@drawbridge/drawbridge-utils 0.0.89 → 0.0.90

package/dist/fetch.cjs

@@ -66,7 +66,19 @@ var request = async ({
       "?" + import_qs.default.stringify(
         params,
         {
-          encode: false
+          // Values MUST be percent-encoded. Params routinely carry user input
+          // (a list search for `Smith & Sons`) and whole URLs (the OAuth
+          // breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+          // With encoding off entirely, the first `&` inside a value ended that
+          // value and the remainder arrived as sibling params: searches
+          // truncated silently, and the Shopify account-link resume lost its
+          // redirect_uri, dropping the merchant on /organizations instead of
+          // back in the embedded app.
+          //
+          // encodeValuesOnly — not full encoding — because the bracket notation
+          // stays readable (search[keys][0]=…), so every query the api already
+          // parses is byte-identical whenever the values needed no escaping.
+          encodeValuesOnly: true
         }
       )
     );

package/dist/fetch.d.cts

@@ -51,7 +51,19 @@ const request = async ({
 			'?' + qs.stringify(
 				params,
 				{
-					encode : false
+					// Values MUST be percent-encoded. Params routinely carry user input
+					// (a list search for `Smith & Sons`) and whole URLs (the OAuth
+					// breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+					// With encoding off entirely, the first `&` inside a value ended that
+					// value and the remainder arrived as sibling params: searches
+					// truncated silently, and the Shopify account-link resume lost its
+					// redirect_uri, dropping the merchant on /organizations instead of
+					// back in the embedded app.
+					//
+					// encodeValuesOnly — not full encoding — because the bracket notation
+					// stays readable (search[keys][0]=…), so every query the api already
+					// parses is byte-identical whenever the values needed no escaping.
+					encodeValuesOnly : true
 				}
 			)
 		);

package/dist/fetch.d.ts

@@ -51,7 +51,19 @@ const request = async ({
 			'?' + qs.stringify(
 				params,
 				{
-					encode : false
+					// Values MUST be percent-encoded. Params routinely carry user input
+					// (a list search for `Smith & Sons`) and whole URLs (the OAuth
+					// breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+					// With encoding off entirely, the first `&` inside a value ended that
+					// value and the remainder arrived as sibling params: searches
+					// truncated silently, and the Shopify account-link resume lost its
+					// redirect_uri, dropping the merchant on /organizations instead of
+					// back in the embedded app.
+					//
+					// encodeValuesOnly — not full encoding — because the bracket notation
+					// stays readable (search[keys][0]=…), so every query the api already
+					// parses is byte-identical whenever the values needed no escaping.
+					encodeValuesOnly : true
 				}
 			)
 		);

package/dist/fetch.js

@@ -30,7 +30,19 @@ var request = async ({
       "?" + qs.stringify(
         params,
         {
-          encode: false
+          // Values MUST be percent-encoded. Params routinely carry user input
+          // (a list search for `Smith & Sons`) and whole URLs (the OAuth
+          // breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+          // With encoding off entirely, the first `&` inside a value ended that
+          // value and the remainder arrived as sibling params: searches
+          // truncated silently, and the Shopify account-link resume lost its
+          // redirect_uri, dropping the merchant on /organizations instead of
+          // back in the embedded app.
+          //
+          // encodeValuesOnly — not full encoding — because the bracket notation
+          // stays readable (search[keys][0]=…), so every query the api already
+          // parses is byte-identical whenever the values needed no escaping.
+          encodeValuesOnly: true
         }
       )
     );

package/package.json

@@ -13,10 +13,10 @@
     "tinycolor2": "1.6.0"
   },
   "devDependencies": {
+    "@drawbridge/drawbridge-agents": "0.1.24",
     "@node-oauth/oauth2-server": "5.3.0",
     "tsup": "8.5.1",
-    "typescript": "5.9.3",
-    "@drawbridge/drawbridge-agents": "0.1.10"
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
     "@node-oauth/oauth2-server": "^5.3.0"
@@ -164,5 +164,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.89"
+  "version": "0.0.90"
 }