@drawbridge/drawbridge-utils 0.0.66 → 0.0.68

package/dist/usage.d.ts

@@ -1,9 +1,8 @@
-// Usage helpers — the per-org `usage` doc totals and the append-only `action`
-// ledger. These are the low-level usage primitives; billing.action.* (lib/
-// billing.js) is the public surface. Kept separate from billing so the generic
-// usage-totals $inc (used for non-billing totals like revenue/submissions/
-// entries too) doesn't live under the billing namespace. Re-exported from
-// index.js for backward compatibility with existing import sites.
+// Usage helpers — the per-org `usage` doc totals $inc and a duplicate-key guard.
+// Generic, non-billing primitives (incrementUsageTotals is used for revenue /
+// submissions / entries totals too), so they live here rather than under the
+// billing namespace; billing.action.record (lib/billing.js) uses both to write
+// the action ledger. Re-exported from index.js for existing import sites.
 
 // Centralized $inc helper for the per-org usage doc. Replaces inline
 // $inc-with-bypass-validation patterns in drawbridge-api + drawbridge-sync.
@@ -49,81 +48,4 @@ const isDuplicateKey = ( error ) =>
 	|| error?.code === '11000'
 	|| /E11000|duplicate key/i.test( error?.message || '' );
 
-// Record a billable action as a row in the append-only `action` ledger — the
-// source of truth for usage billing (summed per period at changeover).
-//
-// Idempotent via an UPSERT on the unique { usage, key }: a duplicate event (the
-// segment realtime path AND the sweep firing for the same membership, or a retry)
-// matches the existing row and no-ops — no duplicate-key error — so this is safe
-// to call INSIDE a caller's transaction (a thrown E11000 would abort the whole
-// transaction). The display cache `usage.totals.actions` is bumped ONLY when the
-// upsert actually inserts a new row, so a duplicate never double-counts.
-//
-// Pass `session` to make the ledger row + cache bump atomic with the caller's own
-// writes (e.g. the membership writes in a segment-sweep chunk, or the submission
-// docs) — all-or-nothing. Without a session it runs standalone.
-//   key   deterministic per source event, e.g. 'segment.join:<contact>:<segment>'
-//   units billable units (default 1; N for batch, e.g. accepted entries)
-//   meta  attribution ids { campaign, page, submission, segment, workflow, step, ... }
-const recordAction = async ({ controller, organization, usageId, type, units = 1, key, meta = {}, traceId, session }) => {
-
-	if( ! controller || ! organization || ! usageId || ! type || ! key ) return;
-
-	const amount = Number( units );
-
-	if( ! Number.isFinite( amount ) || amount === 0 ) return;
-
-	let inserted = false;
-
-	try {
-
-		const { lastErrorObject } = await controller.update({
-			collection : 'action',
-			data : {
-				$setOnInsert : {
-					organization,
-					usage : usageId,
-					type,
-					units : amount,
-					key,
-					meta,
-					...( traceId && { traceId })
-				}
-			},
-			options : {
-				bypassDocumentValidation : true,
-				includeResultMetadata : true,
-				upsert : true,
-				...( session && { session })
-			},
-			query : {
-				key,
-				usage : usageId
-			}
-		});
-
-		inserted = Boolean( lastErrorObject?.upserted );
-
-	} catch ( error ) {
-
-		// A concurrent upsert of the same { usage, key } can still race to E11000.
-		// Standalone: the other writer recorded it — skip. Inside a transaction:
-		// the txn is already aborted, so re-throw to let the caller retry the whole
-		// unit (which then sees the row and no-ops).
-		if( isDuplicateKey( error ) && ! session ) return;
-
-		throw error;
-
-	}
-
-	// Only a genuinely new row bumps the display cache (a matched duplicate must
-	// not double-count). Joined to the caller's transaction when a session is given.
-	if( inserted ){
-
-		await incrementUsageTotals({ controller, usageId, $inc : { 'totals.actions' : amount }, session });
-
-	}
-
-};
-
-export { incrementUsageTotals, isDuplicateKey, recordAction };
+export { incrementUsageTotals, isDuplicateKey };

package/dist/usage.js

@@ -19,47 +19,7 @@ var incrementUsageTotals = async ({ controller, usageId, $inc, session }) => {
   });
 };
 var isDuplicateKey = (error) => (error == null ? void 0 : error.code) === 11e3 || (error == null ? void 0 : error.code) === "11000" || /E11000|duplicate key/i.test((error == null ? void 0 : error.message) || "");
-var recordAction = async ({ controller, organization, usageId, type, units = 1, key, meta = {}, traceId, session }) => {
-  if (!controller || !organization || !usageId || !type || !key) return;
-  const amount = Number(units);
-  if (!Number.isFinite(amount) || amount === 0) return;
-  let inserted = false;
-  try {
-    const { lastErrorObject } = await controller.update({
-      collection: "action",
-      data: {
-        $setOnInsert: {
-          organization,
-          usage: usageId,
-          type,
-          units: amount,
-          key,
-          meta,
-          ...traceId && { traceId }
-        }
-      },
-      options: {
-        bypassDocumentValidation: true,
-        includeResultMetadata: true,
-        upsert: true,
-        ...session && { session }
-      },
-      query: {
-        key,
-        usage: usageId
-      }
-    });
-    inserted = Boolean(lastErrorObject == null ? void 0 : lastErrorObject.upserted);
-  } catch (error) {
-    if (isDuplicateKey(error) && !session) return;
-    throw error;
-  }
-  if (inserted) {
-    await incrementUsageTotals({ controller, usageId, $inc: { "totals.actions": amount }, session });
-  }
-};
 export {
   incrementUsageTotals,
-  isDuplicateKey,
-  recordAction
+  isDuplicateKey
 };

package/package.json

@@ -122,11 +122,6 @@
       "import": "./dist/http.js",
       "require": "./dist/http.cjs"
     },
-    "./shopify": {
-      "types": "./dist/shopify.d.ts",
-      "import": "./dist/shopify.js",
-      "require": "./dist/shopify.cjs"
-    },
     "./slugify": {
       "types": "./dist/slugify.d.ts",
       "import": "./dist/slugify.js",
@@ -137,11 +132,6 @@
       "import": "./dist/token.js",
       "require": "./dist/token.cjs"
     },
-    "./transactions": {
-      "types": "./dist/transactions.d.ts",
-      "import": "./dist/transactions.js",
-      "require": "./dist/transactions.cjs"
-    },
     "./features": {
       "types": "./dist/features.d.ts",
       "import": "./dist/features.js",
@@ -168,5 +158,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.66"
+  "version": "0.0.68"
 }

package/dist/shopify.cjs

@@ -1,253 +0,0 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// lib/shopify.js
-var shopify_exports = {};
-__export(shopify_exports, {
-  getAdminToken: () => getAdminToken,
-  ping: () => ping,
-  refreshAdminToken: () => refreshAdminToken,
-  resolveConnectionSettings: () => resolveConnectionSettings,
-  signOAuthState: () => signOAuthState,
-  verifyOAuthCallbackHmac: () => verifyOAuthCallbackHmac,
-  verifyOAuthState: () => verifyOAuthState
-});
-module.exports = __toCommonJS(shopify_exports);
-var import_crypto3 = __toESM(require("crypto"), 1);
-
-// lib/encrypt.js
-var import_crypto2 = __toESM(require("crypto"), 1);
-
-// lib/token.js
-var import_crypto = __toESM(require("crypto"), 1);
-var generate = (bytes = 32, encoding = "base64url") => {
-  const buf = import_crypto.default.randomBytes(bytes);
-  return encoding ? buf.toString(encoding) : buf;
-};
-
-// lib/encrypt.js
-var ALGORITHM = "aes-256-gcm";
-var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
-var encrypt = (value) => {
-  const iv = generate(12, null);
-  const cipher = import_crypto2.default.createCipheriv(ALGORITHM, getKey(), iv);
-  const data = Buffer.concat([
-    cipher.update(JSON.stringify(value), "utf8"),
-    cipher.final()
-  ]);
-  const tag = cipher.getAuthTag();
-  return [iv, tag, data].map((b) => b.toString("hex")).join(":");
-};
-var decrypt = (value) => {
-  if (typeof value !== "string") return value;
-  const [ivHex, tagHex, dataHex] = value.split(":");
-  const decipher = import_crypto2.default.createDecipheriv(
-    ALGORITHM,
-    getKey(),
-    Buffer.from(ivHex, "hex")
-  );
-  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
-  const result = Buffer.concat([
-    decipher.update(Buffer.from(dataHex, "hex")),
-    decipher.final()
-  ]);
-  return JSON.parse(result.toString("utf8"));
-};
-
-// lib/shopify.js
-var SHOPIFY_ADMIN_API_VERSION = "2025-01";
-var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
-var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-var OAUTH_STATE_TTL_MS = 5 * 60 * 1e3;
-var signOAuthState = ({ organizationId, shop }) => {
-  const payload = Buffer.from(JSON.stringify({
-    exp: Date.now() + OAUTH_STATE_TTL_MS,
-    organizationId,
-    shop
-  })).toString("base64url");
-  const signature = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
-  return payload + "." + signature;
-};
-var verifyOAuthState = (raw) => {
-  if (!raw) return null;
-  const [payload, signature] = raw.split(".");
-  if (!payload || !signature) return null;
-  const expected = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(payload).digest("base64url");
-  if (signature.length !== expected.length) return null;
-  const valid = import_crypto3.default.timingSafeEqual(
-    Buffer.from(signature),
-    Buffer.from(expected)
-  );
-  if (!valid) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(Buffer.from(payload, "base64url").toString());
-  } catch {
-    return null;
-  }
-  ;
-  if (!(parsed == null ? void 0 : parsed.exp) || parsed.exp < Date.now()) return null;
-  return parsed;
-};
-var verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
-  const message = (rawQuery || "").split("&").filter((pair) => !pair.startsWith("hmac=")).sort((a, b) => {
-    const nameA = a.split("=")[0];
-    const nameB = b.split("=")[0];
-    return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
-  }).join("&");
-  const digest = import_crypto3.default.createHmac("sha256", process.env.SHOPIFY_API_SECRET).update(message).digest("hex");
-  const digestBuf = Buffer.from(digest);
-  const hmacBuf = Buffer.from(hmac || "");
-  return digestBuf.length === hmacBuf.length && import_crypto3.default.timingSafeEqual(digestBuf, hmacBuf);
-};
-var shopifyOAuthFetch = async (url, body) => {
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    const error = new Error(response.status + ": " + text);
-    error.status = response.status;
-    throw error;
-  }
-  return response.json();
-};
-var ping = async ({ adminAccessToken, domain }) => {
-  const response = await fetch(
-    `https://${domain}/admin/api/${SHOPIFY_ADMIN_API_VERSION}/shop.json`,
-    {
-      headers: {
-        "X-Shopify-Access-Token": adminAccessToken
-      }
-    }
-  );
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    const error = new Error(response.status + ": " + text);
-    error.status = response.status;
-    throw error;
-  }
-};
-var resolveConnectionSettings = async ({ connection, controller }) => {
-  const connectionSettings = (connection == null ? void 0 : connection.settings) ? decrypt(connection.settings) : {};
-  if (!(connection == null ? void 0 : connection.credential)) {
-    return connectionSettings;
-  }
-  const credential = await controller.get({
-    collection: "credential",
-    query: {
-      id: connection.credential
-    }
-  });
-  const credentialSettings = (credential == null ? void 0 : credential.settings) ? decrypt(credential.settings) : {};
-  return {
-    ...credentialSettings,
-    ...connectionSettings
-  };
-};
-var refreshAdminToken = async ({ connection, controller }) => {
-  var _a;
-  const credential = await controller.get({
-    collection: "credential",
-    query: {
-      id: connection.credential
-    }
-  });
-  if (!credential) {
-    throw new Error("refreshAdminToken: credential not found for connection " + connection.id);
-  }
-  ;
-  const settings = decrypt(credential.settings);
-  const domain = (_a = credential.provider) == null ? void 0 : _a.id;
-  const { refreshToken } = settings;
-  const data = await shopifyOAuthFetch(
-    `https://${domain}/admin/oauth/access_token`,
-    {
-      grant_type: "refresh_token",
-      client_id: process.env.SHOPIFY_API_KEY,
-      client_secret: process.env.SHOPIFY_API_SECRET,
-      refresh_token: refreshToken
-    }
-  );
-  const adminAccessToken = data.access_token;
-  const newRefreshToken = data.refresh_token;
-  const expiresIn = data.expires_in;
-  const tokenExpiresAt = expiresIn ? new Date(Date.now() + expiresIn * 1e3) : null;
-  const refreshTokenExpiresAt = new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS);
-  await ping({ adminAccessToken, domain });
-  await controller.update({
-    collection: "credential",
-    data: {
-      $set: {
-        settings: encrypt({
-          ...settings,
-          adminAccessToken,
-          refreshToken: newRefreshToken,
-          refreshTokenExpiresAt,
-          tokenExpiresAt
-        })
-      }
-    },
-    query: {
-      id: credential.id
-    }
-  });
-  return adminAccessToken;
-};
-var getAdminToken = async ({ connection, controller }) => {
-  if (!(connection == null ? void 0 : connection.credential)) {
-    return null;
-  }
-  ;
-  const settings = await resolveConnectionSettings({ connection, controller });
-  const { adminAccessToken, refreshToken, tokenExpiresAt } = settings;
-  if (!refreshToken) {
-    return adminAccessToken;
-  }
-  ;
-  const needsRefresh = !tokenExpiresAt || new Date(tokenExpiresAt) < new Date(Date.now() + ACCESS_TOKEN_REFRESH_BUFFER_MS);
-  if (needsRefresh) {
-    return refreshAdminToken({ connection, controller });
-  }
-  ;
-  return adminAccessToken;
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getAdminToken,
-  ping,
-  refreshAdminToken,
-  resolveConnectionSettings,
-  signOAuthState,
-  verifyOAuthCallbackHmac,
-  verifyOAuthState
-});

package/dist/shopify.d.cts

@@ -1,259 +0,0 @@
-import crypto from 'crypto';
-import { decrypt, encrypt } from './encrypt.cjs';
-import './token.cjs';
-
-const SHOPIFY_ADMIN_API_VERSION = '2025-01';
-const REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
-const ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
-const OAUTH_STATE_TTL_MS = 5 * 60 * 1000;
-
-const signOAuthState = ({ organizationId, shop }) => {
-
-	const payload = Buffer.from( JSON.stringify({
-		exp : Date.now() + OAUTH_STATE_TTL_MS,
-		organizationId,
-		shop
-	}) ).toString( 'base64url' );
-
-	const signature = crypto
-		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
-		.update( payload )
-		.digest( 'base64url' );
-
-	return payload + '.' + signature;
-
-};
-
-const verifyOAuthState = ( raw ) => {
-
-	if( ! raw ) return null;
-
-	const [ payload, signature ] = raw.split( '.' );
-
-	if( ! payload || ! signature ) return null;
-
-	const expected = crypto
-		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
-		.update( payload )
-		.digest( 'base64url' );
-
-	if( signature.length !== expected.length ) return null;
-
-	const valid = crypto.timingSafeEqual(
-		Buffer.from( signature ),
-		Buffer.from( expected )
-	);
-
-	if( ! valid ) return null;
-
-	let parsed;
-
-	try {
-
-		parsed = JSON.parse( Buffer.from( payload, 'base64url' ).toString() );
-
-	} catch {
-
-		return null;
-
-	}
-	if( ! parsed?.exp || parsed.exp < Date.now() ) return null;
-
-	return parsed;
-
-};
-
-// Verifies the HMAC Shopify includes on OAuth callback query strings. Sort by
-// parameter NAME (not full key=value pair) per Shopify spec — matches the
-// official @shopify/shopify-api SDK. A plain .sort() compares whole strings,
-// which would diverge when one name is a prefix of another and the next char
-// sorts before '=' in ASCII (e.g. `state` vs `state2`).
-const verifyOAuthCallbackHmac = ({ hmac, rawQuery }) => {
-
-	const message = ( rawQuery || '' )
-		.split( '&' )
-		.filter( pair => ! pair.startsWith( 'hmac=' ) )
-		.sort( ( a, b ) => {
-
-			const nameA = a.split( '=' )[ 0 ];
-			const nameB = b.split( '=' )[ 0 ];
-
-			return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
-
-		})
-		.join( '&' );
-
-	const digest = crypto
-		.createHmac( 'sha256', process.env.SHOPIFY_API_SECRET )
-		.update( message )
-		.digest( 'hex' );
-
-	const digestBuf = Buffer.from( digest );
-	const hmacBuf = Buffer.from( hmac || '' );
-
-	return digestBuf.length === hmacBuf.length
-		&& crypto.timingSafeEqual( digestBuf, hmacBuf );
-
-};
-
-const shopifyOAuthFetch = async ( url, body ) => {
-
-	const response = await fetch( url, {
-		method : 'POST',
-		headers : {
-			'Content-Type' : 'application/json'
-		},
-		body : JSON.stringify( body )
-	});
-
-	if( ! response.ok ){
-
-		const text = await response.text().catch( () => '' );
-		const error = new Error( response.status + ': ' + text );
-
-		error.status = response.status;
-
-		throw error;
-
-	}
-
-	return response.json();
-
-};
-
-const ping = async ({ adminAccessToken, domain }) => {
-
-	const response = await fetch(
-		`https://${ domain }/admin/api/${ SHOPIFY_ADMIN_API_VERSION }/shop.json`,
-		{
-			headers : {
-				'X-Shopify-Access-Token' : adminAccessToken
-			}
-		}
-	);
-
-	if( ! response.ok ){
-
-		const text = await response.text().catch( () => '' );
-		const error = new Error( response.status + ': ' + text );
-
-		error.status = response.status;
-
-		throw error;
-
-	}
-
-};
-
-const resolveConnectionSettings = async ({ connection, controller }) => {
-
-	const connectionSettings = connection?.settings ? decrypt( connection.settings ) : {};
-
-	if( ! connection?.credential ){
-
-		return connectionSettings;
-
-	}
-
-	const credential = await controller.get({
-		collection : 'credential',
-		query : {
-			id : connection.credential
-		}
-	});
-
-	const credentialSettings = credential?.settings ? decrypt( credential.settings ) : {};
-
-	return {
-		...credentialSettings,
-		...connectionSettings
-	};
-
-};
-
-const refreshAdminToken = async ({ connection, controller }) => {
-
-	const credential = await controller.get({
-		collection : 'credential',
-		query : {
-			id : connection.credential
-		}
-	});
-
-	if( ! credential ){
-
-		throw new Error( 'refreshAdminToken: credential not found for connection ' + connection.id );
-
-	}
-	const settings = decrypt( credential.settings );
-	const domain = credential.provider?.id;
-	const { refreshToken } = settings;
-
-	const data = await shopifyOAuthFetch(
-		`https://${ domain }/admin/oauth/access_token`,
-		{
-			grant_type : 'refresh_token',
-			client_id : process.env.SHOPIFY_API_KEY,
-			client_secret : process.env.SHOPIFY_API_SECRET,
-			refresh_token : refreshToken
-		}
-	);
-
-	const adminAccessToken = data.access_token;
-	const newRefreshToken = data.refresh_token;
-	const expiresIn = data.expires_in;
-	const tokenExpiresAt = expiresIn ? new Date( Date.now() + ( expiresIn * 1000 ) ) : null;
-	const refreshTokenExpiresAt = new Date( Date.now() + REFRESH_TOKEN_LIFETIME_MS );
-
-	await ping({ adminAccessToken, domain });
-
-	await controller.update({
-		collection : 'credential',
-		data : {
-			$set : {
-				settings : encrypt({
-					...settings,
-					adminAccessToken,
-					refreshToken : newRefreshToken,
-					refreshTokenExpiresAt,
-					tokenExpiresAt
-				})
-			}
-		},
-		query : {
-			id : credential.id
-		}
-	});
-
-	return adminAccessToken;
-
-};
-
-const getAdminToken = async ({ connection, controller }) => {
-
-	if( ! connection?.credential ){
-
-		return null;
-
-	}
-	const settings = await resolveConnectionSettings({ connection, controller });
-	const { adminAccessToken, refreshToken, tokenExpiresAt } = settings;
-
-	if( ! refreshToken ){
-
-		return adminAccessToken;
-
-	}
-	const needsRefresh = ! tokenExpiresAt ||
-		new Date( tokenExpiresAt ) < new Date( Date.now() + ACCESS_TOKEN_REFRESH_BUFFER_MS );
-
-	if( needsRefresh ){
-
-		return refreshAdminToken({ connection, controller });
-
-	}
-	return adminAccessToken;
-
-};
-
-export { getAdminToken, ping, refreshAdminToken, resolveConnectionSettings, signOAuthState, verifyOAuthCallbackHmac, verifyOAuthState };