           title: (context == null ? void 0 : context.title) || null
         };
         if (!(context == null ? void 0 : context.id)) return { message: "Skipped \u2014 product webhook payload had no id.", request: request2, response: { skipped: true }, skipped: true };
@@ -5856,9 +8259,612 @@ var shopify_default2 = {
       }
     },
     contacts: { remove: false, sync: false },
-    // The embedded-app surface. Only a vendor whose merchants arrive from its
-    // own app store has one.
-    install: false,
+    // THE EMBEDDED-APP SURFACE. Only a vendor whose merchants arrive from its
+    // own app store has one, and these thirteen slots are the thirteen routes
+    // that used to live in api/route/shopify-embedded.js.
+    //
+    // A HOOK DESCRIBES ITS WRITES and the shell performs them, so none of these
+    // holds a controller — `read` is the controller's read methods and nothing
+    // else. Where one REFUSES it throws with a status, and the route answers
+    // what it said. The helpers they share are above the manifest.
+    install: {
+      account: {
+        // ESTABLISH THE DURABLE MERCHANT-TO-STORE LINK. The breakout
+        // authenticates the merchant once, top-level, and stashes their user
+        // token in `install.token.save`; App Bridge has already proven shop
+        // control by the time this runs.
+        //
+        // THE STASHED TOKEN IS THE TRUST ANCHOR, not merely any valid user
+        // token: the presented one must BE this shop's one-shot handoff token,
+        // unexpired, and an access or pat record — a refresh or oauth-state
+        // token that happens to resolve to a user must not qualify, which is
+        // the rule a session is held to in drawbridge-api's middleware.
+        link: async ({ context }, { read } = {}) => {
+          var _a;
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          const token = context == null ? void 0 : context.token;
+          if (!shop || !token) throw refusal("shop and token are required", 400);
+          const now = /* @__PURE__ */ new Date();
+          const record = await read.get({ collection: "shop", query: { shop } });
+          const stashed = (record == null ? void 0 : record.linkToken) ? (_a = decrypt(record.linkToken)) == null ? void 0 : _a.token : null;
+          const expired = !(record == null ? void 0 : record.linkTokenExpiresAt) || new Date(record.linkTokenExpiresAt) <= now;
+          if (!stashed || expired || stashed !== token) throw refusal("Invalid or expired link token", 401);
+          const granted = await read.get({
+            collection: "token",
+            query: {
+              revoked: false,
+              tokenHash: hashToken(token),
+              type: { $in: [tokenTypes.access, tokenTypes.pat] }
+            }
+          });
+          if (!(granted == null ? void 0 : granted.user) || granted.expiresAt && new Date(granted.expiresAt) <= now) {
+            throw refusal("Invalid or expired link token", 401);
+          }
+          const switching = Boolean(record == null ? void 0 : record.user) && record.user !== granted.user;
+          const connections2 = switching ? await read.aggregate({
+            collection: "connection",
+            pipeline: [
+              { $match: { shop, slug: "shopify" } },
+              { $project: { _id: 0, id: 1 } }
+            ]
+          }) : [];
+          return {
+            message: switching ? "Linked to a different Drawbridge account." : "Linked.",
+            request: { shop },
+            result: { connected: true, switched: switching },
+            // ALL OR NONE. A half-done switch is a store linked to the new
+            // account while the old account's connections still serve from it.
+            transaction: true,
+            writes: [
+              ...(connections2 || []).map((connection) => ({
+                collection: "connection",
+                operation: "delete",
+                query: { id: connection.id }
+              })),
+              {
+                collection: "shop",
+                data: { $set: { linkToken: null, linkTokenExpiresAt: null, user: granted.user } },
+                operation: "update",
+                query: { shop }
+              }
+            ]
+          };
+        },
+        // DISCONNECT THE ACCOUNT FROM THE STORE. Every org connection goes and
+        // the durable link clears; the offline token and the shop record stay,
+        // because the app is still installed and the merchant may link a
+        // different account next.
+        unlink: async ({ context }, { read } = {}) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          const connections2 = await read.aggregate({
+            collection: "connection",
+            pipeline: [
+              { $match: { shop, slug: "shopify" } },
+              { $project: { _id: 0, id: 1 } }
+            ]
+          });
+          return {
+            message: "Unlinked " + (connections2 || []).length + " connection(s).",
+            request: { shop },
+            result: { ok: true },
+            transaction: true,
+            writes: [
+              ...(connections2 || []).map((connection) => ({
+                collection: "connection",
+                operation: "delete",
+                query: { id: connection.id }
+              })),
+              {
+                collection: "shop",
+                data: { $set: { linkToken: null, linkTokenExpiresAt: null, user: null } },
+                operation: "update",
+                query: { shop }
+              }
+            ]
+          };
+        }
+      },
+      organizations: {
+        // BIND ONE ORGANIZATION TO THIS STORE. The longest slot here, and every
+        // gate in it came from a line in the route it replaces.
+        add: async ({ context }, { currencies, mintId, read, shopify = client } = {}) => {
+          var _a, _b;
+          const organization = context == null ? void 0 : context.organization;
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          if (!organization) throw refusal("organization is required", 400);
+          const record = await read.get({ collection: "shop", query: { shop } });
+          if (!(record == null ? void 0 : record.user)) throw refusal("Account is not connected for this store", 409);
+          const owned = await merchantOrganizations({ read, user: record.user });
+          const org = (owned || []).find((entry) => entry.id === organization);
+          if (!org) throw refusal("No access to this organization", 403);
+          if (!CONNECTABLE_STATUSES.includes(org.billingStatus)) {
+            throw refusal("This organization can't accept connections right now \u2014 check its billing status in the dashboard", 403);
+          }
+          if (org.connection && org.connection.shop !== shop) {
+            throw refusal("This organization is already connected to another Shopify store", 409);
+          }
+          const settings = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : null;
+          if (!(settings == null ? void 0 : settings.accessToken)) {
+            throw refusal("Store is not installed \u2014 open the app in the Shopify admin first", 409);
+          }
+          const plan = await storePlan({ record, shopify });
+          if (plan.unavailable) throw refusal("Couldn't verify the store's plan \u2014 try again shortly", 502);
+          if (!plan.active) throw refusal("Approve a plan before connecting organizations", 402);
+          let storefront = null;
+          if (!record.storefront) {
+            try {
+              const minted2 = await shopify.oauth.createStorefrontToken({
+                adminAccessToken: settings.accessToken,
+                shop
+              });
+              if (minted2) storefront = encrypt({ token: minted2 });
+            } catch (_) {
+            }
+          }
+          let currency = (record == null ? void 0 : record.currency) || null;
+          let source = (record == null ? void 0 : record.source) || null;
+          try {
+            const shopData = await shopify.oauth.getShop({ adminAccessToken: settings.accessToken, shop });
+            if (shopData) {
+              currency = String(shopData.currency || "").toLowerCase() || null;
+              source = { domain: shopData.myshopifyDomain, id: String(shopData.id), label: shopData.name };
+            }
+          } catch (_) {
+          }
+          if (currency && currencies && !currencies.includes(currency)) {
+            throw refusal("This store settles in a currency we can't bill yet. Connect a store with a supported settlement currency.", 422);
+          }
+          const minted = ((_a = org.connection) == null ? void 0 : _a.id) ? null : mintId();
+          const connectionId = ((_b = org.connection) == null ? void 0 : _b.id) || minted.id;
+          return {
+            message: "Connected " + org.name + " to " + shop + ".",
+            request: { organization, shop },
+            result: { ok: true },
+            transaction: true,
+            writes: [
+              ...storefront ? [{
+                collection: "shop",
+                data: { $set: { storefront } },
+                operation: "update",
+                query: { shop }
+              }] : [],
+              {
+                collection: "connection",
+                data: {
+                  $set: {
+                    currency,
+                    errors: [],
+                    // The token of record lives on the shared `shop` row; this
+                    // is the pointer that satisfies the required `settings`
+                    // string, and `auth.install.shared` declares how to read it.
+                    settings: encrypt({ ref: "shop", shop }),
+                    shop,
+                    status: "pending",
+                    ...source && { source }
+                  },
+                  $setOnInsert: {
+                    ...minted && { _id: minted._id, id: minted.id },
+                    feature: "organization:connection:shopify",
+                    organization,
+                    slug: "shopify"
+                  }
+                },
+                operation: "update",
+                options: { upsert: true },
+                query: { organization, slug: "shopify" }
+              },
+              {
+                collection: "organization",
+                data: {
+                  // $addToSet UNCONDITIONALLY. The route this replaces only
+                  // registered the refs when the upsert INSERTED, which meant an
+                  // org whose refs had drifted stayed drifted through every
+                  // re-link. Adding a member that is already there is a no-op,
+                  // so doing it every time costs nothing and repairs the drift.
+                  $addToSet: {
+                    "connections.groups": "ecommerce",
+                    "connections.ids": connectionId,
+                    "connections.keys": "shopify"
+                  },
+                  $set: { billingProvider: "shopify" }
+                },
+                operation: "update",
+                query: { id: organization }
+              }
+            ]
+          };
+        },
+        // WHAT THIS STORE CAN SEE: the linked merchant's organizations, the
+        // store's live plan, and the products the merchant has to act on.
+        //
+        // AN ORG CONNECTED TO A DIFFERENT STORE IS OMITTED ENTIRELY, because
+        // `add` would refuse it — a list that offers what the next call rejects
+        // is worse than a shorter one.
+        list: async ({ context }, { conversionRate, planTitle, read, shopify = client } = {}) => {
+          var _a;
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          const record = await read.get({ collection: "shop", query: { shop } });
+          if (!(record == null ? void 0 : record.user)) {
+            return {
+              message: "No account linked to this store.",
+              request: { shop },
+              result: {
+                account: null,
+                connected: false,
+                organizations: [],
+                plan: { active: false, name: null },
+                unavailableProducts: [],
+                unavailableProductsTotal: 0
+              }
+            };
+          }
+          const owned = await merchantOrganizations({ read, user: record.user });
+          const organizations = (owned || []).filter((org) => !org.connection || org.connection.shop === shop).map((org) => {
+            var _a2;
+            return {
+              // The org's OWN billing status decides whether `add` accepts it.
+              // Sent up so the app can disable Connect and name the reason
+              // rather than letting the merchant click into a 403 —
+              // listed-but-blocked beats hidden, because an org vanishing from
+              // the list is indistinguishable from a bug.
+              billingStatus: org.billingStatus || null,
+              connectable: CONNECTABLE_STATUSES.includes(org.billingStatus),
+              connected: Boolean(org.connection),
+              conversion: conversionRate(org.subscription),
+              id: org.id,
+              name: org.name,
+              plan: planTitle(org.subscription),
+              status: ((_a2 = org.connection) == null ? void 0 : _a2.status) || null
+            };
+          });
+          const connections2 = (owned || []).filter((org) => {
+            var _a2;
+            return ((_a2 = org.connection) == null ? void 0 : _a2.shop) === shop && org.connection.id;
+          }).map((org) => org.connection.id);
+          const [account, plan, unavailable] = await Promise.all([
+            read.get({ collection: "user", query: { id: record.user } }),
+            storePlan({ record, shopify }),
+            connections2.length ? read.aggregate({
+              collection: "product",
+              pipeline: [
+                { $match: { connections: { $in: connections2 }, "source.domain": shop, status: "inactive" } },
+                // $facet so the app can name the first 25 AND report a
+                // truthful total: listing 25 of 40 under "25 products need
+                // attention" would understate the problem.
+                {
+                  $facet: {
+                    items: [{ $sort: { title: 1 } }, { $limit: 25 }, { $project: { _id: 0, id: 1, title: 1 } }],
+                    total: [{ $count: "count" }]
+                  }
+                }
+              ]
+            }) : []
+          ]);
+          const facet = (unavailable || [])[0] || {};
+          if (plan.active && plan.metered !== true) {
+            const stamped = await read.aggregate({
+              collection: "connection",
+              pipeline: [
+                { $match: { shop, slug: "shopify" } },
+                { $project: { _id: 0, "source.metered": 1 } }
+              ]
+            });
+            const verdicts = (stamped || []).map((row2) => {
+              var _a2;
+              return (_a2 = row2 == null ? void 0 : row2.source) == null ? void 0 : _a2.metered;
+            });
+            if (verdicts.some((verdict) => typeof verdict === "string")) plan.metered = true;
+            else if (verdicts.some((verdict) => verdict === null)) plan.metered = false;
+          }
+          return {
+            message: organizations.length + " organization(s) for this store.",
+            request: { shop },
+            result: {
+              account: { email: (account == null ? void 0 : account.email) || null },
+              connected: true,
+              organizations,
+              plan,
+              unavailableProducts: (facet.items || []).map((product) => ({
+                id: product.id,
+                title: product.title || "Untitled product"
+              })),
+              // The total can exceed the 25 listed above, and has to.
+              unavailableProductsTotal: ((_a = (facet.total || [])[0]) == null ? void 0 : _a.count) || 0
+            }
+          };
+        },
+        // DISCONNECT ONE ORGANIZATION. The connection is deleted and nothing
+        // else: every dependent — products, ads, steps, workflows, and the org's
+        // own connection refs — is torn down by drawbridge-sync's connection
+        // change stream. The shared token and the other orgs are untouched.
+        remove: async ({ context }, { read } = {}) => {
+          const organization = context == null ? void 0 : context.organization;
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          if (!organization) throw refusal("organization is required", 400);
+          const record = await read.get({ collection: "shop", query: { shop } });
+          if (!(record == null ? void 0 : record.user)) throw refusal("Account is not connected for this store", 409);
+          const owned = await merchantOrganizations({ read, user: record.user });
+          if (!(owned || []).some((entry) => entry.id === organization)) {
+            throw refusal("No access to this organization", 403);
+          }
+          const connection = await read.get({
+            collection: "connection",
+            query: { organization, shop, slug: "shopify" }
+          });
+          if (!connection) throw refusal("No connection to remove", 404);
+          return {
+            message: "Disconnected.",
+            request: { organization, shop },
+            result: { ok: true },
+            writes: [{ collection: "connection", operation: "delete", query: { id: connection.id } }]
+          };
+        }
+      },
+      plan: {
+        // RELEASE EVERY ACTIVE APPROVAL. The App Home then re-checks the plan
+        // and falls back to "Choose a plan".
+        cancel: ({ context }, { read, shopify = client } = {}) => releaseApprovals({ context, read, shopify }),
+        // ONE ATTRIBUTED ORDER'S USAGE CHARGE. Enqueued per conversion by the
+        // order step and run on a retrying queue, so this may be called
+        // several times for one order — which is safe because the idempotency
+        // key is PERMANENT for billing events and Shopify settles the repeat.
+        //
+        // THE HANDLE IS CHECKED AGAINST THE MANIFEST'S OWN DECLARATION, which
+        // is a real strengthening of what it replaced: drawbridge-sync compared
+        // the job's `handle` against the job's `transaction` — two fields from
+        // the same enqueuer, so a drifted enqueuer agreed with itself. The
+        // handle is the one string that decides whether the event bills at all,
+        // and this is the file that publishes it.
+        //
+        // REFUSE BEFORE SENDING, because sending burns the order's PERMANENT
+        // idempotency key on an event that misclassifies or mistraces. The
+        // throw rides the queue's normal retry path and the abandoned-job alert
+        // pages on exhaustion.
+        //
+        // DELIBERATELY NO TIMESTAMP. sendAppEvent defaults to the SEND time,
+        // which is always inside the merchant's current billing cycle at the
+        // moment of sending and so can never hit PERIOD_CLOSED. Pinning the
+        // purchase time reads more correct and is strictly worse: a retry
+        // backoff crossing a cycle boundary would carry a closed-cycle
+        // timestamp, Shopify would 202-accept, silently drop it, and the
+        // commission would be lost. Send-time's worst case is benign — the
+        // charge lands in the next cycle, but it lands.
+        charge: async ({ clientId, clientSecret, context, manifest }, { shopify = client } = {}) => {
+          const { idempotencyKey, order, orderId, rate, revision, shopId, timestamp, transaction, value } = context || {};
+          const handle = (context == null ? void 0 : context.handle) || manifest.auth.install.billing.handle;
+          if (!transaction || !String(transaction).startsWith(handle + ".")) {
+            throw new Error("shopify.usage.billing.handle.mismatch on order " + orderId + ": transaction " + (transaction || "null") + " does not carry handle " + handle + " \u2014 refusing to send");
+          }
+          await shopify.billing.sendAppEvent({
+            clientId,
+            clientSecret,
+            eventHandle: handle,
+            idempotencyKey,
+            // The Shopify-side event record names the order that produced it.
+            reference: transaction,
+            // OPERATOR-ONLY, BOTH OF THEM, and absent on every automatic
+            // send. `revision` suffixes the idempotency key, which is what
+            // makes a second attempt possible once a key has been consumed;
+            // the encoding is owned by sendAppEvent so no caller builds keys
+            // itself. `timestamp` pins the PURCHASE time, which the automatic
+            // path must never do — see the note above — and the recovery
+            // migration must, because it is resending orders from a closed
+            // window and bounds its own run to the merchant's current cycle.
+            ...revision && { revision },
+            ...timestamp && { timestamp },
+            shopId,
+            value
+          });
+          return {
+            message: "Usage charge sent for order " + orderId + ".",
+            request: { order: order || null, orderId: orderId || null, shopId: shopId || null, value },
+            result: { transaction: String(transaction) },
+            // TRACEABILITY. The App Events API returns no event id, so the
+            // trace key into Shopify's event logs is the transaction id the
+            // commerce.order hook minted and this sent as `reference`.
+            // `amount` is the per-order usage value in cents, mirroring the
+            // Stripe path's marker.
+            ...order && { writes: [{
+              collection: "order",
+              data: {
+                $set: {
+                  billed: {
+                    amount: value,
+                    date: /* @__PURE__ */ new Date(),
+                    rate: rate || 0,
+                    transaction: String(transaction)
+                  }
+                }
+              },
+              operation: "update",
+              query: { id: order }
+            }] }
+          };
+        },
+        // RESELECT, NOT CANCEL. The same mechanics — the current approval has to
+        // be released before the pricing page will offer the plan again — but
+        // the intent is a thirty-second round trip rather than a departure.
+        //
+        // `mark` IS A DECLARED CAPABILITY, and this is the only slot here that
+        // needs one. The marker has to be persisted BEFORE the approval is
+        // released: it is what tells sync's CANCELLED handler to hold the pause
+        // — no connection error, no owner email — and start a timed recheck that
+        // pauses honestly if the merchant abandons. A described write lands
+        // after the hook returns, which is after the cancel, and a marker
+        // written then can race the very webhook it exists to soften. Same
+        // precedent as `resolveContact`: the one write a description cannot
+        // carry.
+        reselect: async ({ context }, { mark, read, shopify = client } = {}) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          await mark({ shop });
+          return releaseApprovals({ context, read, shopify });
+        },
+        // IS THIS STORE'S ORDER BILLING ACTUALLY METERED? Not a merchant
+        // action — the other two slots here are — but the same subject, and
+        // the reason it is a declared hook rather than a helper is that the
+        // answer was being derived in two places: `lifecycle.health` below,
+        // and drawbridge-sync's app_subscriptions/update handler, whose copy
+        // stated in its own comment that it matched this one and did not.
+        //
+        // THREE ANSWERS, and the caller must keep them apart:
+        //
+        //   a string     PROVEN. The charge id or usage line id, stamped on
+        //                the connection as the evidence.
+        //   null         PROBED, and nothing is accruing.
+        //   undefined    NO VERDICT — the probe could not run. `probed` says
+        //                which, because undefined does not survive JSON.
+        verify: async ({ context }, { adminToken, read, shopify = client } = {}) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          const adminAccessToken = await adminToken();
+          if (!adminAccessToken) {
+            return { message: "No admin token for this store \u2014 no verdict.", request: { shop }, result: { metered: null, probed: false }, skipped: true };
+          }
+          const partnerRow = (read == null ? void 0 : read.get) ? await read.get({ collection: "provider", query: { slug: "shopify" } }) : null;
+          const partner = (partnerRow == null ? void 0 : partnerRow.settings) ? decrypt(partnerRow.settings) : {};
+          const { ledger, metered } = await meterVerdict({
+            adminAccessToken,
+            ledgerFloor: new Date(Date.now() - LEDGER_WINDOW_MS),
+            partner,
+            shop,
+            shopId: (context == null ? void 0 : context.shopId) || null,
+            shopify
+          });
+          return {
+            message: typeof metered === "string" ? "Billing is metered." : "No meter evidence for this store.",
+            request: { shop },
+            // `probed` is the LEDGER, not the call: a store whose Partner
+            // credentials are absent was not asked, and reporting that as
+            // "probed, nothing accruing" would stamp an unmetered verdict on
+            // a store nobody looked at.
+            result: { metered: metered ?? null, probed: ledger || typeof metered === "string" }
+          };
+        }
+      },
+      // THE EMBEDDED APP'S SESSION STORE. The @shopify/shopify-app library
+      // persists the offline session on token exchange and refresh; it lives
+      // encrypted on the shared `shop` record, which is the same row every
+      // organization's connection to this store points at.
+      session: {
+        // SOFT-CLEAR, NEVER A DELETE. The library calls this on session
+        // invalidation and not only on uninstall, so hard-deleting the record
+        // would orphan every org connection pointing at it — token resolution
+        // silently nulls — and destroy the durable account link and the
+        // storefront token with it. The next embedded load re-runs token
+        // exchange. The full record delete belongs to the uninstall webhook.
+        clear: async ({ context }) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          return {
+            message: "Session cleared.",
+            request: { shop },
+            result: { ok: true },
+            writes: [{
+              collection: "shop",
+              data: { $set: { settings: null } },
+              operation: "update",
+              query: { shop }
+            }]
+          };
+        },
+        read: async ({ context }, { read } = {}) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          const record = await read.get({ collection: "shop", query: { shop } });
+          if (!(record == null ? void 0 : record.settings)) throw refusal("No session for this store", 404);
+          return {
+            message: "Session read.",
+            request: { shop },
+            result: { session: decrypt(record.settings) }
+          };
+        },
+        save: async ({ context }) => {
+          const session = context == null ? void 0 : context.session;
+          const shop = sanitizeDomain(session == null ? void 0 : session.shop);
+          if (!shop || !(session == null ? void 0 : session.accessToken)) throw refusal("session.shop and session.accessToken are required", 400);
+          return {
+            message: "Session saved.",
+            request: { shop },
+            result: { ok: true },
+            writes: [{
+              collection: "shop",
+              data: {
+                $set: { settings: encrypt(session), shop },
+                $setOnInsert: { status: "pending" }
+              },
+              operation: "update",
+              options: { upsert: true },
+              query: { shop }
+            }]
+          };
+        }
+      },
+      // THE LINK-TOKEN HANDOFF. The breakout callback runs top-level and can set
+      // a first-party cookie; the embedded App Home cannot read that cookie from
+      // inside the Shopify admin iframe. So the callback stashes the merchant's
+      // user token here keyed by shop, and App Home reads it once and clears it.
+      //
+      // DURABLE RATHER THAN IN REDIS: a restart must not strand a merchant
+      // mid-handoff. Short-lived and encrypted.
+      token: {
+        clear: async ({ context }) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          return {
+            message: "Link token cleared.",
+            request: { shop },
+            result: { ok: true },
+            writes: [{
+              collection: "shop",
+              data: { $set: { linkToken: null, linkTokenExpiresAt: null } },
+              operation: "update",
+              query: { shop }
+            }]
+          };
+        },
+        read: async ({ context }, { read } = {}) => {
+          var _a;
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          if (!shop) throw refusal("shop is required", 400);
+          const record = await read.get({ collection: "shop", query: { shop } });
+          const expiresAt = (record == null ? void 0 : record.linkTokenExpiresAt) ? new Date(record.linkTokenExpiresAt) : null;
+          if (!(record == null ? void 0 : record.linkToken) || !expiresAt || expiresAt <= /* @__PURE__ */ new Date()) {
+            throw refusal("No link token for this store", 404);
+          }
+          return {
+            message: "Link token read.",
+            request: { shop },
+            result: { token: ((_a = decrypt(record.linkToken)) == null ? void 0 : _a.token) ?? null }
+          };
+        },
+        save: async ({ context }) => {
+          const shop = sanitizeDomain(context == null ? void 0 : context.shop);
+          const token = context == null ? void 0 : context.token;
+          if (!shop || !token) throw refusal("shop and token are required", 400);
+          return {
+            message: "Link token saved.",
+            request: { shop },
+            result: { ok: true },
+            writes: [{
+              collection: "shop",
+              data: {
+                $set: {
+                  linkToken: encrypt({ token }),
+                  linkTokenExpiresAt: new Date(Date.now() + LINK_TOKEN_TTL_MS)
+                }
+              },
+              operation: "update",
+              query: { shop }
+            }]
+          };
+        }
+      }
+    },
     // Drawbridge sends its own notification email and SMS — see the private
     // `drawbridge` manifest. A vendor answering these would be a second sender,
     // which is the arrangement the platform sender replaced.
@@ -5920,8 +8926,8 @@ var shopify_default2 = {
       // access token still works, reconciles the scopes the store granted
       // against the ones the app now needs, and queues a webhook
       // reconciliation.
-      health: async ({ connection, workflow }, { adminToken, logger, read, reconcileScopes, resolveSettings, rotateToken, shopify } = {}) => {
-        var _a, _b, _c, _d, _e, _f;
+      health: async ({ connection, workflow }, { adminToken, logger, read, reconcileScopes, resolveSettings, rotateToken, shopify = client } = {}) => {
+        var _a, _b, _c, _d;
         const request2 = {
           connectionId: workflow.connection,
           organizationId: workflow.organization,
@@ -5958,33 +8964,26 @@ var shopify_default2 = {
               shopCurrency = String(shopData.currency || "").toLowerCase() || null;
               sourceRepaired = true;
             }
-            const { subscriptions } = await shopify.admin.getActiveAppSubscriptions({
-              adminAccessToken,
-              domain: connection.shop
-            });
-            const usageLine = (_a = subscriptions.find((subscription) => subscription.usageLineItemId)) == null ? void 0 : _a.usageLineItemId;
-            if (usageLine) metered = usageLine;
             const partnerRow = (read == null ? void 0 : read.get) ? await read.get({ collection: "provider", query: { slug: "shopify" } }) : null;
             const partner = (partnerRow == null ? void 0 : partnerRow.settings) ? decrypt(partnerRow.settings) : {};
-            if (partner.partnerToken && partner.partnerOrgId && partner.partnerAppId && (source == null ? void 0 : source.id) && ((_b = shopify.partner) == null ? void 0 : _b.getUsageChargeEvents)) {
-              const ledgerFloor = new Date(Date.now() - 30 * 24 * 60 * 60 * 1e3);
-              const accruals = await shopify.partner.getUsageChargeEvents({
-                appId: "gid://shopify/App/" + partner.partnerAppId,
-                first: 10,
-                occurredAtMin: ledgerFloor.toISOString(),
-                organizationId: partner.partnerOrgId,
-                partnerToken: partner.partnerToken,
-                shopId: "gid://shopify/Shop/" + source.id
-              });
-              const boundaries = accruals.filter((event) => event.occurredAt).sort((a, b) => new Date(a.occurredAt) - new Date(b.occurredAt));
-              const accrued = [...boundaries].reverse().find((event) => Number(event.usageQuantity) > 0);
-              if (accrued) metered = String(accrued.chargeId || accrued.id);
-              const stampedAt = (_c = boundaries.find(
+            const ledgerFloor = new Date(Date.now() - LEDGER_WINDOW_MS);
+            const verdict = await meterVerdict({
+              adminAccessToken,
+              ledgerFloor,
+              partner,
+              shop: connection.shop,
+              shopId: source == null ? void 0 : source.id,
+              shopify
+            });
+            if (verdict.metered !== void 0) metered = verdict.metered;
+            const { boundaries } = verdict;
+            if (boundaries.length) {
+              const stampedAt = (_a = boundaries.find(
                 (event) => {
                   var _a2;
                   return String(event.chargeId || event.id) === String(((_a2 = connection.source) == null ? void 0 : _a2.metered) || "");
                 }
-              )) == null ? void 0 : _c.occurredAt;
+              )) == null ? void 0 : _a.occurredAt;
               reconciliation = [];
               let windowStart = ledgerFloor;
               for (const boundary of boundaries) {
@@ -6034,7 +9033,7 @@ var shopify_default2 = {
                     }
                   });
                 } else {
-                  (_d = logger == null ? void 0 : logger.error) == null ? void 0 : _d.call(logger, new Error(
+                  (_b = logger == null ? void 0 : logger.error) == null ? void 0 : _b.call(logger, new Error(
                     "shopify.usage.reconciliation.mismatch on shop " + connection.shop + ": charge " + charge + " charged " + charged + " cents but its window holds " + billed + " cents across " + orders.length + " billed orders \u2014 each cent of difference is commission that never charged"
                   ), {
                     extra: {
@@ -6053,13 +9052,13 @@ var shopify_default2 = {
             }
           } catch (probeError) {
             billingProbeFailed = true;
-            (_e = logger == null ? void 0 : logger.warn) == null ? void 0 : _e.call(logger, "shopify.health.billing.probe.failed", {
+            (_c = logger == null ? void 0 : logger.warn) == null ? void 0 : _c.call(logger, "shopify.health.billing.probe.failed", {
               connectionId: connection.id,
               message: probeError == null ? void 0 : probeError.message,
               shop: connection.shop
             });
           }
-          if (sourceRepaired || metered !== void 0 && metered !== (((_f = connection.source) == null ? void 0 : _f.metered) ?? void 0)) {
+          if (sourceRepaired || metered !== void 0 && metered !== (((_d = connection.source) == null ? void 0 : _d.metered) ?? void 0)) {
             writes.push({
               collection: "connection",
               data: {
@@ -6194,13 +9193,13 @@ var shopify_default2 = {
       // They are the same two questions every other vendor answers through
       // resources.*, so they answer them the same way now.
       //
-      // `shopify` is INJECTED: this package cannot import @drawbridge/shopify,
+      // `shopify` DEFAULTS to the client this file imports; nothing injects it,
       // which depends on it. What arrives is the SDK's pure HTTP namespaces
       // and nothing else — no controller, no collection access. Resolving the
       // credential is the caller's job because it is Drawbridge's job: the
       // admin token refreshes and writes itself back, which is service work,
       // not vendor work.
-      products: async ({ cursor, limit = 100, search, settings, sort }, { shopify } = {}) => {
+      products: async ({ cursor, limit = 100, search, settings, sort }, { shopify = client } = {}) => {
         var _a, _b, _c, _d;
         const products = await shopify.storefront.getProducts({
           cursor,
@@ -6222,7 +9221,7 @@ var shopify_default2 = {
           }
         };
       },
-      promotions: async ({ cursor, limit = 100, search, settings }, { shopify } = {}) => {
+      promotions: async ({ cursor, limit = 100, search, settings }, { shopify = client } = {}) => {
         var _a, _b;
         const discounts = await shopify.admin.getDiscounts({
           adminAccessToken: settings == null ? void 0 : settings.adminAccessToken,
@@ -6373,6 +9372,13 @@ var shopify_default2 = {
           key: "Shopify Order Tracking",
           queue: "connection",
           system: true,
+          // THE TRIGGER THE REGISTER JOB HAND-WROTE. It is byte-identical to
+          // the one on every stored workflow, because these documents exist on
+          // prod with thousands of runs behind them and provisioning is
+          // idempotent on (connection, system, title) — a different trigger
+          // here would not be picked up by the existing rows anyway, and a
+          // different TITLE would provision a second workflow for every store.
+          trigger: { event: "shopify.order.create", type: "webhook" },
           type: "step.commerce.order.record"
         })
       },
@@ -6383,6 +9389,15 @@ var shopify_default2 = {
           key: "Shopify Product Sync",
           queue: "connection",
           system: true,
+          // `shopify.product.update`, NOT `product.insert`. The plan named the
+          // latter, and it is the right long-term answer — a Drawbridge product
+          // row appearing should pull the vendor's copy, rather than
+          // stream/product.js branching on the slug and enqueueing a
+          // vendor-named queue. But a workflow carries ONE trigger, this one is
+          // stored on prod against the webhook, and changing a live workflow's
+          // trigger is a data migration. So the declaration matches what exists
+          // and `product.insert` stays a separate, migration-gated change.
+          trigger: { event: "shopify.product.update", type: "webhook" },
           type: "step.commerce.product.sync"
         })
       }
@@ -6404,26 +9419,37 @@ var shopify_default2 = {
           type: "step.connection.health.check"
         })
       },
-      // Audit-only. The "Shopify Token Activity" system workflow lists these
-      // for descriptive grouping, but its audit step docs are written manually
-      // at OAuth time — the workflow is never dispatched. Routing is declared
-      // defensively so that if it ever IS dispatched, the job lands on a real
-      // queue and the handler lookup misses cleanly instead of throwing
-      // "Unknown step type".
+      // THE ONE WORKFLOW THAT CARRIES TWO STEPS, and the shape the plan called
+      // the single genuinely new thing in it.
+      //
+      // Every other system step is its own workflow, titled by its own `key`.
+      // These two are "Shopify Token Activity", one row in the merchant's list
+      // with both steps in it — so they declare `workflow`, which names the
+      // title, the trigger and the ORDER, and the provisioner groups on it.
+      // Without that key the pair could only be provisioned by the hand-written
+      // spec in drawbridge-sync's register job, which is exactly why that spec
+      // outlived every other one.
+      //
+      // AUDIT-ONLY. The step documents are written manually at OAuth time and
+      // the workflow is never dispatched; `queue` is declared defensively so
+      // that if it ever IS, the job lands on a real queue and the handler lookup
+      // misses cleanly rather than throwing "Unknown step type".
       token: {
         exchange: () => ({
           description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
           key: "Shopify Token Exchange",
           queue: "connection",
           system: true,
-          type: "step.connection.token.exchange"
+          type: "step.connection.token.exchange",
+          workflow: { key: "Shopify Token Activity", order: 0, trigger: { event: "shopify.token", type: "event" } }
         }),
         refresh: () => ({
           description: "Records a token rotation. Audit only \u2014 never dispatched.",
           key: "Shopify Token Refresh",
           queue: "connection",
           system: true,
-          type: "step.connection.token.refresh"
+          type: "step.connection.token.refresh",
+          workflow: { key: "Shopify Token Activity", order: 1, trigger: { event: "shopify.token", type: "event" } }
         })
       }
     }
@@ -6509,7 +9535,7 @@ var shopify_default2 = {
 };
 
 // lib/connections/manifests/webhook.js
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 
 // lib/safe-http.js
 import dns2 from "dns";
@@ -6682,7 +9708,7 @@ var signature = ({ body, settings }) => {
   return [
     "t=" + timestamp,
     ...[settings.secret, ...previous].map(
-      (secret) => "v1=" + crypto2.createHmac(generated.algorithm, secret).update(payload).digest(generated.encoding)
+      (secret) => "v1=" + crypto3.createHmac(generated.algorithm, secret).update(payload).digest(generated.encoding)
     )
   ].join(",");
 };
@@ -6727,14 +9753,15 @@ var webhook_default = {
       "Drawbridge can POST event payloads to your endpoint as activity happens in your account, so your own systems can react to it.",
       "Generate a signing secret and Drawbridge signs every request with it. Your endpoint recomputes the signature to confirm each payload genuinely came from Drawbridge before acting on it."
     ],
-    // NO VENDOR-SPECIFIC CONNECT COPY, and that is a decision rather than a gap.
-    // The dashboard already carries generic reasons for every way an
-    // authorization can fail — declined, expired state, a vendor we are not set
-    // up for — and a sentence here is an ADDITION to those, for a vendor whose
-    // failures need saying differently. This one's do not.
+    // THERE IS NO CONSENT SCREEN TO FAIL. Connecting mints a signing secret;
+    // nothing is authorized against a third party, so neither `denied` nor
+    // `invalid` has a state it could describe. The failures this connection
+    // really has are at DELIVERY — a merchant's endpoint refusing a POST — and
+    // those reach them through the connection's own errors rather than through
+    // connect copy.
     //
-    // Answered rather than omitted, because `errors` existed on two of six
-    // manifests and there was no way to tell "nothing to add" from "nobody
+    // `false` is the recorded decision, not silence: `errors` existed on two of
+    // six manifests and there was no way to tell "nothing to add" from "nobody
     // wrote it".
     errors: false,
     excerpt: "Sign outgoing webhook payloads with an HMAC secret to verify authenticity.",
@@ -6878,7 +9905,7 @@ var webhook_default = {
   // The connect prompt only where connecting is not already the card's whole
   // story: a disconnected or errored document renders a Connect action itself,
   // and a task repeating it talks over the button.
-  tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
+  tasks: ({ settings, status } = {}) => status === "error" ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
       message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
@@ -6965,6 +9992,77 @@ var attentive_default3 = {
   }
 };
 
+// lib/connections/icons/brightdata.js
+var brightdata_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#0F58FF"/>
+<circle cx="250" cy="250" r="52" fill="white"/>
+<rect x="234" y="70" width="32" height="96" rx="16" fill="white"/>
+<rect x="234" y="334" width="32" height="96" rx="16" fill="white"/>
+<rect x="70" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="334" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="117" y="140" width="32" height="96" rx="16" transform="rotate(-45 117 140)" fill="white"/>
+<rect x="304" y="327" width="32" height="96" rx="16" transform="rotate(-45 304 327)" fill="white"/>
+<rect x="360" y="117" width="32" height="96" rx="16" transform="rotate(45 360 117)" fill="white"/>
+<rect x="173" y="304" width="32" height="96" rx="16" transform="rotate(45 173 304)" fill="white"/>
+</svg>`;
+
+// lib/connections/vendors/brightdata.js
+var brightdata_default2 = {
+  fields: [
+    {
+      credential: "BRIGHTDATA_BROWSER_URI",
+      input: "password",
+      key: "browserUri",
+      // A wss:// endpoint with the account's user and password in its
+      // authority, which is why it is a password field rather than a url one:
+      // the whole string is the credential.
+      label: "Scraping Browser endpoint",
+      message: "The wss:// Scraping Browser endpoint, carrying its own credentials. Used to render pages that need a real browser.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_API_KEY",
+      input: "password",
+      key: "unlockerApiKey",
+      label: "Web Unlocker API key",
+      // NO EXPIRY FIELD, and that is a decision rather than an omission. Bright
+      // Data offers an `Unlimited` expiry and recommends against it; Drawbridge
+      // takes the unlimited key deliberately, because there is no way to rotate
+      // this programmatically and a date nothing can act on is a date that only
+      // surfaces after it has already broken scraping. If a fixed expiry is ever
+      // taken instead, the field to add is a stored date and a warning ahead of
+      // it — not a rotation, which the vendor cannot support.
+      message: "Bright Data account settings \u2192 API keys. Taken with an unlimited expiry: their API offers no way to rotate a key, so a dated one can only ever break scraping silently.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_ZONE",
+      input: "text",
+      key: "unlockerZone",
+      label: "Web Unlocker zone",
+      // Not secret — a zone is a label on the account, and it is shown rather
+      // than redacted so an operator can confirm which one is in use without
+      // clearing the field to read it.
+      message: "The zone name the Unlocker requests run against.",
+      required: true
+    }
+  ],
+  icon: brightdata_default,
+  name: "Bright Data",
+  slug: "brightdata",
+  // WHERE THE FACTS CAME FROM, read 2026-09-16.
+  urls: {
+    api: "https://docs.brightdata.com/api-reference/authentication",
+    dashboard: "https://brightdata.com/cp/setting/users",
+    // Bright Data has no scope model — a key carries the account's own access —
+    // so there is nothing to link. `false` is the recorded answer rather than a
+    // missing key.
+    scopes: false
+  }
+};
+
 // lib/connections/vendors/hubspot.js
 var hubspot_default2 = {
   // WHAT AN ADMIN TYPES on the provider screen. `credential` names the env var a
@@ -7278,7 +10376,7 @@ var twilio_default2 = {
 
 // lib/connections/index.js
 var QUEUES = ["connection", "notification", "segment", "webhook"];
-var implemented = (hooks, path) => {
+var implemented2 = (hooks, path) => {
   const hook = path.split(".").reduce((node, key) => node == null ? void 0 : node[key], hooks);
   return typeof hook === "function" || !!hook && typeof hook === "object";
 };
@@ -7340,7 +10438,7 @@ var checkIcon = (owner, icon) => {
   }
 };
 var vendors = Object.freeze(Object.fromEntries(
-  [attentive_default3, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
+  [attentive_default3, brightdata_default2, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
 ));
 var buildVendor = (vendor) => {
   if (!(vendor == null ? void 0 : vendor.slug)) throw new Error("A vendor needs a slug");
@@ -7367,7 +10465,7 @@ for (const [slug2, vendor] of Object.entries(vendors)) {
   buildVendor(vendor);
 }
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (manifest == null ? void 0 : manifest.private) throw new Error(manifest.slug + " declares private \u2014 that is feature : false now");
@@ -7396,7 +10494,7 @@ var build = (manifest) => {
       if (!field.hook.startsWith("resources.")) {
         throw new Error(manifest.slug + "." + field.key + " reads from " + field.hook + " \u2014 a picker may only read resources.*");
       }
-      if (!implemented(manifest.hooks, field.hook)) {
+      if (!implemented2(manifest.hooks, field.hook)) {
         throw new Error(manifest.slug + "." + field.key + " reads " + field.hook + ", which this vendor does not implement");
       }
     }
@@ -7435,7 +10533,7 @@ var build = (manifest) => {
   }
   let callback = null;
   const type = kinds[0];
-  if (["install", "oauth"].includes(type) && !implemented(manifest.hooks, "lifecycle.health")) {
+  if (["install", "oauth"].includes(type) && !implemented2(manifest.hooks, "lifecycle.health")) {
     throw new Error(
       manifest.slug + " is " + type + " and must implement hooks.lifecycle.health \u2014 a credential somebody else can revoke, expire or narrow tells us nothing when it dies"
     );
@@ -7464,10 +10562,10 @@ var build = (manifest) => {
     }
     callback = "/api/connection/" + manifest.slug + "/callback";
   }
-  if (implemented(manifest.hooks, "inbound.event") && typeof ((_n = (_m = manifest.hooks) == null ? void 0 : _m.inbound) == null ? void 0 : _n.event) !== "function" && !((_r = (_q = (_p = (_o = manifest.hooks) == null ? void 0 : _o.inbound) == null ? void 0 : _p.config) == null ? void 0 : _q.headers) == null ? void 0 : _r.event)) {
+  if (implemented2(manifest.hooks, "inbound.event") && typeof ((_n = (_m = manifest.hooks) == null ? void 0 : _m.inbound) == null ? void 0 : _n.event) !== "function" && !((_r = (_q = (_p = (_o = manifest.hooks) == null ? void 0 : _o.inbound) == null ? void 0 : _p.config) == null ? void 0 : _q.headers) == null ? void 0 : _r.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_v = (_u = (_t = (_s = manifest.hooks) == null ? void 0 : _s.inbound) == null ? void 0 : _t.config) == null ? void 0 : _u.headers) == null ? void 0 : _v.signature)) {
+  if (implemented2(manifest.hooks, "inbound.verify") && !((_v = (_u = (_t = (_s = manifest.hooks) == null ? void 0 : _s.inbound) == null ? void 0 : _t.config) == null ? void 0 : _u.headers) == null ? void 0 : _v.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (!Array.isArray((_w = manifest == null ? void 0 : manifest.content) == null ? void 0 : _w.guide) || !manifest.content.guide.length) {
@@ -7478,7 +10576,7 @@ var build = (manifest) => {
     if (Array.isArray(node)) {
       for (const verb of node) {
         const hook = declared2 == null ? void 0 : declared2[verb];
-        if (hook !== false && !implemented({ [verb]: hook }, verb)) {
+        if (hook !== false && !implemented2({ [verb]: hook }, verb)) {
           throw new Error(manifest.slug + " must answer hooks." + [...path, verb].join(".") + " \u2014 false, a function, or {} if another repo implements it");
         }
       }
@@ -7624,7 +10722,7 @@ var build = (manifest) => {
     if (!QUEUES.includes(declared2 == null ? void 0 : declared2.queue)) {
       throw new Error(manifest.slug + " step " + type2 + " needs a queue \u2014 one of " + QUEUES.join(", "));
     }
-    if (declared2.hook && !implemented(manifest.hooks, declared2.hook)) {
+    if (declared2.hook && !implemented2(manifest.hooks, declared2.hook)) {
       throw new Error(manifest.slug + " step " + type2 + " points at hook " + declared2.hook + ", which this vendor does not implement");
     }
     for (const trigger of declared2.triggers || []) {
@@ -7633,11 +10731,22 @@ var build = (manifest) => {
         manifest.slug + " step " + type2 + " may be triggered by " + trigger + ", which is not a trigger \u2014 one of " + Object.keys(TRIGGERS).join(", ")
       );
     }
-    if (declared2.trigger) {
-      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === declared2.trigger.event && TRIGGERS[key].type === declared2.trigger.type)];
+    if (declared2.workflow) {
+      if (!declared2.workflow.key) {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no key \u2014 the title several steps share");
+      }
+      if (typeof declared2.workflow.order !== "number") {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no order \u2014 two steps in one row need a sequence");
+      }
+      if (declared2.trigger) {
+        throw new Error(manifest.slug + " step " + type2 + " declares BOTH a trigger and a workflow \u2014 the workflow carries the trigger for every step in it");
+      }
+    }
+    for (const candidate of [declared2.trigger, (_y = declared2.workflow) == null ? void 0 : _y.trigger].filter(Boolean)) {
+      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === candidate.event && TRIGGERS[key].type === candidate.type)];
       if (!known2) {
         throw new Error(
-          manifest.slug + " step " + type2 + " declares trigger { event : " + declared2.trigger.event + ", type : " + declared2.trigger.type + " }, which nothing dispatches"
+          manifest.slug + " step " + type2 + " declares trigger { event : " + candidate.event + ", type : " + candidate.type + " }, which nothing dispatches"
         );
       }
     }
@@ -7707,13 +10816,14 @@ var publicSettingsBySlug = Object.fromEntries(
 var connectionSteps = (env = {}) => Object.entries(availableConnections(env)).flatMap(
   ([slug2, manifest]) => leaves(manifest.steps).map(([, step]) => ({ ...step({}), slug: slug2 }))
 );
+var implementsHook = (hooks, name) => implemented2(hooks, name);
 var hookSupport = (name) => ({
-  no: Object.keys(connections).filter((slug2) => !implemented(connections[slug2].hooks, name)),
-  yes: Object.keys(connections).filter((slug2) => implemented(connections[slug2].hooks, name))
+  no: Object.keys(connections).filter((slug2) => !implemented2(connections[slug2].hooks, name)),
+  yes: Object.keys(connections).filter((slug2) => implemented2(connections[slug2].hooks, name))
 });
 var connectFields = (slug2) => {
   var _a;
-  return (((_a = connections[slug2]) == null ? void 0 : _a.fields) || []).map(({ copy, from, hook, input, key, label, message, options, placeholder, redact, required, search }) => ({
+  return (((_a = connections[slug2]) == null ? void 0 : _a.fields) || []).map(({ copy, from, hook, input, key, label, message, options, placeholder, redact, required: required2, search }) => ({
     ...copy && { copy: true },
     ...hook && { hook },
     ...from && { from },
@@ -7726,7 +10836,7 @@ var connectFields = (slug2) => {
     // Declared false only where the vendor cannot filter, so a picker does not
     // offer a search box that quietly searches one page.
     ...search === false && { search: false },
-    required: Boolean(required),
+    required: Boolean(required2),
     // A UI hint, not a leak: the form uses it to stop requiring the field once
     // the connection exists, and to say "leave blank to keep" — because the GET
     // response deliberately never returns the stored value.
@@ -7865,6 +10975,7 @@ export {
   HOOK_PROPS,
   HOOK_SLOT_PROPS,
   INPUTS,
+  MARKERS,
   OAUTH_ENDPOINTS,
   OAUTH_FIELDS,
   OUTCOMES,
@@ -7885,28 +10996,35 @@ export {
   buildVendor,
   catalogConnections,
   connectFields,
+  connectionSettings,
   connectionSteps,
   connections,
   consentUrl,
   effectsOf,
   ensureSystemWorkflows,
   hookSupport,
+  implementsHook,
   isStale,
   isStatus,
   mergeSettings,
+  perform,
   pkcePair,
   projectConnection,
   publicConnectionKeys,
   publicSettingsBySlug,
+  reconcileConnectionScopes,
   redactSettings,
+  reference,
   resolveConnection,
   runHook,
   scopesMessage,
+  spliced,
   stepLabels,
   stepQueues,
   stepRoutes,
   surviving,
   systemSteps,
+  systemWorkflows,
   tokenSettings,
   vendors
 };