@drawbridge/drawbridge-utils 0.0.109 → 0.0.110

package/dist/connections/index.cjs

@@ -342,7 +342,17 @@ var klaviyo_default2 = {
   // Google product wants it.
   auth: {
     oauth: {
-      authorize: "https://a.klaviyo.com/oauth/authorize",
+      // TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+      //
+      // authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+      // a.klaviyo.com -- their API host -- sends the merchant somewhere that
+      // never renders a consent screen, so the journey stalls with no error
+      // anybody can see.
+      //
+      // token is a server call and must stay on a.klaviyo.com: Klaviyo began
+      // blocking OAuth token traffic through www on 2025-03-31, so the mirror
+      // image of this mistake breaks the exchange instead of the consent.
+      authorize: "https://www.klaviyo.com/oauth/authorize",
       // NAMES the env vars holding OUR application's client. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's

package/dist/connections/index.d.cts

@@ -361,7 +361,17 @@ var klaviyo = {
 	// Google product wants it.
 	auth : {
 		oauth : {
-			authorize : 'https://a.klaviyo.com/oauth/authorize',
+			// TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+			//
+			// authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+			// a.klaviyo.com -- their API host -- sends the merchant somewhere that
+			// never renders a consent screen, so the journey stalls with no error
+			// anybody can see.
+			//
+			// token is a server call and must stay on a.klaviyo.com: Klaviyo began
+			// blocking OAuth token traffic through www on 2025-03-31, so the mirror
+			// image of this mistake breaks the exchange instead of the consent.
+			authorize : 'https://www.klaviyo.com/oauth/authorize',
 			// NAMES the env vars holding OUR application's client. One identity,
 			// every merchant — the token is the merchant's and arrives from their
 			// own consent, which is what stops one organization reading another's

package/dist/connections/index.d.ts

@@ -361,7 +361,17 @@ var klaviyo = {
 	// Google product wants it.
 	auth : {
 		oauth : {
-			authorize : 'https://a.klaviyo.com/oauth/authorize',
+			// TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+			//
+			// authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+			// a.klaviyo.com -- their API host -- sends the merchant somewhere that
+			// never renders a consent screen, so the journey stalls with no error
+			// anybody can see.
+			//
+			// token is a server call and must stay on a.klaviyo.com: Klaviyo began
+			// blocking OAuth token traffic through www on 2025-03-31, so the mirror
+			// image of this mistake breaks the exchange instead of the consent.
+			authorize : 'https://www.klaviyo.com/oauth/authorize',
 			// NAMES the env vars holding OUR application's client. One identity,
 			// every merchant — the token is the merchant's and arrives from their
 			// own consent, which is what stops one organization reading another's

package/dist/connections/index.js

@@ -289,7 +289,17 @@ var klaviyo_default2 = {
   // Google product wants it.
   auth: {
     oauth: {
-      authorize: "https://a.klaviyo.com/oauth/authorize",
+      // TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+      //
+      // authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+      // a.klaviyo.com -- their API host -- sends the merchant somewhere that
+      // never renders a consent screen, so the journey stalls with no error
+      // anybody can see.
+      //
+      // token is a server call and must stay on a.klaviyo.com: Klaviyo began
+      // blocking OAuth token traffic through www on 2025-03-31, so the mirror
+      // image of this mistake breaks the exchange instead of the consent.
+      authorize: "https://www.klaviyo.com/oauth/authorize",
       // NAMES the env vars holding OUR application's client. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's

package/package.json

@@ -200,5 +200,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.109"
+  "version": "0.0.110"
 }