@drawbridge/drawbridge-utils 0.0.109 → 0.0.111

package/dist/connections/index.cjs

@@ -127,6 +127,12 @@ var HOOKS = Object.freeze({
   // not for what Shopify calls it: Shopify says discounts, Stripe says coupons
   // and promotion codes, BigCommerce says coupons and promotions.
   catalog: Object.freeze([
+    // The named groups a contact can be synced INTO. Klaviyo calls them lists,
+    // Mailchimp calls them audiences; `audiences` is the industry-generic term
+    // and belongs to neither vendor's API. Read at form time, so a merchant
+    // picks from what actually exists in their account rather than pasting an
+    // id from another tab.
+    "audiences",
     "products",
     // Shopify folds price into the product variant; Stripe makes Price a
     // first-class object beside Product. Declared so a vendor that separates
@@ -342,7 +348,17 @@ var klaviyo_default2 = {
   // Google product wants it.
   auth: {
     oauth: {
-      authorize: "https://a.klaviyo.com/oauth/authorize",
+      // TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+      //
+      // authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+      // a.klaviyo.com -- their API host -- sends the merchant somewhere that
+      // never renders a consent screen, so the journey stalls with no error
+      // anybody can see.
+      //
+      // token is a server call and must stay on a.klaviyo.com: Klaviyo began
+      // blocking OAuth token traffic through www on 2025-03-31, so the mirror
+      // image of this mistake breaks the exchange instead of the consent.
+      authorize: "https://www.klaviyo.com/oauth/authorize",
       // NAMES the env vars holding OUR application's client. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's
@@ -392,6 +408,17 @@ var klaviyo_default2 = {
     {
       key: "account",
       label: "Klaviyo account"
+    },
+    {
+      input: "select",
+      key: "list",
+      label: "Klaviyo list",
+      message: "Contacts your campaigns collect are synced into this list.",
+      required: true,
+      // The choices come from the merchant's own account, not from here — see
+      // catalog.audiences below. Static options would mean asking somebody to
+      // paste a list id copied out of another browser tab.
+      source: "catalog.audiences"
     }
   ],
   // The three auth hooks, all pure HTTP against Klaviyo — which is why they
@@ -417,6 +444,29 @@ var klaviyo_default2 = {
     //
     // Basic auth with our client, exactly like the token exchange — the token
     // being revoked is the subject, not the credential.
+    // The lists a merchant can sync into, for the picker on their connection.
+    //
+    // PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to it,
+    // so a single call quietly returns the first ten lists and an account with
+    // more would show a picker missing the one they wanted — with nothing to
+    // indicate anything was cut. Follows links.next, bounded so a runaway
+    // cursor cannot spin forever.
+    "catalog.audiences": async ({ fetcher, token }) => {
+      var _a, _b;
+      const audiences = [];
+      let path = "/lists?page%5Bsize%5D=10";
+      let pages = 0;
+      while (path && pages < 20) {
+        const body = await api(path, { fetcher, token });
+        for (const list of (body == null ? void 0 : body.data) || []) {
+          audiences.push({ label: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id, value: list.id });
+        }
+        const next = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
+        path = next ? String(next).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
+        pages = pages + 1;
+      }
+      return audiences;
+    },
     "auth.disconnect": async ({ clientId, clientSecret, fetcher = fetch, settings }) => {
       const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
       if (!token) return { revoked: false };
@@ -490,6 +540,7 @@ var klaviyo_default2 = {
     "auth.probe": true,
     // Klaviyo scopes are fixed at app level and re-consented, not drifted.
     "auth.scopes": false,
+    "catalog.audiences": true,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -522,6 +573,11 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 </svg>`;
 
 // lib/connections/mailchimp.js
+var base = (apiKey) => {
+  const dc = String(apiKey || "").split("-").pop();
+  if (!dc || dc === apiKey) throw new Error("That Mailchimp key carries no data centre suffix, so there is no host to call");
+  return "https://" + dc + ".api.mailchimp.com/3.0";
+};
 var mailchimp_default2 = {
   // Keys TODAY. Mailchimp integrations authenticate with OAuth 2 (authorization
   // code) and that is where this goes, so the endpoints are recorded here
@@ -559,8 +615,53 @@ var mailchimp_default2 = {
       placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022-us1",
       redact: true,
       required: true
+    },
+    {
+      input: "select",
+      key: "audience",
+      label: "Mailchimp audience",
+      message: "Contacts your campaigns collect are synced into this audience.",
+      required: true,
+      source: "catalog.audiences"
     }
   ],
+  // The audiences a merchant can sync into, for the picker on their connection.
+  //
+  // count DEFAULTS TO 10 and maxes at 1000 (their own OpenAPI spec), so leaving
+  // it unset returns the first ten audiences and looks entirely successful —
+  // the same silent truncation Klaviyo has, at a different number. Paged
+  // against total_items so an account past a thousand still resolves.
+  hooks: {
+    "catalog.audiences": async ({ fetcher = fetch, settings }) => {
+      const key = settings == null ? void 0 : settings.apiKey;
+      const headers = {
+        // Basic with any username — Mailchimp reads only the password half.
+        authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64")
+      };
+      const audiences = [];
+      let offset = 0;
+      let total = null;
+      while (total === null || offset < total && offset < 5e3) {
+        const response = await fetcher(
+          base(key) + "/lists?count=1000&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          { headers, signal: AbortSignal.timeout(15e3) }
+        );
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp refused the request (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        for (const list of (body == null ? void 0 : body.lists) || []) {
+          audiences.push({ label: (list == null ? void 0 : list.name) || list.id, value: list.id });
+        }
+        total = (body == null ? void 0 : body.total_items) ?? audiences.length;
+        offset = offset + 1e3;
+      }
+      return audiences;
+    }
+  },
   icon: mailchimp_default,
   // A key with no audience chosen is authenticated and inert. Mailchimp also
   // needs its merge fields created on that audience before any Drawbridge total
@@ -581,6 +682,7 @@ var mailchimp_default2 = {
     "auth.disconnect": true,
     "auth.probe": false,
     "auth.scopes": false,
+    "catalog.audiences": true,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -755,6 +857,7 @@ var shopify_default2 = {
     // Shopify has no separate price resource — a price belongs to a product
     // variant and arrives with it, so there is nothing for prices to answer
     // that products does not already.
+    "catalog.audiences": false,
     "catalog.prices": false,
     "catalog.products": true,
     "catalog.promotions": true,
@@ -920,6 +1023,7 @@ var webhook_default = {
     "auth.disconnect": true,
     "auth.probe": false,
     "auth.scopes": false,
+    "catalog.audiences": false,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -971,7 +1075,7 @@ var webhook_default = {
 // lib/connections/index.js
 var QUEUES = ["connection", "notification", "segment", "webhook"];
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -986,8 +1090,16 @@ var build = (manifest) => {
     if (field.input && !INPUTS.includes(field.input)) {
       throw new Error(manifest.slug + "." + field.key + " declares an unknown input: " + field.input + " \u2014 one of " + INPUTS.join(", "));
     }
-    if (field.input === "select" && !(field.options || []).length) {
-      throw new Error(manifest.slug + "." + field.key + " is a select and must declare options");
+    if (field.input === "select" && !(field.options || []).length && !field.source) {
+      throw new Error(manifest.slug + "." + field.key + " is a select and must declare options or a source");
+    }
+    if (field.source) {
+      if (!HOOK_NAMES.includes(field.source)) {
+        throw new Error(manifest.slug + "." + field.key + " sources options from an unknown hook: " + field.source);
+      }
+      if (((_a = manifest.supports) == null ? void 0 : _a[field.source]) !== true) {
+        throw new Error(manifest.slug + "." + field.key + " sources options from " + field.source + ", which it declares unsupported");
+      }
     }
   }
   if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
@@ -1002,15 +1114,15 @@ var build = (manifest) => {
   if (!CATEGORIES.includes(manifest == null ? void 0 : manifest.category)) {
     throw new Error(manifest.slug + " needs a category \u2014 one of " + CATEGORIES.join(", "));
   }
-  if ((_a = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _a.type) {
+  if ((_b = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _b.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_b = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _b.type)) {
+  if (!AUTH_TYPES.includes((_c = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _c.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
     for (const field of OAUTH_FIELDS) {
-      if (!((_c = manifest.auth.oauth) == null ? void 0 : _c[field])) {
+      if (!((_d = manifest.auth.oauth) == null ? void 0 : _d[field])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field);
       }
     }
@@ -1020,10 +1132,10 @@ var build = (manifest) => {
       );
     }
   }
-  if (((_d = manifest.supports) == null ? void 0 : _d["inbound.event"]) && !((_f = (_e = manifest.inbound) == null ? void 0 : _e.headers) == null ? void 0 : _f.event)) {
+  if (((_e = manifest.supports) == null ? void 0 : _e["inbound.event"]) && !((_g = (_f = manifest.inbound) == null ? void 0 : _f.headers) == null ? void 0 : _g.event)) {
     throw new Error(manifest.slug + " supports inbound.event but declares no inbound.headers.event");
   }
-  if (((_g = manifest.supports) == null ? void 0 : _g["inbound.verify"]) && !((_i = (_h = manifest.inbound) == null ? void 0 : _h.headers) == null ? void 0 : _i.signature)) {
+  if (((_h = manifest.supports) == null ? void 0 : _h["inbound.verify"]) && !((_j = (_i = manifest.inbound) == null ? void 0 : _i.headers) == null ? void 0 : _j.signature)) {
     throw new Error(manifest.slug + " supports inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.incomplete) !== "function") {
@@ -1039,7 +1151,7 @@ var build = (manifest) => {
     if (typeof hook !== "function") {
       throw new Error(manifest.slug + " declares hook " + name + " but it is not a function");
     }
-    if (((_j = manifest.supports) == null ? void 0 : _j[name]) !== true) {
+    if (((_k = manifest.supports) == null ? void 0 : _k[name]) !== true) {
       throw new Error(manifest.slug + " implements " + name + " but declares supports[ '" + name + "' ] false");
     }
   }

package/dist/connections/index.d.cts

@@ -98,6 +98,12 @@ const HOOKS = Object.freeze({
 	// not for what Shopify calls it: Shopify says discounts, Stripe says coupons
 	// and promotion codes, BigCommerce says coupons and promotions.
 	catalog : Object.freeze([
+		// The named groups a contact can be synced INTO. Klaviyo calls them lists,
+		// Mailchimp calls them audiences; `audiences` is the industry-generic term
+		// and belongs to neither vendor's API. Read at form time, so a merchant
+		// picks from what actually exists in their account rather than pasting an
+		// id from another tab.
+		'audiences',
 		'products',
 		// Shopify folds price into the product variant; Stripe makes Price a
 		// first-class object beside Product. Declared so a vendor that separates
@@ -361,7 +367,17 @@ var klaviyo = {
 	// Google product wants it.
 	auth : {
 		oauth : {
-			authorize : 'https://a.klaviyo.com/oauth/authorize',
+			// TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+			//
+			// authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+			// a.klaviyo.com -- their API host -- sends the merchant somewhere that
+			// never renders a consent screen, so the journey stalls with no error
+			// anybody can see.
+			//
+			// token is a server call and must stay on a.klaviyo.com: Klaviyo began
+			// blocking OAuth token traffic through www on 2025-03-31, so the mirror
+			// image of this mistake breaks the exchange instead of the consent.
+			authorize : 'https://www.klaviyo.com/oauth/authorize',
 			// NAMES the env vars holding OUR application's client. One identity,
 			// every merchant — the token is the merchant's and arrives from their
 			// own consent, which is what stops one organization reading another's
@@ -411,6 +427,17 @@ var klaviyo = {
 		{
 			key : 'account',
 			label : 'Klaviyo account'
+		},
+		{
+			input : 'select',
+			key : 'list',
+			label : 'Klaviyo list',
+			message : 'Contacts your campaigns collect are synced into this list.',
+			required : true,
+			// The choices come from the merchant's own account, not from here — see
+			// catalog.audiences below. Static options would mean asking somebody to
+			// paste a list id copied out of another browser tab.
+			source : 'catalog.audiences'
 		}
 	],
 	// The three auth hooks, all pure HTTP against Klaviyo — which is why they
@@ -439,6 +466,43 @@ var klaviyo = {
 		//
 		// Basic auth with our client, exactly like the token exchange — the token
 		// being revoked is the subject, not the credential.
+		// The lists a merchant can sync into, for the picker on their connection.
+		//
+		// PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to it,
+		// so a single call quietly returns the first ten lists and an account with
+		// more would show a picker missing the one they wanted — with nothing to
+		// indicate anything was cut. Follows links.next, bounded so a runaway
+		// cursor cannot spin forever.
+		'catalog.audiences' : async ({ fetcher, token }) => {
+
+			const audiences = [];
+
+			let path = '/lists?page%5Bsize%5D=10';
+			let pages = 0;
+
+			while( path && pages < 20 ){
+
+				const body = await api( path, { fetcher, token });
+
+				for( const list of ( body?.data || [] ) ){
+
+					audiences.push({ label : list?.attributes?.name || list.id, value : list.id });
+
+				}
+
+				const next = body?.links?.next;
+
+				// Klaviyo returns an absolute url; the shared caller prefixes its own
+				// base, so only the part after /api travels on.
+				path = next ? String( next ).replace( /^https:\/\/a\.klaviyo\.com\/api/, '' ) : null;
+
+				pages = pages + 1;
+
+			}
+
+			return audiences;
+
+		},
 		'auth.disconnect' : async ({ clientId, clientSecret, fetcher = fetch, settings }) => {
 
 			const token = settings?.refreshToken || settings?.accessToken;
@@ -523,6 +587,7 @@ var klaviyo = {
 		'auth.probe' : true,
 		// Klaviyo scopes are fixed at app level and re-consented, not drifted.
 		'auth.scopes' : false,
+		'catalog.audiences' : true,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -559,6 +624,20 @@ var icon$2 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 <path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
 </svg>`;
 
+// EVERY ACCOUNT LIVES BEHIND A DATA-CENTRE PREFIX, and the key carries it as a
+// suffix — `...-us19` means us19.api.mailchimp.com. There is no fixed host to
+// call, which is Mailchimp's oldest quirk and the reason its future OAuth flow
+// needs a metadata call the other vendors do not.
+const base = ( apiKey ) => {
+
+	const dc = String( apiKey || '' ).split( '-' ).pop();
+
+	if( ! dc || dc === apiKey ) throw new Error( 'That Mailchimp key carries no data centre suffix, so there is no host to call' );
+
+	return 'https://' + dc + '.api.mailchimp.com/3.0';
+
+};
+
 // Mailchimp — contact sync, not a sender.
 //
 // Deliberately no `group`. Mailchimp and SendGrid shared one while they were
@@ -602,8 +681,70 @@ var mailchimp = {
 			placeholder : '••••••••••••••••••••••••••••••••-us1',
 			redact : true,
 			required : true
+		},
+		{
+			input : 'select',
+			key : 'audience',
+			label : 'Mailchimp audience',
+			message : 'Contacts your campaigns collect are synced into this audience.',
+			required : true,
+			source : 'catalog.audiences'
 		}
 	],
+	// The audiences a merchant can sync into, for the picker on their connection.
+	//
+	// count DEFAULTS TO 10 and maxes at 1000 (their own OpenAPI spec), so leaving
+	// it unset returns the first ten audiences and looks entirely successful —
+	// the same silent truncation Klaviyo has, at a different number. Paged
+	// against total_items so an account past a thousand still resolves.
+	hooks : {
+		'catalog.audiences' : async ({ fetcher = fetch, settings }) => {
+
+			const key = settings?.apiKey;
+
+			const headers = {
+				// Basic with any username — Mailchimp reads only the password half.
+				authorization : 'Basic ' + Buffer.from( 'drawbridge:' + key ).toString( 'base64' )
+			};
+
+			const audiences = [];
+
+			let offset = 0;
+			let total = null;
+
+			while( total === null || ( offset < total && offset < 5000 ) ){
+
+				const response = await fetcher(
+					base( key ) + '/lists?count=1000&offset=' + offset + '&fields=lists.id,lists.name,total_items',
+					{ headers, signal : AbortSignal.timeout( 15000 ) }
+				);
+
+				if( ! response.ok ){
+
+					throw Object.assign(
+						new Error( 'Mailchimp refused the request (' + response.status + ')' ),
+						{ status : response.status }
+					);
+
+				}
+
+				const body = await response.json();
+
+				for( const list of ( body?.lists || [] ) ){
+
+					audiences.push({ label : list?.name || list.id, value : list.id });
+
+				}
+
+				total = body?.total_items ?? audiences.length;
+				offset = offset + 1000;
+
+			}
+
+			return audiences;
+
+		}
+	},
 	icon: icon$2,
 	// A key with no audience chosen is authenticated and inert. Mailchimp also
 	// needs its merge fields created on that audience before any Drawbridge total
@@ -624,6 +765,7 @@ var mailchimp = {
 		'auth.disconnect' : true,
 		'auth.probe' : false,
 		'auth.scopes' : false,
+		'catalog.audiences' : true,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -865,6 +1007,7 @@ var shopify = {
 		// Shopify has no separate price resource — a price belongs to a product
 		// variant and arrives with it, so there is nothing for prices to answer
 		// that products does not already.
+		'catalog.audiences' : false,
 		'catalog.prices' : false,
 		'catalog.products' : true,
 		'catalog.promotions' : true,
@@ -1037,6 +1180,7 @@ var webhook = {
 		'auth.disconnect' : true,
 		'auth.probe' : false,
 		'auth.scopes' : false,
+		'catalog.audiences' : false,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -1151,9 +1295,33 @@ const build = ( manifest ) => {
 
 		// A choice with nothing to choose from renders an empty dropdown, which
 		// looks like a loading state that never resolves.
-		if( field.input === 'select' && ! ( field.options || [] ).length ){
+		//
+		// `source` is the other way to have options: the vendor supplies them, per
+		// merchant, at form time. A Klaviyo list cannot be a static list here —
+		// it exists in their account, not in this package — and the alternative is
+		// asking a merchant to paste an id from another browser tab.
+		if( field.input === 'select' && ! ( field.options || [] ).length && ! field.source ){
+
+			throw new Error( manifest.slug + '.' + field.key + ' is a select and must declare options or a source' );
+
+		}
 
-			throw new Error( manifest.slug + '.' + field.key + ' is a select and must declare options' );
+		// A source names a hook, and the manifest must actually support it —
+		// otherwise the form asks for choices from something that will answer
+		// `unsupported`, and the merchant sees a dropdown that never fills.
+		if( field.source ){
+
+			if( ! HOOK_NAMES.includes( field.source ) ){
+
+				throw new Error( manifest.slug + '.' + field.key + ' sources options from an unknown hook: ' + field.source );
+
+			}
+
+			if( manifest.supports?.[ field.source ] !== true ){
+
+				throw new Error( manifest.slug + '.' + field.key + ' sources options from ' + field.source + ', which it declares unsupported' );
+
+			}
 
 		}
 

package/dist/connections/index.d.ts

@@ -98,6 +98,12 @@ const HOOKS = Object.freeze({
 	// not for what Shopify calls it: Shopify says discounts, Stripe says coupons
 	// and promotion codes, BigCommerce says coupons and promotions.
 	catalog : Object.freeze([
+		// The named groups a contact can be synced INTO. Klaviyo calls them lists,
+		// Mailchimp calls them audiences; `audiences` is the industry-generic term
+		// and belongs to neither vendor's API. Read at form time, so a merchant
+		// picks from what actually exists in their account rather than pasting an
+		// id from another tab.
+		'audiences',
 		'products',
 		// Shopify folds price into the product variant; Stripe makes Price a
 		// first-class object beside Product. Declared so a vendor that separates
@@ -361,7 +367,17 @@ var klaviyo = {
 	// Google product wants it.
 	auth : {
 		oauth : {
-			authorize : 'https://a.klaviyo.com/oauth/authorize',
+			// TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+			//
+			// authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+			// a.klaviyo.com -- their API host -- sends the merchant somewhere that
+			// never renders a consent screen, so the journey stalls with no error
+			// anybody can see.
+			//
+			// token is a server call and must stay on a.klaviyo.com: Klaviyo began
+			// blocking OAuth token traffic through www on 2025-03-31, so the mirror
+			// image of this mistake breaks the exchange instead of the consent.
+			authorize : 'https://www.klaviyo.com/oauth/authorize',
 			// NAMES the env vars holding OUR application's client. One identity,
 			// every merchant — the token is the merchant's and arrives from their
 			// own consent, which is what stops one organization reading another's
@@ -411,6 +427,17 @@ var klaviyo = {
 		{
 			key : 'account',
 			label : 'Klaviyo account'
+		},
+		{
+			input : 'select',
+			key : 'list',
+			label : 'Klaviyo list',
+			message : 'Contacts your campaigns collect are synced into this list.',
+			required : true,
+			// The choices come from the merchant's own account, not from here — see
+			// catalog.audiences below. Static options would mean asking somebody to
+			// paste a list id copied out of another browser tab.
+			source : 'catalog.audiences'
 		}
 	],
 	// The three auth hooks, all pure HTTP against Klaviyo — which is why they
@@ -439,6 +466,43 @@ var klaviyo = {
 		//
 		// Basic auth with our client, exactly like the token exchange — the token
 		// being revoked is the subject, not the credential.
+		// The lists a merchant can sync into, for the picker on their connection.
+		//
+		// PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to it,
+		// so a single call quietly returns the first ten lists and an account with
+		// more would show a picker missing the one they wanted — with nothing to
+		// indicate anything was cut. Follows links.next, bounded so a runaway
+		// cursor cannot spin forever.
+		'catalog.audiences' : async ({ fetcher, token }) => {
+
+			const audiences = [];
+
+			let path = '/lists?page%5Bsize%5D=10';
+			let pages = 0;
+
+			while( path && pages < 20 ){
+
+				const body = await api( path, { fetcher, token });
+
+				for( const list of ( body?.data || [] ) ){
+
+					audiences.push({ label : list?.attributes?.name || list.id, value : list.id });
+
+				}
+
+				const next = body?.links?.next;
+
+				// Klaviyo returns an absolute url; the shared caller prefixes its own
+				// base, so only the part after /api travels on.
+				path = next ? String( next ).replace( /^https:\/\/a\.klaviyo\.com\/api/, '' ) : null;
+
+				pages = pages + 1;
+
+			}
+
+			return audiences;
+
+		},
 		'auth.disconnect' : async ({ clientId, clientSecret, fetcher = fetch, settings }) => {
 
 			const token = settings?.refreshToken || settings?.accessToken;
@@ -523,6 +587,7 @@ var klaviyo = {
 		'auth.probe' : true,
 		// Klaviyo scopes are fixed at app level and re-consented, not drifted.
 		'auth.scopes' : false,
+		'catalog.audiences' : true,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -559,6 +624,20 @@ var icon$2 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 <path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
 </svg>`;
 
+// EVERY ACCOUNT LIVES BEHIND A DATA-CENTRE PREFIX, and the key carries it as a
+// suffix — `...-us19` means us19.api.mailchimp.com. There is no fixed host to
+// call, which is Mailchimp's oldest quirk and the reason its future OAuth flow
+// needs a metadata call the other vendors do not.
+const base = ( apiKey ) => {
+
+	const dc = String( apiKey || '' ).split( '-' ).pop();
+
+	if( ! dc || dc === apiKey ) throw new Error( 'That Mailchimp key carries no data centre suffix, so there is no host to call' );
+
+	return 'https://' + dc + '.api.mailchimp.com/3.0';
+
+};
+
 // Mailchimp — contact sync, not a sender.
 //
 // Deliberately no `group`. Mailchimp and SendGrid shared one while they were
@@ -602,8 +681,70 @@ var mailchimp = {
 			placeholder : '••••••••••••••••••••••••••••••••-us1',
 			redact : true,
 			required : true
+		},
+		{
+			input : 'select',
+			key : 'audience',
+			label : 'Mailchimp audience',
+			message : 'Contacts your campaigns collect are synced into this audience.',
+			required : true,
+			source : 'catalog.audiences'
 		}
 	],
+	// The audiences a merchant can sync into, for the picker on their connection.
+	//
+	// count DEFAULTS TO 10 and maxes at 1000 (their own OpenAPI spec), so leaving
+	// it unset returns the first ten audiences and looks entirely successful —
+	// the same silent truncation Klaviyo has, at a different number. Paged
+	// against total_items so an account past a thousand still resolves.
+	hooks : {
+		'catalog.audiences' : async ({ fetcher = fetch, settings }) => {
+
+			const key = settings?.apiKey;
+
+			const headers = {
+				// Basic with any username — Mailchimp reads only the password half.
+				authorization : 'Basic ' + Buffer.from( 'drawbridge:' + key ).toString( 'base64' )
+			};
+
+			const audiences = [];
+
+			let offset = 0;
+			let total = null;
+
+			while( total === null || ( offset < total && offset < 5000 ) ){
+
+				const response = await fetcher(
+					base( key ) + '/lists?count=1000&offset=' + offset + '&fields=lists.id,lists.name,total_items',
+					{ headers, signal : AbortSignal.timeout( 15000 ) }
+				);
+
+				if( ! response.ok ){
+
+					throw Object.assign(
+						new Error( 'Mailchimp refused the request (' + response.status + ')' ),
+						{ status : response.status }
+					);
+
+				}
+
+				const body = await response.json();
+
+				for( const list of ( body?.lists || [] ) ){
+
+					audiences.push({ label : list?.name || list.id, value : list.id });
+
+				}
+
+				total = body?.total_items ?? audiences.length;
+				offset = offset + 1000;
+
+			}
+
+			return audiences;
+
+		}
+	},
 	icon: icon$2,
 	// A key with no audience chosen is authenticated and inert. Mailchimp also
 	// needs its merge fields created on that audience before any Drawbridge total
@@ -624,6 +765,7 @@ var mailchimp = {
 		'auth.disconnect' : true,
 		'auth.probe' : false,
 		'auth.scopes' : false,
+		'catalog.audiences' : true,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -865,6 +1007,7 @@ var shopify = {
 		// Shopify has no separate price resource — a price belongs to a product
 		// variant and arrives with it, so there is nothing for prices to answer
 		// that products does not already.
+		'catalog.audiences' : false,
 		'catalog.prices' : false,
 		'catalog.products' : true,
 		'catalog.promotions' : true,
@@ -1037,6 +1180,7 @@ var webhook = {
 		'auth.disconnect' : true,
 		'auth.probe' : false,
 		'auth.scopes' : false,
+		'catalog.audiences' : false,
 		'catalog.prices' : false,
 		'catalog.products' : false,
 		'catalog.promotions' : false,
@@ -1151,9 +1295,33 @@ const build = ( manifest ) => {
 
 		// A choice with nothing to choose from renders an empty dropdown, which
 		// looks like a loading state that never resolves.
-		if( field.input === 'select' && ! ( field.options || [] ).length ){
+		//
+		// `source` is the other way to have options: the vendor supplies them, per
+		// merchant, at form time. A Klaviyo list cannot be a static list here —
+		// it exists in their account, not in this package — and the alternative is
+		// asking a merchant to paste an id from another browser tab.
+		if( field.input === 'select' && ! ( field.options || [] ).length && ! field.source ){
+
+			throw new Error( manifest.slug + '.' + field.key + ' is a select and must declare options or a source' );
+
+		}
 
-			throw new Error( manifest.slug + '.' + field.key + ' is a select and must declare options' );
+		// A source names a hook, and the manifest must actually support it —
+		// otherwise the form asks for choices from something that will answer
+		// `unsupported`, and the merchant sees a dropdown that never fills.
+		if( field.source ){
+
+			if( ! HOOK_NAMES.includes( field.source ) ){
+
+				throw new Error( manifest.slug + '.' + field.key + ' sources options from an unknown hook: ' + field.source );
+
+			}
+
+			if( manifest.supports?.[ field.source ] !== true ){
+
+				throw new Error( manifest.slug + '.' + field.key + ' sources options from ' + field.source + ', which it declares unsupported' );
+
+			}
 
 		}
 

package/dist/connections/index.js

@@ -74,6 +74,12 @@ var HOOKS = Object.freeze({
   // not for what Shopify calls it: Shopify says discounts, Stripe says coupons
   // and promotion codes, BigCommerce says coupons and promotions.
   catalog: Object.freeze([
+    // The named groups a contact can be synced INTO. Klaviyo calls them lists,
+    // Mailchimp calls them audiences; `audiences` is the industry-generic term
+    // and belongs to neither vendor's API. Read at form time, so a merchant
+    // picks from what actually exists in their account rather than pasting an
+    // id from another tab.
+    "audiences",
     "products",
     // Shopify folds price into the product variant; Stripe makes Price a
     // first-class object beside Product. Declared so a vendor that separates
@@ -289,7 +295,17 @@ var klaviyo_default2 = {
   // Google product wants it.
   auth: {
     oauth: {
-      authorize: "https://a.klaviyo.com/oauth/authorize",
+      // TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
+      //
+      // authorize is a page a HUMAN loads, and it lives on www. Pointing it at
+      // a.klaviyo.com -- their API host -- sends the merchant somewhere that
+      // never renders a consent screen, so the journey stalls with no error
+      // anybody can see.
+      //
+      // token is a server call and must stay on a.klaviyo.com: Klaviyo began
+      // blocking OAuth token traffic through www on 2025-03-31, so the mirror
+      // image of this mistake breaks the exchange instead of the consent.
+      authorize: "https://www.klaviyo.com/oauth/authorize",
       // NAMES the env vars holding OUR application's client. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's
@@ -339,6 +355,17 @@ var klaviyo_default2 = {
     {
       key: "account",
       label: "Klaviyo account"
+    },
+    {
+      input: "select",
+      key: "list",
+      label: "Klaviyo list",
+      message: "Contacts your campaigns collect are synced into this list.",
+      required: true,
+      // The choices come from the merchant's own account, not from here — see
+      // catalog.audiences below. Static options would mean asking somebody to
+      // paste a list id copied out of another browser tab.
+      source: "catalog.audiences"
     }
   ],
   // The three auth hooks, all pure HTTP against Klaviyo — which is why they
@@ -364,6 +391,29 @@ var klaviyo_default2 = {
     //
     // Basic auth with our client, exactly like the token exchange — the token
     // being revoked is the subject, not the credential.
+    // The lists a merchant can sync into, for the picker on their connection.
+    //
+    // PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to it,
+    // so a single call quietly returns the first ten lists and an account with
+    // more would show a picker missing the one they wanted — with nothing to
+    // indicate anything was cut. Follows links.next, bounded so a runaway
+    // cursor cannot spin forever.
+    "catalog.audiences": async ({ fetcher, token }) => {
+      var _a, _b;
+      const audiences = [];
+      let path = "/lists?page%5Bsize%5D=10";
+      let pages = 0;
+      while (path && pages < 20) {
+        const body = await api(path, { fetcher, token });
+        for (const list of (body == null ? void 0 : body.data) || []) {
+          audiences.push({ label: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id, value: list.id });
+        }
+        const next = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
+        path = next ? String(next).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
+        pages = pages + 1;
+      }
+      return audiences;
+    },
     "auth.disconnect": async ({ clientId, clientSecret, fetcher = fetch, settings }) => {
       const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
       if (!token) return { revoked: false };
@@ -437,6 +487,7 @@ var klaviyo_default2 = {
     "auth.probe": true,
     // Klaviyo scopes are fixed at app level and re-consented, not drifted.
     "auth.scopes": false,
+    "catalog.audiences": true,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -469,6 +520,11 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 </svg>`;
 
 // lib/connections/mailchimp.js
+var base = (apiKey) => {
+  const dc = String(apiKey || "").split("-").pop();
+  if (!dc || dc === apiKey) throw new Error("That Mailchimp key carries no data centre suffix, so there is no host to call");
+  return "https://" + dc + ".api.mailchimp.com/3.0";
+};
 var mailchimp_default2 = {
   // Keys TODAY. Mailchimp integrations authenticate with OAuth 2 (authorization
   // code) and that is where this goes, so the endpoints are recorded here
@@ -506,8 +562,53 @@ var mailchimp_default2 = {
       placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022-us1",
       redact: true,
       required: true
+    },
+    {
+      input: "select",
+      key: "audience",
+      label: "Mailchimp audience",
+      message: "Contacts your campaigns collect are synced into this audience.",
+      required: true,
+      source: "catalog.audiences"
     }
   ],
+  // The audiences a merchant can sync into, for the picker on their connection.
+  //
+  // count DEFAULTS TO 10 and maxes at 1000 (their own OpenAPI spec), so leaving
+  // it unset returns the first ten audiences and looks entirely successful —
+  // the same silent truncation Klaviyo has, at a different number. Paged
+  // against total_items so an account past a thousand still resolves.
+  hooks: {
+    "catalog.audiences": async ({ fetcher = fetch, settings }) => {
+      const key = settings == null ? void 0 : settings.apiKey;
+      const headers = {
+        // Basic with any username — Mailchimp reads only the password half.
+        authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64")
+      };
+      const audiences = [];
+      let offset = 0;
+      let total = null;
+      while (total === null || offset < total && offset < 5e3) {
+        const response = await fetcher(
+          base(key) + "/lists?count=1000&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          { headers, signal: AbortSignal.timeout(15e3) }
+        );
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp refused the request (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        for (const list of (body == null ? void 0 : body.lists) || []) {
+          audiences.push({ label: (list == null ? void 0 : list.name) || list.id, value: list.id });
+        }
+        total = (body == null ? void 0 : body.total_items) ?? audiences.length;
+        offset = offset + 1e3;
+      }
+      return audiences;
+    }
+  },
   icon: mailchimp_default,
   // A key with no audience chosen is authenticated and inert. Mailchimp also
   // needs its merge fields created on that audience before any Drawbridge total
@@ -528,6 +629,7 @@ var mailchimp_default2 = {
     "auth.disconnect": true,
     "auth.probe": false,
     "auth.scopes": false,
+    "catalog.audiences": true,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -702,6 +804,7 @@ var shopify_default2 = {
     // Shopify has no separate price resource — a price belongs to a product
     // variant and arrives with it, so there is nothing for prices to answer
     // that products does not already.
+    "catalog.audiences": false,
     "catalog.prices": false,
     "catalog.products": true,
     "catalog.promotions": true,
@@ -867,6 +970,7 @@ var webhook_default = {
     "auth.disconnect": true,
     "auth.probe": false,
     "auth.scopes": false,
+    "catalog.audiences": false,
     "catalog.prices": false,
     "catalog.products": false,
     "catalog.promotions": false,
@@ -918,7 +1022,7 @@ var webhook_default = {
 // lib/connections/index.js
 var QUEUES = ["connection", "notification", "segment", "webhook"];
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -933,8 +1037,16 @@ var build = (manifest) => {
     if (field.input && !INPUTS.includes(field.input)) {
       throw new Error(manifest.slug + "." + field.key + " declares an unknown input: " + field.input + " \u2014 one of " + INPUTS.join(", "));
     }
-    if (field.input === "select" && !(field.options || []).length) {
-      throw new Error(manifest.slug + "." + field.key + " is a select and must declare options");
+    if (field.input === "select" && !(field.options || []).length && !field.source) {
+      throw new Error(manifest.slug + "." + field.key + " is a select and must declare options or a source");
+    }
+    if (field.source) {
+      if (!HOOK_NAMES.includes(field.source)) {
+        throw new Error(manifest.slug + "." + field.key + " sources options from an unknown hook: " + field.source);
+      }
+      if (((_a = manifest.supports) == null ? void 0 : _a[field.source]) !== true) {
+        throw new Error(manifest.slug + "." + field.key + " sources options from " + field.source + ", which it declares unsupported");
+      }
     }
   }
   if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
@@ -949,15 +1061,15 @@ var build = (manifest) => {
   if (!CATEGORIES.includes(manifest == null ? void 0 : manifest.category)) {
     throw new Error(manifest.slug + " needs a category \u2014 one of " + CATEGORIES.join(", "));
   }
-  if ((_a = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _a.type) {
+  if ((_b = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _b.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_b = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _b.type)) {
+  if (!AUTH_TYPES.includes((_c = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _c.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
     for (const field of OAUTH_FIELDS) {
-      if (!((_c = manifest.auth.oauth) == null ? void 0 : _c[field])) {
+      if (!((_d = manifest.auth.oauth) == null ? void 0 : _d[field])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field);
       }
     }
@@ -967,10 +1079,10 @@ var build = (manifest) => {
       );
     }
   }
-  if (((_d = manifest.supports) == null ? void 0 : _d["inbound.event"]) && !((_f = (_e = manifest.inbound) == null ? void 0 : _e.headers) == null ? void 0 : _f.event)) {
+  if (((_e = manifest.supports) == null ? void 0 : _e["inbound.event"]) && !((_g = (_f = manifest.inbound) == null ? void 0 : _f.headers) == null ? void 0 : _g.event)) {
     throw new Error(manifest.slug + " supports inbound.event but declares no inbound.headers.event");
   }
-  if (((_g = manifest.supports) == null ? void 0 : _g["inbound.verify"]) && !((_i = (_h = manifest.inbound) == null ? void 0 : _h.headers) == null ? void 0 : _i.signature)) {
+  if (((_h = manifest.supports) == null ? void 0 : _h["inbound.verify"]) && !((_j = (_i = manifest.inbound) == null ? void 0 : _i.headers) == null ? void 0 : _j.signature)) {
     throw new Error(manifest.slug + " supports inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.incomplete) !== "function") {
@@ -986,7 +1098,7 @@ var build = (manifest) => {
     if (typeof hook !== "function") {
       throw new Error(manifest.slug + " declares hook " + name + " but it is not a function");
     }
-    if (((_j = manifest.supports) == null ? void 0 : _j[name]) !== true) {
+    if (((_k = manifest.supports) == null ? void 0 : _k[name]) !== true) {
       throw new Error(manifest.slug + " implements " + name + " but declares supports[ '" + name + "' ] false");
     }
   }

package/package.json

@@ -200,5 +200,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.109"
+  "version": "0.0.111"
 }