@drawbridge/drawbridge-utils 0.0.89 → 0.0.91

package/dist/fetch.cjs

@@ -66,7 +66,19 @@ var request = async ({
       "?" + import_qs.default.stringify(
         params,
         {
-          encode: false
+          // Values MUST be percent-encoded. Params routinely carry user input
+          // (a list search for `Smith & Sons`) and whole URLs (the OAuth
+          // breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+          // With encoding off entirely, the first `&` inside a value ended that
+          // value and the remainder arrived as sibling params: searches
+          // truncated silently, and the Shopify account-link resume lost its
+          // redirect_uri, dropping the merchant on /organizations instead of
+          // back in the embedded app.
+          //
+          // encodeValuesOnly — not full encoding — because the bracket notation
+          // stays readable (search[keys][0]=…), so every query the api already
+          // parses is byte-identical whenever the values needed no escaping.
+          encodeValuesOnly: true
         }
       )
     );

package/dist/fetch.d.cts

@@ -51,7 +51,19 @@ const request = async ({
 			'?' + qs.stringify(
 				params,
 				{
-					encode : false
+					// Values MUST be percent-encoded. Params routinely carry user input
+					// (a list search for `Smith & Sons`) and whole URLs (the OAuth
+					// breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+					// With encoding off entirely, the first `&` inside a value ended that
+					// value and the remainder arrived as sibling params: searches
+					// truncated silently, and the Shopify account-link resume lost its
+					// redirect_uri, dropping the merchant on /organizations instead of
+					// back in the embedded app.
+					//
+					// encodeValuesOnly — not full encoding — because the bracket notation
+					// stays readable (search[keys][0]=…), so every query the api already
+					// parses is byte-identical whenever the values needed no escaping.
+					encodeValuesOnly : true
 				}
 			)
 		);

package/dist/fetch.d.ts

@@ -51,7 +51,19 @@ const request = async ({
 			'?' + qs.stringify(
 				params,
 				{
-					encode : false
+					// Values MUST be percent-encoded. Params routinely carry user input
+					// (a list search for `Smith & Sons`) and whole URLs (the OAuth
+					// breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+					// With encoding off entirely, the first `&` inside a value ended that
+					// value and the remainder arrived as sibling params: searches
+					// truncated silently, and the Shopify account-link resume lost its
+					// redirect_uri, dropping the merchant on /organizations instead of
+					// back in the embedded app.
+					//
+					// encodeValuesOnly — not full encoding — because the bracket notation
+					// stays readable (search[keys][0]=…), so every query the api already
+					// parses is byte-identical whenever the values needed no escaping.
+					encodeValuesOnly : true
 				}
 			)
 		);

package/dist/fetch.js

@@ -30,7 +30,19 @@ var request = async ({
       "?" + qs.stringify(
         params,
         {
-          encode: false
+          // Values MUST be percent-encoded. Params routinely carry user input
+          // (a list search for `Smith & Sons`) and whole URLs (the OAuth
+          // breakout's redirectTo = /api/oauth/authorize?client_id=…&redirect_uri=…).
+          // With encoding off entirely, the first `&` inside a value ended that
+          // value and the remainder arrived as sibling params: searches
+          // truncated silently, and the Shopify account-link resume lost its
+          // redirect_uri, dropping the merchant on /organizations instead of
+          // back in the embedded app.
+          //
+          // encodeValuesOnly — not full encoding — because the bracket notation
+          // stays readable (search[keys][0]=…), so every query the api already
+          // parses is byte-identical whenever the values needed no escaping.
+          encodeValuesOnly: true
         }
       )
     );

package/dist/plans.cjs

@@ -423,8 +423,8 @@ var plans = {
   }
 };
 var conversionRate = (subscription) => {
-  var _a;
-  return (subscription == null ? void 0 : subscription.conversion) ?? ((_a = plans[subscription == null ? void 0 : subscription.plan]) == null ? void 0 : _a.conversion) ?? free.conversion;
+  var _a, _b;
+  return ((_a = subscription == null ? void 0 : subscription.overrides) == null ? void 0 : _a.conversion) ?? (subscription == null ? void 0 : subscription.conversion) ?? ((_b = plans[subscription == null ? void 0 : subscription.plan]) == null ? void 0 : _b.conversion) ?? free.conversion;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/plans.d.cts

@@ -196,11 +196,14 @@ const plans = {
 };
 
 // Resolve the conversion-fee percentage for an order's owning org.
-// Precedence: explicit per-subscription override (admin/negotiated) →
-// the plan's catalog default → the free-org rate. `subscription` is null
-// for free orgs (they have no subscription doc).
+// Precedence: explicit per-subscription override (admin/negotiated) in
+// subscription.overrides → the legacy top-level field (pre-migration docs;
+// remove after the overrides cleanup release) → the plan's catalog default →
+// the free-org rate. `??` throughout — a stored 0 is a valid 0% override.
+// `subscription` is null for free orgs (they have no subscription doc).
 const conversionRate = ( subscription ) =>
-	subscription?.conversion
+	subscription?.overrides?.conversion
+	?? subscription?.conversion
 	?? plans[ subscription?.plan ]?.conversion
 	?? free.conversion;
 

package/dist/plans.d.ts

@@ -196,11 +196,14 @@ const plans = {
 };
 
 // Resolve the conversion-fee percentage for an order's owning org.
-// Precedence: explicit per-subscription override (admin/negotiated) →
-// the plan's catalog default → the free-org rate. `subscription` is null
-// for free orgs (they have no subscription doc).
+// Precedence: explicit per-subscription override (admin/negotiated) in
+// subscription.overrides → the legacy top-level field (pre-migration docs;
+// remove after the overrides cleanup release) → the plan's catalog default →
+// the free-org rate. `??` throughout — a stored 0 is a valid 0% override.
+// `subscription` is null for free orgs (they have no subscription doc).
 const conversionRate = ( subscription ) =>
-	subscription?.conversion
+	subscription?.overrides?.conversion
+	?? subscription?.conversion
 	?? plans[ subscription?.plan ]?.conversion
 	?? free.conversion;
 

package/dist/plans.js

@@ -386,8 +386,8 @@ var plans = {
   }
 };
 var conversionRate = (subscription) => {
-  var _a;
-  return (subscription == null ? void 0 : subscription.conversion) ?? ((_a = plans[subscription == null ? void 0 : subscription.plan]) == null ? void 0 : _a.conversion) ?? free.conversion;
+  var _a, _b;
+  return ((_a = subscription == null ? void 0 : subscription.overrides) == null ? void 0 : _a.conversion) ?? (subscription == null ? void 0 : subscription.conversion) ?? ((_b = plans[subscription == null ? void 0 : subscription.plan]) == null ? void 0 : _b.conversion) ?? free.conversion;
 };
 export {
   conversionRate,

package/package.json

@@ -13,10 +13,10 @@
     "tinycolor2": "1.6.0"
   },
   "devDependencies": {
+    "@drawbridge/drawbridge-agents": "0.1.28",
     "@node-oauth/oauth2-server": "5.3.0",
     "tsup": "8.5.1",
-    "typescript": "5.9.3",
-    "@drawbridge/drawbridge-agents": "0.1.10"
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
     "@node-oauth/oauth2-server": "^5.3.0"
@@ -164,5 +164,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.89"
+  "version": "0.0.91"
 }