@drawbridge/drawbridge-utils 0.0.42 → 0.0.44

package/dist/ai.cjs

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// ai.js
+// lib/ai.js
 var ai_exports = {};
 __export(ai_exports, {
   MARKUP: () => MARKUP,
@@ -31,7 +31,7 @@ __export(ai_exports, {
 module.exports = __toCommonJS(ai_exports);
 var import_genai = require("@google/genai");
 
-// circuit.js
+// lib/circuit.js
 var CLOSED = "CLOSED";
 var OPEN = "OPEN";
 var HALF_OPEN = "HALF_OPEN";
@@ -82,7 +82,7 @@ var circuit = ({
   };
 };
 
-// transactions.js
+// lib/transactions.js
 var import_drawbridge_telemetry = require("@drawbridge/drawbridge-telemetry");
 var insertTransaction = async ({
   db,
@@ -155,7 +155,7 @@ var debit = async ({
   });
 };
 
-// ai.js
+// lib/ai.js
 var google_client = new import_genai.GoogleGenAI({
   apiKey: process.env.GOOGLE_API_KEY
 });

package/dist/ai.js

@@ -1,12 +1,131 @@
-import {
-  debit
-} from "./chunk-JT2PAZAZ.js";
-import {
-  circuit
-} from "./chunk-6HH36OK6.js";
-
-// ai.js
+// lib/ai.js
 import { GoogleGenAI } from "@google/genai";
+
+// lib/circuit.js
+var CLOSED = "CLOSED";
+var OPEN = "OPEN";
+var HALF_OPEN = "HALF_OPEN";
+var circuit = ({
+  name,
+  threshold = 5,
+  timeout = 3e4
+}) => {
+  let state = CLOSED;
+  let failures = 0;
+  let openedAt = null;
+  const trip = () => {
+    state = OPEN;
+    openedAt = Date.now();
+    console.error(`Circuit breaker OPEN: ${name}`);
+  };
+  const reset = () => {
+    state = CLOSED;
+    failures = 0;
+    openedAt = null;
+    console.log(`Circuit breaker CLOSED: ${name}`);
+  };
+  return async (fn) => {
+    if (state === OPEN) {
+      if (Date.now() - openedAt >= timeout) {
+        state = HALF_OPEN;
+      } else {
+        const error = new Error(`${name} is temporarily unavailable`);
+        error.status = 503;
+        throw error;
+      }
+    }
+    try {
+      const result = await fn();
+      if (state === HALF_OPEN) {
+        reset();
+      } else {
+        failures = 0;
+      }
+      return result;
+    } catch (error) {
+      failures++;
+      if (state === HALF_OPEN || failures >= threshold) {
+        trip();
+      }
+      throw error;
+    }
+  };
+};
+
+// lib/transactions.js
+import { currentTraceId } from "@drawbridge/drawbridge-telemetry";
+var insertTransaction = async ({
+  db,
+  user,
+  type,
+  category,
+  source,
+  amount,
+  _id,
+  stripeInvoiceId,
+  stripeEventId,
+  session,
+  ...rest
+}) => {
+  var _a;
+  const beforeRaw = (_a = user == null ? void 0 : user.balance) == null ? void 0 : _a[type];
+  const balance = typeof beforeRaw === "number" ? { before: beforeRaw, after: beforeRaw + amount } : void 0;
+  const trace = currentTraceId();
+  await db.create({
+    authenticated: user,
+    collection: "transaction",
+    data: {
+      ..._id && { _id },
+      user: user == null ? void 0 : user.id,
+      type,
+      category,
+      source,
+      amount,
+      ...balance && { balance },
+      ...trace && { trace },
+      ...rest,
+      ...stripeInvoiceId && { stripeInvoiceId },
+      ...stripeEventId && { stripeEventId }
+    },
+    ...session && { options: { session } }
+  });
+};
+var debit = async ({
+  db,
+  user,
+  amount,
+  type,
+  category,
+  source,
+  stripeInvoiceId,
+  stripeEventId,
+  session,
+  ...rest
+}) => {
+  if (!Number.isInteger(amount) || amount <= 0) {
+    throw new Error(`debit() requires a positive integer amount, got ${amount}`);
+  }
+  if (!type) {
+    throw new Error('debit() requires a type (e.g., "ai")');
+  }
+  if (!source) {
+    throw new Error('debit() requires a source ("system" | "admin" | "user")');
+  }
+  await insertTransaction({
+    db,
+    user,
+    type,
+    category,
+    source,
+    amount: -amount,
+    stripeInvoiceId,
+    stripeEventId,
+    session,
+    ...rest
+  });
+};
+
+// lib/ai.js
 var google_client = new GoogleGenAI({
   apiKey: process.env.GOOGLE_API_KEY
 });

package/dist/axios.cjs

@@ -26,7 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// axios.js
+// lib/axios.js
 var axios_exports = {};
 __export(axios_exports, {
   axios: () => axios,

package/dist/axios.js

@@ -1,4 +1,4 @@
-// axios.js
+// lib/axios.js
 import axiosLib from "axios";
 import dns from "dns";
 import https from "https";

package/dist/cdn.cjs

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// cdn.js
+// lib/cdn.js
 var cdn_exports = {};
 __export(cdn_exports, {
   cdnShopify: () => cdnShopify,

package/dist/cdn.js

@@ -1,4 +1,4 @@
-// cdn.js
+// lib/cdn.js
 var cdnSrc = (asset, size, timestamp) => {
   var _a;
   const src = (_a = asset == null ? void 0 : asset.sizes) == null ? void 0 : _a[size];

package/dist/circuit.cjs

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// circuit.js
+// lib/circuit.js
 var circuit_exports = {};
 __export(circuit_exports, {
   circuit: () => circuit

package/dist/circuit.js

@@ -1,6 +1,53 @@
-import {
-  circuit
-} from "./chunk-6HH36OK6.js";
+// lib/circuit.js
+var CLOSED = "CLOSED";
+var OPEN = "OPEN";
+var HALF_OPEN = "HALF_OPEN";
+var circuit = ({
+  name,
+  threshold = 5,
+  timeout = 3e4
+}) => {
+  let state = CLOSED;
+  let failures = 0;
+  let openedAt = null;
+  const trip = () => {
+    state = OPEN;
+    openedAt = Date.now();
+    console.error(`Circuit breaker OPEN: ${name}`);
+  };
+  const reset = () => {
+    state = CLOSED;
+    failures = 0;
+    openedAt = null;
+    console.log(`Circuit breaker CLOSED: ${name}`);
+  };
+  return async (fn) => {
+    if (state === OPEN) {
+      if (Date.now() - openedAt >= timeout) {
+        state = HALF_OPEN;
+      } else {
+        const error = new Error(`${name} is temporarily unavailable`);
+        error.status = 503;
+        throw error;
+      }
+    }
+    try {
+      const result = await fn();
+      if (state === HALF_OPEN) {
+        reset();
+      } else {
+        failures = 0;
+      }
+      return result;
+    } catch (error) {
+      failures++;
+      if (state === HALF_OPEN || failures >= threshold) {
+        trip();
+      }
+      throw error;
+    }
+  };
+};
 export {
   circuit
 };

package/dist/encrypt.cjs

@@ -26,7 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// encrypt.js
+// lib/encrypt.js
 var encrypt_exports = {};
 __export(encrypt_exports, {
   decrypt: () => decrypt,
@@ -35,14 +35,14 @@ __export(encrypt_exports, {
 module.exports = __toCommonJS(encrypt_exports);
 var import_crypto2 = __toESM(require("crypto"), 1);
 
-// token.js
+// lib/token.js
 var import_crypto = __toESM(require("crypto"), 1);
 var generate = (bytes = 32, encoding = "base64url") => {
   const buf = import_crypto.default.randomBytes(bytes);
   return encoding ? buf.toString(encoding) : buf;
 };
 
-// encrypt.js
+// lib/encrypt.js
 var ALGORITHM = "aes-256-gcm";
 var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
 var encrypt = (value) => {

package/dist/encrypt.js

@@ -1,8 +1,41 @@
-import {
-  decrypt,
-  encrypt
-} from "./chunk-2DRAIKGZ.js";
-import "./chunk-OS2AHUWX.js";
+// lib/encrypt.js
+import crypto2 from "crypto";
+
+// lib/token.js
+import crypto from "crypto";
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = crypto.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+
+// lib/encrypt.js
+var ALGORITHM = "aes-256-gcm";
+var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
+var encrypt = (value) => {
+  const iv = generate(12, null);
+  const cipher = crypto2.createCipheriv(ALGORITHM, getKey(), iv);
+  const data = Buffer.concat([
+    cipher.update(JSON.stringify(value), "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return [iv, tag, data].map((b) => b.toString("hex")).join(":");
+};
+var decrypt = (value) => {
+  if (typeof value !== "string") return value;
+  const [ivHex, tagHex, dataHex] = value.split(":");
+  const decipher = crypto2.createDecipheriv(
+    ALGORITHM,
+    getKey(),
+    Buffer.from(ivHex, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  const result = Buffer.concat([
+    decipher.update(Buffer.from(dataHex, "hex")),
+    decipher.final()
+  ]);
+  return JSON.parse(result.toString("utf8"));
+};
 export {
   decrypt,
   encrypt

package/dist/fetch.cjs

@@ -26,7 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// fetch.js
+// lib/fetch.js
 var fetch_exports = {};
 __export(fetch_exports, {
   queryString: () => queryString,

package/dist/fetch.js

@@ -1,4 +1,4 @@
-// fetch.js
+// lib/fetch.js
 import qs from "qs";
 var queryString = qs;
 var memoryToken = null;

package/dist/http.cjs

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// http.js
+// lib/http.js
 var http_exports = {};
 __export(http_exports, {
   request: () => request

package/dist/http.js

@@ -1,4 +1,4 @@
-// http.js
+// lib/http.js
 var DEFAULT_TIMEOUT_MS = 15e3;
 var request = async ({
   body,

package/dist/nanoid.cjs

@@ -16,7 +16,7 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// nanoid.js
+// lib/nanoid.js
 var nanoid_exports = {};
 __export(nanoid_exports, {
   nanoid: () => nanoid,

package/dist/nanoid.js

@@ -1,4 +1,4 @@
-// nanoid.js
+// lib/nanoid.js
 import { customAlphabet } from "nanoid";
 var nanoid = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
 var DEFAULT_MAX_RETRIES = 5;

package/dist/{oauth.cjs → oauth/index.cjs}

@@ -26,23 +26,26 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// oauth.js
+// lib/oauth/index.js
 var oauth_exports = {};
 __export(oauth_exports, {
-  DEVELOPER_ALLOWED_SCOPES: () => DEVELOPER_ALLOWED_SCOPES,
-  SCOPES: () => SCOPES,
   compare: () => compare,
   createOAuthClient: () => createOAuthClient,
+  developer: () => developer,
+  developerOptions: () => developerOptions,
   generateToken: () => generateToken,
   hashToken: () => hashToken,
   intersect: () => intersect,
   isDeveloperAllowed: () => isDeveloperAllowed,
   parse: () => parse,
+  scopeLabels: () => scopeLabels,
+  scopeOptions: () => scopeOptions,
+  scopes: () => scopes,
   validate: () => validate
 });
 module.exports = __toCommonJS(oauth_exports);
 
-// token.js
+// lib/token.js
 var import_crypto = __toESM(require("crypto"), 1);
 var generate = (bytes = 32, encoding = "base64url") => {
   const buf = import_crypto.default.randomBytes(bytes);
@@ -64,8 +67,8 @@ var compare = (a, b) => {
   );
 };
 
-// oauth.js
-var SCOPES = [
+// lib/oauth/index.js
+var scopes = [
   "profile:read",
   "profile:write",
   "organization:read",
@@ -82,7 +85,7 @@ var SCOPES = [
   "billing:write",
   "admin"
 ];
-var DEVELOPER_ALLOWED_SCOPES = [
+var developer = [
   "profile:read",
   "organization:read",
   "campaigns:read",
@@ -99,9 +102,9 @@ var parse = (raw) => {
   if (Array.isArray(raw)) return raw;
   return String(raw).split(/\s+/).filter(Boolean);
 };
-var validate = (scopes) => {
-  const parsed = parse(scopes);
-  const invalid = parsed.filter((scope) => !SCOPES.includes(scope));
+var validate = (scopes2) => {
+  const parsed = parse(scopes2);
+  const invalid = parsed.filter((scope) => !scopes2.includes(scope));
   return {
     invalid,
     valid: invalid.length === 0
@@ -112,14 +115,37 @@ var intersect = (requested, allowed) => {
   const a = parse(allowed);
   return r.filter((scope) => a.includes(scope));
 };
-var isDeveloperAllowed = (scope) => DEVELOPER_ALLOWED_SCOPES.includes(scope);
+var isDeveloperAllowed = (scope) => developer.includes(scope);
+var scopeLabels = {
+  "profile:read": "Read own profile",
+  "profile:write": "Update own profile",
+  "organization:read": "Read organization info",
+  "organization:write": "Manage organization",
+  "campaigns:read": "Read campaigns",
+  "campaigns:write": "Manage campaigns",
+  "contacts:read": "Read contacts",
+  "contacts:write": "Manage contacts",
+  "workflows:read": "Read workflows",
+  "workflows:write": "Manage workflows",
+  "connections:read": "Read integrations",
+  "connections:write": "Manage integrations",
+  "billing:read": "Read billing",
+  "billing:write": "Manage billing",
+  admin: "Admin access"
+};
+var toOption = (scope) => ({
+  key: scopeLabels[scope] || scope,
+  value: scope
+});
+var developerOptions = developer.map(toOption);
+var scopeOptions = scopes.map(toOption);
 var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 var REFRESH_LEAD_SECONDS = 60;
 var createOAuthClient = ({
   clientId,
   clientSecret,
-  scopes = [],
+  scopes: scopes2 = [],
   tokenUri
 }) => {
   if (!clientId) throw new Error("createOAuthClient: clientId required");
@@ -135,8 +161,8 @@ var createOAuthClient = ({
   const fetchToken = async () => {
     const params = new URLSearchParams();
     params.set("grant_type", "client_credentials");
-    if (scopes.length > 0) {
-      params.set("scope", scopes.join(" "));
+    if (scopes2.length > 0) {
+      params.set("scope", scopes2.join(" "));
     }
     const basic = Buffer.from(clientId + ":" + clientSecret).toString("base64");
     const response = await fetch(
@@ -183,14 +209,17 @@ var createOAuthClient = ({
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  DEVELOPER_ALLOWED_SCOPES,
-  SCOPES,
   compare,
   createOAuthClient,
+  developer,
+  developerOptions,
   generateToken,
   hashToken,
   intersect,
   isDeveloperAllowed,
   parse,
+  scopeLabels,
+  scopeOptions,
+  scopes,
   validate
 });

package/dist/{oauth.d.ts → oauth/index.d.cts}

@@ -1,12 +1,12 @@
-import { generate, hash } from './token.js';
-export { compare } from './token.js';
+import { generate, hash } from '../token.cjs';
+export { compare } from '../token.cjs';
 import 'crypto';
 
 // Shared OAuth helpers used across drawbridge-api, drawbridge-sync,
 // drawbridge-app-web, and any first-party app that needs to participate
 // in the OAuth 2.1 provider:
 //
-//   - SCOPES, DEVELOPER_ALLOWED_SCOPES: the locked scope vocabulary
+//   - scopes, developer: the locked scope vocabulary
 //   - parse, validate, intersect, isDeveloperAllowed: scope set operations
 //   - hashToken, generateToken, compare: opaque-token primitives
 //   - createOAuthClient: cached client_credentials access token getter
@@ -16,7 +16,7 @@ import 'crypto';
 // Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)
 // ─────────────────────────────────────────────────────────────────────────
 
-const SCOPES = [
+const scopes = [
 	'profile:read',
 	'profile:write',
 	'organization:read',
@@ -37,7 +37,7 @@ const SCOPES = [
 // Subset granted to third-party developer apps via /oauth/clients self-service
 // registration. Excludes profile:write (account-level), organization:write
 // (org admin only), billing:* (financial), admin (privileged).
-const DEVELOPER_ALLOWED_SCOPES = [
+const developer = [
 	'profile:read',
 	'organization:read',
 	'campaigns:read',
@@ -63,7 +63,7 @@ const parse = ( raw ) => {
 const validate = ( scopes ) => {
 
 	const parsed = parse( scopes );
-	const invalid = parsed.filter( ( scope ) => ! SCOPES.includes( scope ) );
+	const invalid = parsed.filter( ( scope ) => ! scopes.includes( scope ) );
 
 	return {
 		invalid,
@@ -81,7 +81,39 @@ const intersect = ( requested, allowed ) => {
 
 };
 
-const isDeveloperAllowed = ( scope ) => DEVELOPER_ALLOWED_SCOPES.includes( scope );
+const isDeveloperAllowed = ( scope ) => developer.includes( scope );
+
+// User-facing labels for each scope — used by UI components rendering
+// scope pickers. Centralized here so the dashboard, future admin tools,
+// and any other consumer surface the same strings.
+const scopeLabels = {
+	'profile:read' : 'Read own profile',
+	'profile:write' : 'Update own profile',
+	'organization:read' : 'Read organization info',
+	'organization:write' : 'Manage organization',
+	'campaigns:read' : 'Read campaigns',
+	'campaigns:write' : 'Manage campaigns',
+	'contacts:read' : 'Read contacts',
+	'contacts:write' : 'Manage contacts',
+	'workflows:read' : 'Read workflows',
+	'workflows:write' : 'Manage workflows',
+	'connections:read' : 'Read integrations',
+	'connections:write' : 'Manage integrations',
+	'billing:read' : 'Read billing',
+	'billing:write' : 'Manage billing',
+	admin : 'Admin access'
+};
+
+const toOption = ( scope ) => ({
+	key : scopeLabels[ scope ] || scope,
+	value : scope
+});
+
+// `{ key, value }` option arrays ready to feed any standard checkbox-list
+// component. Derived from the canonical scope arrays so vocabulary
+// changes auto-propagate to every consumer on the next utils bump.
+const developerOptions = developer.map( toOption );
+const scopeOptions = scopes.map( toOption );
 
 // ─────────────────────────────────────────────────────────────────────────
 // Token primitives — convenience wrappers over drawbridge-utils/token that
@@ -228,4 +260,4 @@ const createOAuthClient = ({
 
 };
 
-export { DEVELOPER_ALLOWED_SCOPES, SCOPES, createOAuthClient, generateToken, hashToken, intersect, isDeveloperAllowed, parse, validate };
+export { createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, parse, scopeLabels, scopeOptions, scopes, validate };