@drawbridge/drawbridge-utils 0.0.82 → 0.0.84

package/dist/billing.cjs

@@ -435,6 +435,7 @@ var action = {
       valid.push({ type, amount: amount2, key, meta, traceId });
     }
     if (valid.length === 0) return;
+    const date = /* @__PURE__ */ new Date();
     const result = await controller.bulk({
       collection: "action",
       pipeline: valid.map(({ type, amount: amount2, key, meta, traceId }) => ({
@@ -448,6 +449,8 @@ var action = {
               units: amount2,
               key,
               meta,
+              createdAt: date,
+              updatedAt: date,
               ...traceId && { traceId }
             }
           },

package/dist/billing.d.cts

@@ -485,6 +485,15 @@ const action = {
 
 		if( valid.length === 0 ) return;
 
+		// controller.bulk is a RAW bulkWrite — unlike record()'s controller.update,
+		// nothing injects insert timestamps. createdAt is what the per-period billing
+		// aggregation (and the ledger's TTL index) key on, so a row inserted without
+		// it is invisible to every invoice window forever: sweep-billed segment
+		// joins were counted on the usage display but never billed (2026-07-21,
+		// usage 12 vs invoice qty 3). No `id` is minted here (no ObjectId dep);
+		// ledger rows are only ever queried by key/usage/organization/createdAt.
+		const date = new Date();
+
 		const result = await controller.bulk({
 			collection : 'action',
 			pipeline : valid.map( ({ type, amount, key, meta, traceId }) => ({
@@ -498,6 +507,8 @@ const action = {
 							units : amount,
 							key,
 							meta,
+							createdAt : date,
+							updatedAt : date,
 							...( traceId && { traceId })
 						}
 					},

package/dist/billing.d.ts

@@ -485,6 +485,15 @@ const action = {
 
 		if( valid.length === 0 ) return;
 
+		// controller.bulk is a RAW bulkWrite — unlike record()'s controller.update,
+		// nothing injects insert timestamps. createdAt is what the per-period billing
+		// aggregation (and the ledger's TTL index) key on, so a row inserted without
+		// it is invisible to every invoice window forever: sweep-billed segment
+		// joins were counted on the usage display but never billed (2026-07-21,
+		// usage 12 vs invoice qty 3). No `id` is minted here (no ObjectId dep);
+		// ledger rows are only ever queried by key/usage/organization/createdAt.
+		const date = new Date();
+
 		const result = await controller.bulk({
 			collection : 'action',
 			pipeline : valid.map( ({ type, amount, key, meta, traceId }) => ({
@@ -498,6 +507,8 @@ const action = {
 							units : amount,
 							key,
 							meta,
+							createdAt : date,
+							updatedAt : date,
 							...( traceId && { traceId })
 						}
 					},

package/dist/billing.js

@@ -405,6 +405,7 @@ var action = {
       valid.push({ type, amount: amount2, key, meta, traceId });
     }
     if (valid.length === 0) return;
+    const date = /* @__PURE__ */ new Date();
     const result = await controller.bulk({
       collection: "action",
       pipeline: valid.map(({ type, amount: amount2, key, meta, traceId }) => ({
@@ -418,6 +419,8 @@ var action = {
               units: amount2,
               key,
               meta,
+              createdAt: date,
+              updatedAt: date,
               ...traceId && { traceId }
             }
           },

package/dist/oauth/server.cjs

@@ -361,6 +361,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/dist/oauth/server.d.cts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.d.ts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.js

@@ -326,6 +326,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "dependencies": {
-    "@drawbridge/drawbridge-agents": "0.0.10",
+    "@drawbridge/drawbridge-agents": "0.0.11",
     "@drawbridge/drawbridge-telemetry": "0.0.15",
     "@google/genai": "1.30.0",
     "axios": "1.16.0",
@@ -164,5 +164,5 @@
     "test": "node --test test/"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.82"
+  "version": "0.0.84"
 }