@drawbridge/drawbridge-utils 0.0.112 → 0.0.114

package/dist/connections/index.js

@@ -13,10 +13,25 @@ var HOOKS = Object.freeze({
     // the credential can be valid and the grant still be too narrow.
     "scopes",
     // Revoke at the vendor and drop what we hold.
-    "disconnect"
+    "disconnect",
+    // MINT A TOKEN — from a consent code, or from a stored refresh token. Both
+    // are the same POST, so they are one hook.
+    //
+    // The default body is authToken() in oauth.js and most vendors point
+    // straight at it. It is a hook rather than a declared flag because the
+    // vendors that differ, differ in ways config cannot express: Klaviyo needs
+    // HTTP Basic where others want body fields, and Mailchimp cannot use the
+    // token it receives until a second call tells it which data centre the
+    // account is behind.
+    "token"
   ]),
   // What happens around connecting and disconnecting, beyond the credential.
   lifecycle: Object.freeze([
+    // KEEP ACCESS WORKING. Rotate a credential before its window closes, prove
+    // it still works, and reconcile whatever the vendor has changed underneath
+    // — scopes, webhooks. Distinct from auth.probe, which only answers "is this
+    // still good": this one FIXES what it can and reports what it cannot.
+    "health",
     // Post-connect setup: register the vendor's webhooks, create the system
     // workflows that describe them.
     "register",
@@ -70,9 +85,63 @@ var HOOKS = Object.freeze({
     // carry them. The declaration is what proves the implementation exists.
     "process"
   ]),
-  // Vendor data a campaign draws on. Named for what every store platform has,
-  // not for what Shopify calls it: Shopify says discounts, Stripe says coupons
-  // and promotion codes, BigCommerce says coupons and promotions.
+  // WHAT A WORKFLOW STEP DOES, as a verb like any other. Step handlers used to
+  // live in drawbridge-sync keyed by step type, which meant a vendor's logic sat
+  // in a repo the vendor file could not see — the split this whole exercise
+  // exists to close.
+  //
+  // A `steps` entry points at one of these; the step says when it runs and what
+  // it costs, the hook does the work.
+  contacts: Object.freeze([
+    // Forget a contact at the vendor. Distinct from suppression, which keeps the
+    // record and marks it unsubscribed: this is deletion, for account closure.
+    "remove",
+    // Push one contact into the audience the merchant chose, honouring
+    // suppression rather than omitting an opted-out person — omission lets them
+    // quietly reappear on the next sync.
+    "sync"
+  ]),
+  commerce: Object.freeze([
+    // Mint a discount code against this merchant's store, mapped to one lead.
+    "code",
+    // Create the buyer at the vendor, so an order can be attributed to them.
+    "customer",
+    // An order arrived at the vendor: attribute it, record it, update totals.
+    "order",
+    // Pull product data across on a vendor update.
+    "product"
+  ]),
+  // WHAT DRAWBRIDGE ITSELF DOES. These are not a third party's verbs — nobody
+  // connects an account to send email through Drawbridge — but they are steps a
+  // workflow runs, and a step points at a hook. So they live on a PRIVATE
+  // connection: one that contributes steps and never appears in the catalog.
+  //
+  // Without it the base steps stay the exception the shell has to know about,
+  // and "every step is a declaration pointing at a hook" stops being true the
+  // moment somebody looks at the six most common ones.
+  email: Object.freeze([
+    // To a lead. Suppression applies, and the send is billed.
+    "send",
+    // To organization members. Never suppressed — an entrant's opt-out must not
+    // silence an alert to staff — and never billed.
+    "notify",
+    // A batched summary to members.
+    "digest"
+  ]),
+  sms: Object.freeze(["send"]),
+  segment: Object.freeze(["sync"]),
+  // OUTBOUND DELIVERY to an address the merchant owns, rather than to a vendor.
+  // The Webhooks connection is the only thing here with no third party behind
+  // it, and the destination is per STEP rather than per connection.
+  webhook: Object.freeze(["send"]),
+  // Vendor data we READ — the things a merchant picks from. Named `resources`
+  // rather than `catalog` because it also holds audiences, and a catalog is a
+  // commerce word for something that is not only commerce. It matches the
+  // pickers that render it, too: InputResource and ListResource.
+  //
+  // The verbs are named for what every vendor has, not for what one calls it:
+  // Shopify says discounts, Stripe says coupons and promotion codes,
+  // BigCommerce says coupons and promotions.
   //
   // ONE SHAPE FOR ALL OF THEM — searchable and cursor-paged:
   //
@@ -92,7 +161,7 @@ var HOOKS = Object.freeze({
   // Shopify pushes the term into its GraphQL query, Klaviyo has a filter
   // parameter, and Mailchimp's /lists has no name filter at all so its hook
   // matches against what it fetched. The caller never learns which.
-  catalog: Object.freeze([
+  resources: Object.freeze([
     // The named groups a contact can be synced INTO. Klaviyo calls them lists,
     // Mailchimp calls them audiences; `audiences` is the industry-generic term
     // and belongs to neither vendor's API. Read at form time, so a merchant
@@ -107,6 +176,37 @@ var HOOKS = Object.freeze({
     "promotions"
   ])
 });
+var STEPS = Object.freeze({
+  "commerce.code.issue": "Issue discount code",
+  "commerce.customer.insert": "Create customer",
+  "commerce.order.record": "Record order",
+  "commerce.product.sync": "Sync product",
+  // Not commerce at all — connection lifecycle, and they generalise to any
+  // vendor holding a rotating credential.
+  "connection.health.check": "Connection health check",
+  "connection.token.exchange": "Exchange token",
+  "connection.token.refresh": "Refresh token",
+  "contacts.sync": "Sync contact",
+  "email.digest": "Digest",
+  "email.notify": "Notification",
+  "email.send": "Send email",
+  "segment.sync": "Sync segment",
+  "sms.send": "Send SMS",
+  "webhook.send": "Send webhook"
+});
+var RETIRED = Object.freeze({
+  "step.shopify.customer.insert": "step.commerce.customer.insert",
+  "step.shopify.discount.update": "step.commerce.code.issue",
+  "step.shopify.health.check": "step.connection.health.check",
+  "step.shopify.order.record": "step.commerce.order.record",
+  "step.shopify.product.sync": "step.commerce.product.sync",
+  "step.shopify.token.exchange": "step.connection.token.exchange",
+  "step.shopify.token.refresh": "step.connection.token.refresh"
+});
+var STEP_TYPES = Object.freeze(Object.keys(STEPS).map((name) => "step." + name));
+var STEP_LABELS = Object.freeze(Object.fromEntries(
+  Object.entries(STEPS).map(([name, label]) => ["step." + name, label])
+));
 var HOOK_NAMES = Object.freeze(
   Object.entries(HOOKS).flatMap(([domain, verbs]) => verbs.map((verb) => domain + "." + verb))
 );
@@ -120,9 +220,11 @@ var OUTCOMES = Object.freeze({
   unimplemented: "unimplemented",
   unsupported: "unsupported"
 });
-var AUTH_TYPES = Object.freeze(["generated", "install", "keys", "oauth"]);
-var CATEGORIES = Object.freeze(["commerce", "contacts", "developer", "messaging"]);
-var OAUTH_FIELDS = Object.freeze(["authorize", "client", "redirect", "token"]);
+var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var AUTH_TYPES = Object.freeze(["generated", "install", "keys", "none", "oauth"]);
+var GROUPS = Object.freeze(["commerce", "contacts", "developer", "messaging"]);
+var OAUTH_FIELDS = Object.freeze(["client"]);
+var OAUTH_URLS = Object.freeze(["authorize", "redirect", "token"]);
 var INPUTS = Object.freeze([
   "checkbox",
   "email",
@@ -136,12 +238,12 @@ var INPUTS = Object.freeze([
 
 // lib/connections/oauth.js
 import { createHash, randomBytes } from "crypto";
-var credentials = ({ clientId, clientSecret, descriptor }) => (descriptor == null ? void 0 : descriptor.clientAuth) === "basic" ? {
-  headers: { authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64") },
-  body: {}
+var credentials = ({ basic, clientId, clientSecret }) => basic ? {
+  body: {},
+  headers: { authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64") }
 } : {
-  headers: {},
-  body: { client_id: clientId, client_secret: clientSecret }
+  body: { client_id: clientId, client_secret: clientSecret },
+  headers: {}
 };
 var pkcePair = () => {
   const verifier = randomBytes(32).toString("base64url");
@@ -152,10 +254,11 @@ var pkcePair = () => {
   };
 };
 var consentUrl = ({ challenge, clientId, descriptor, redirect, state } = {}) => {
+  var _a;
   if (!clientId) throw new Error("This deployment has no OAuth client configured, so there is nothing to consent through");
-  if (!(descriptor == null ? void 0 : descriptor.authorize)) throw new Error("This connection declares no authorize url");
+  if (!((_a = descriptor == null ? void 0 : descriptor.urls) == null ? void 0 : _a.authorize)) throw new Error("This connection declares no authorize url");
   if (descriptor.pkce && !challenge) throw new Error("This connection requires PKCE, so a code challenge is not optional");
-  return descriptor.authorize + "?" + new URLSearchParams({
+  return descriptor.urls.authorize + "?" + new URLSearchParams({
     // The descriptor's own params go FIRST, so a vendor quirk cannot quietly
     // overwrite one of the fields below that every consent carries.
     ...descriptor.params || {},
@@ -170,17 +273,33 @@ var consentUrl = ({ challenge, clientId, descriptor, redirect, state } = {}) =>
     state
   });
 };
-var exchange = async ({ clientId, clientSecret, code, descriptor, fetcher = fetch, redirect, verifier } = {}) => {
-  if (!(descriptor == null ? void 0 : descriptor.token)) throw new Error("This connection declares no token url");
-  if (descriptor.pkce && !verifier) throw new Error("This connection requires PKCE, so the code verifier is not optional");
-  const client = credentials({ clientId, clientSecret, descriptor });
-  const response = await fetcher(descriptor.token, {
+var authToken = async ({
+  basic,
+  clientId,
+  clientSecret,
+  code: code2,
+  descriptor,
+  fetcher = fetch,
+  redirect,
+  refreshToken,
+  verifier
+} = {}) => {
+  var _a;
+  if (!clientId || !clientSecret) throw new Error("This deployment has no OAuth client configured, so no token can be minted");
+  if (!((_a = descriptor == null ? void 0 : descriptor.urls) == null ? void 0 : _a.token)) throw new Error("This connection declares no token url");
+  const renewing = !code2;
+  if (renewing && !refreshToken) throw new Error("Nothing has been consented to yet, so there is no refresh token to spend");
+  if (!renewing && descriptor.pkce && !verifier) throw new Error("This connection requires PKCE, so the code verifier is not optional");
+  const client = credentials({ basic, clientId, clientSecret });
+  const response = await fetcher(descriptor.urls.token, {
     body: new URLSearchParams({
       ...client.body,
-      code: decodeURIComponent(String(code || "").trim()),
-      grant_type: "authorization_code",
-      redirect_uri: redirect,
-      ...descriptor.pkce && { code_verifier: verifier }
+      ...renewing ? { grant_type: "refresh_token", refresh_token: refreshToken } : {
+        code: decodeURIComponent(String(code2 || "").trim()),
+        grant_type: "authorization_code",
+        redirect_uri: redirect,
+        ...descriptor.pkce && { code_verifier: verifier }
+      }
     }),
     headers: { "content-type": "application/x-www-form-urlencoded", ...client.headers },
     method: "POST",
@@ -188,42 +307,26 @@ var exchange = async ({ clientId, clientSecret, code, descriptor, fetcher = fetc
   });
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
-    throw new Error("The vendor refused the exchange (" + response.status + ")" + ((body == null ? void 0 : body.error) ? ": " + body.error : ""));
+    throw new Error(
+      renewing ? "The vendor refused the refresh token (" + response.status + ") \u2014 reconnect the connection" : "The vendor refused the exchange (" + response.status + ")" + ((body == null ? void 0 : body.error) ? ": " + body.error : "")
+    );
   }
-  if (!body.access_token) throw new Error("The vendor returned no access token");
+  if (!renewing && !body.access_token) throw new Error("The vendor returned no access token");
   return {
     accessToken: body.access_token,
     expiresIn: body.expires_in || null,
+    // A REFRESH TOKEN IS NOT UNIVERSAL. Google returns one only with
+    // access_type=offline; Mailchimp's tokens do not expire and it returns none
+    // at all, so its absence cannot be an error here.
+    //
+    // On a RENEWAL the same null matters for the opposite reason: a vendor that
+    // rotates returns a new one, and dropping it silently invalidates the stored
+    // grant on the NEXT refresh — a failure a day late and nowhere near its
+    // cause. tokenSettings() keeps the existing one when this is null.
     refreshToken: body.refresh_token || null,
     scope: body.scope || null
   };
 };
-var refresh = async ({ clientId, clientSecret, descriptor, fetcher = fetch, refreshToken } = {}) => {
-  if (!clientId || !clientSecret) throw new Error("This deployment has no OAuth client configured, so no token can be minted");
-  if (!refreshToken) throw new Error("Nothing has been consented to yet, so there is no refresh token to spend");
-  if (!(descriptor == null ? void 0 : descriptor.token)) throw new Error("This connection declares no token url");
-  const client = credentials({ clientId, clientSecret, descriptor });
-  const response = await fetcher(descriptor.token, {
-    body: new URLSearchParams({
-      ...client.body,
-      grant_type: "refresh_token",
-      refresh_token: refreshToken
-    }),
-    headers: { "content-type": "application/x-www-form-urlencoded", ...client.headers },
-    method: "POST",
-    signal: AbortSignal.timeout(15e3)
-  });
-  if (!response.ok) throw new Error("The vendor refused the refresh token (" + response.status + ") \u2014 reconnect the connection");
-  const body = await response.json();
-  return {
-    accessToken: body.access_token,
-    expiresIn: body.expires_in || null,
-    // A vendor that rotates its refresh token returns a new one, and dropping
-    // it silently invalidates the stored grant on the NEXT refresh rather
-    // than this one — a failure a day late and nowhere near its cause.
-    refreshToken: body.refresh_token || null
-  };
-};
 
 // lib/connections/token.js
 var SKEW_SECONDS = 120;
@@ -263,7 +366,7 @@ var accessToken = async ({
   if (!settings.refreshToken) {
     throw new Error("This connection has expired and cannot be renewed automatically. Reconnect it.");
   }
-  const minted = await refresh({
+  const minted = await manifest.hooks.auth.token({
     clientId,
     clientSecret,
     descriptor: manifest.auth.oauth,
@@ -275,6 +378,1019 @@ var accessToken = async ({
   return next.accessToken;
 };
 
+// lib/connections/icons/drawbridge.js
+var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#BAEC5F"/>
+<g clip-path="url(#clip0_2115_2832)">
+<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
+<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
+</g>
+<defs>
+<clipPath id="clip0_2115_2832">
+<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
+</clipPath>
+</defs>
+</svg>`;
+
+// lib/features.js
+var page = {
+  qrcode: {
+    key: "page:qrcode",
+    error: "Plan does not include qrcodes",
+    feature: "Page qrcode management"
+  },
+  shortcode: {
+    key: "page:shortcode",
+    error: "Plan does not include shortcodes",
+    feature: "Page shortcode management"
+  },
+  slug: {
+    key: "page:slug",
+    error: "Plan does not include url customization",
+    feature: "Page slug customization"
+  }
+};
+var fields = {
+  additional: {
+    key: "campaign:fields:additional",
+    error: "Plan does not include additional fields",
+    feature: "Campaign additional fields"
+  },
+  lead: {
+    key: "campaign:fields:lead",
+    error: "Plan does not include lead fields",
+    feature: "Campaign lead fields"
+  }
+};
+var field = {
+  email: {
+    key: "campaign:field:email",
+    error: "Plan does not include email field",
+    feature: "Campaign email field"
+  },
+  name: {
+    key: "campaign:field:name",
+    error: "Plan does not include name field",
+    feature: "Campaign name field"
+  },
+  number: {
+    key: "campaign:field:number",
+    error: "Plan does not include number field",
+    feature: "Campaign number field"
+  },
+  phone: {
+    key: "campaign:field:phone",
+    error: "Plan does not include phone field",
+    feature: "Campaign phone field"
+  },
+  select: {
+    key: "campaign:field:select",
+    error: "Plan does not include dropdown field",
+    feature: "Campaign dropdown field"
+  },
+  text: {
+    key: "campaign:field:text",
+    error: "Plan does not include short text field",
+    feature: "Campaign short text field"
+  },
+  textarea: {
+    key: "campaign:field:textarea",
+    error: "Plan does not include long text field",
+    feature: "Campaign long text field"
+  }
+};
+var connection = {
+  mailchimp: {
+    key: "organization:connection:mailchimp",
+    error: "Plan does not include Mailchimp connection",
+    feature: "Mailchimp connection"
+  },
+  sendgrid: {
+    key: "organization:connection:sendgrid",
+    error: "Plan does not include SendGrid connection",
+    feature: "SendGrid connection"
+  },
+  shopify: {
+    key: "organization:connection:shopify",
+    error: "Plan does not include Shopify connection",
+    feature: "Shopify connection"
+  },
+  twilio: {
+    key: "organization:connection:twilio",
+    error: "Plan does not include Twilio connection",
+    feature: "Twilio connection"
+  },
+  webhook: {
+    key: "organization:connection:webhook",
+    error: "Plan does not include Webhook connection",
+    feature: "Webhook connection"
+  }
+};
+var organization = {
+  advertisements: {
+    key: "organization:advertisements",
+    error: "Your plan does not include advertisements",
+    feature: "Organization advertisement management"
+  },
+  affiliates: {
+    key: "organization:affiliates",
+    error: "Your plan does not include affiliates",
+    feature: "Organization affiliates management"
+  },
+  analytics: {
+    key: "organization:analytics",
+    error: "Your plan does not include analytics",
+    feature: "Organization analytics management"
+  },
+  brands: {
+    key: "organization:brands",
+    error: "Your plan does not include brands",
+    feature: "Organization brands management"
+  },
+  // Gates the Networking section as a whole — a verified sending domain today,
+  // the SMS number and a custom page domain as they land. One key rather than
+  // one per type: they are the same capability to a merchant, and splitting
+  // them would mean a plan could grant half a section.
+  //
+  // It replaces `connection.sender`, which named a connection this stopped
+  // being. Free organizations cannot send lead-facing email at all, so a
+  // sending identity there is one they could never send from.
+  networking: {
+    key: "organization:networking",
+    error: "Your plan does not include a custom sending identity",
+    feature: "Organization networking"
+  },
+  members: {
+    key: "organization:members",
+    error: "Your plan does not include team members",
+    feature: "Organization members management"
+  },
+  reports: {
+    key: "organization:report",
+    error: "Plan does not include report generation",
+    feature: "Organization report generation"
+  },
+  subdomain: {
+    key: "organization:subdomain",
+    error: "Plan does not include subdomain customization",
+    feature: "Organization subdomain customization"
+  }
+};
+
+// index.js
+import { code, data } from "currency-codes";
+import { customAlphabet } from "nanoid";
+
+// lib/color.js
+import tinycolor from "tinycolor2";
+var colorFormatted = (value) => {
+  const color = tinycolor(value);
+  const attributes = {
+    brightness: color.getBrightness(),
+    dark: color.isDark(),
+    light: color.isLight(),
+    luminance: color.getLuminance()
+  };
+  return {
+    attributes,
+    hex: color.toHexString(),
+    hsl: color.toHsl(),
+    hsv: color.toHsv(),
+    rgb: color.toRgbString()
+  };
+};
+var colorAccessible = (background2) => {
+  const white = "#ffffff";
+  const black = "#000000";
+  return tinycolor.isReadable(
+    background2,
+    white,
+    {
+      level: "AA",
+      size: "normal"
+    }
+  ) ? white : black;
+};
+
+// lib/constants.js
+var font = {
+  family: "Roboto Flex",
+  transform: "none",
+  weight: "regular"
+};
+var background = "#ffffff";
+var style = {
+  background: {
+    color: colorFormatted(background)
+  },
+  body: font,
+  button: {
+    background: {
+      color: colorFormatted(background)
+    },
+    radius: 0,
+    text: {
+      color: colorFormatted(colorAccessible(background))
+    }
+  },
+  heading: font,
+  input: {
+    radius: 0
+  },
+  text: {
+    color: colorFormatted(colorAccessible(background))
+  }
+};
+
+// index.js
+var nanoid = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var infinite = 1e300;
+var megabyte = 1024 * 1024;
+var gigabyte = megabyte * 1024;
+var currencies = data.map((item) => ({
+  ...item,
+  key: item.currency,
+  value: item.code
+}));
+
+// lib/plans.js
+var featuresFor = (array = []) => Object.values({
+  ...connection,
+  ...organization,
+  ...fields,
+  ...field,
+  ...page
+}).reduce(
+  (accumulator, { key, error, feature }) => {
+    if (array.includes(key)) {
+      accumulator.granted[key] = feature;
+    } else {
+      accumulator.denied[key] = error;
+    }
+    return accumulator;
+  },
+  { denied: {}, granted: {} }
+);
+var overage = (actionCents) => ({
+  actionCents,
+  overages: { actions: String(actionCents) }
+});
+var all = {
+  features: (array = []) => featuresFor([
+    connection.mailchimp.key,
+    connection.sendgrid.key,
+    connection.shopify.key,
+    connection.twilio.key,
+    connection.webhook.key,
+    organization.affiliates.key,
+    organization.brands.key,
+    fields.additional.key,
+    fields.lead.key,
+    field.email.key,
+    field.name.key,
+    field.number.key,
+    field.phone.key,
+    field.select.key,
+    field.text.key,
+    field.textarea.key,
+    page.qrcode.key,
+    page.shortcode.key,
+    ...array
+  ]),
+  // `members` and `storage` default to infinite so an unnamed term on a custom
+  // plan reads as UNLIMITED rather than absent. Storage used to have no
+  // default, so a deal that did not name it resolved to undefined and the
+  // organization's usage card simply omitted the row — the same blank field
+  // that showed "Unlimited" for members showed nothing at all for storage.
+  // Every catalog plan names both, so the defaults only ever apply to a
+  // custom plan. `actions` has no default on purpose: an unnamed allowance
+  // bills nothing, which is why the availability switch refuses to flip
+  // without one.
+  limits: ({ actions, members = infinite, storage = infinite }) => ({
+    campaign: {
+      advertisements: infinite,
+      links: infinite,
+      fields: infinite,
+      pages: infinite
+    },
+    organization: {
+      actions,
+      affiliates: infinite,
+      brands: infinite,
+      campaigns: infinite,
+      members,
+      storage
+    }
+  })
+};
+var free = {
+  conversion: 3,
+  features: all.features(),
+  limits: all.limits({
+    actions: 200,
+    members: 0,
+    storage: gigabyte * 5
+  }),
+  title: "Free"
+};
+var plans = {
+  DB00002: {
+    // A verified sending domain is a PAID capability: free plans cannot send
+    // lead-facing email at all (the send path gates on an active
+    // subscription), so granting it there would offer a domain that can
+    // never send from.
+    features: all.features([organization.networking.key, organization.members.key]),
+    limits: all.limits({ actions: 5e3, members: 3, storage: gigabyte * 10 }),
+    marketing: {
+      description: "Tools to fine-tune campaigns and improve lead quality.",
+      features: [],
+      limits: [
+        ["Actions per month", "5,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "3"],
+        ["Storage", "10GB"]
+      ]
+    },
+    ...overage(2.5),
+    title: "Starter",
+    conversion: 2
+  },
+  DB00003: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 15e3, members: 5, storage: gigabyte * 20 }),
+    marketing: {
+      description: "Expand your reach and grow your lead pipeline.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "15,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "5"],
+        ["Storage", "20GB"]
+      ]
+    },
+    ...overage(2),
+    title: "Pro",
+    conversion: 1.5
+  },
+  DB00004: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 4e4, members: 10, storage: gigabyte * 50 }),
+    marketing: {
+      description: "Accelerate acquisition with more power and flexibility.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "40,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "10"],
+        ["Storage", "50GB"]
+      ]
+    },
+    ...overage(1.85),
+    title: "Premium",
+    conversion: 1
+  },
+  DB00005: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 1e5, members: infinite, storage: gigabyte * 100 }),
+    marketing: {
+      description: "Built for brands focused on results.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "100,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "Unlimited"],
+        ["Storage", "100GB"]
+      ]
+    },
+    ...overage(1.5),
+    title: "Elite",
+    conversion: 0.5
+  }
+};
+
+// lib/transactions.js
+import { currentTraceId } from "@drawbridge/drawbridge-telemetry";
+
+// lib/billing.js
+import { createLogger } from "@drawbridge/drawbridge-telemetry";
+var logger = createLogger();
+var MARKUP = 1.3;
+var cost = {
+  // gemini-3.5-flash — verified against Google's pricing page 2026-07-09:
+  // $0.15 cached / $1.50 input / $9.00 output per 1M tokens (thinking billed at
+  // output). ~3.6x the retired 2.5-flash output rate.
+  "gemini-3.5-flash": {
+    cached: 15,
+    input: 150,
+    output: 900
+  },
+  // gemini-3.5-flash-lite — verified against Google's pricing page 2026-08-20:
+  // $0.03 cached / $0.30 input / $2.50 output per 1M tokens (thinking billed at
+  // output). A fifth of flash on input, ~a quarter on output. Growth's assistant
+  // ranks the feed on this tier — one call per page — so its rows were the
+  // unpriced ones until now.
+  "gemini-3.5-flash-lite": {
+    cached: 3,
+    input: 30,
+    output: 250
+  },
+  "gemini-2.5-flash": {
+    cached: 3,
+    input: 30,
+    output: 250
+  },
+  "gemini-2.5-flash-image": {
+    cached: 3,
+    input: 30,
+    output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
+  }
+};
+var toolCost = {
+  search: 3.5
+};
+var toolPricing = Object.fromEntries(
+  Object.entries(toolCost).map(([tool, value]) => [
+    tool,
+    Math.ceil(value * MARKUP)
+  ])
+);
+var pricing = Object.fromEntries(
+  Object.entries(cost).map(([model, rates]) => [
+    model,
+    {
+      cached: Math.round(rates.cached * MARKUP),
+      input: Math.round(rates.input * MARKUP),
+      output: Math.round(rates.output * MARKUP)
+    }
+  ])
+);
+
+// lib/pricing.js
+var emailPlans = {
+  essentials50k: {
+    included: 5e4,
+    // The plan's own price is not shown in the console once you are on it —
+    // it reads "Your Current Plan" where the price would be. Left null rather
+    // than guessed; fill from an invoice. Nothing derives from it yet, and an
+    // invented figure would quietly become the basis of an upgrade decision.
+    monthly: null,
+    overageCents: 0.133,
+    title: "Essentials 50K"
+  },
+  essentials100k: {
+    included: 1e5,
+    monthly: 3495,
+    overageCents: 0.09,
+    title: "Essentials 100K"
+  },
+  pro100k: {
+    included: 1e5,
+    monthly: 8995,
+    overageCents: 0.11,
+    title: "Pro 100K"
+  },
+  pro300k: {
+    included: 3e5,
+    monthly: 24900,
+    overageCents: 0.091,
+    title: "Pro 300K"
+  },
+  pro700k: {
+    included: 7e5,
+    monthly: 49900,
+    overageCents: 0.078,
+    title: "Pro 700K"
+  },
+  pro1500k: {
+    included: 15e5,
+    monthly: 79900,
+    overageCents: 0.059,
+    title: "Pro 1.5 Million"
+  },
+  pro2500k: {
+    included: 25e5,
+    monthly: 109900,
+    overageCents: 0.047,
+    title: "Pro 2.5 Million"
+  }
+};
+var emailPlan = "essentials50k";
+var sending = {
+  email: {
+    // Fraction of the included volume that raises the alarm. Far enough ahead
+    // to act on, high enough not to fire on ordinary growth.
+    //
+    // Crossing it is NOT an outage. The provider bills overage rather than
+    // stopping sends, so the alarm is a COST signal: past the included volume
+    // every email is charged at overageCents, and at some run rate the next
+    // plan up is cheaper than the overage. That is the decision it exists to
+    // prompt, and it is why nobody should be woken by it.
+    alertThreshold: 0.8,
+    // Emails per calendar month included, PLATFORM-WIDE and across every send
+    // path: lead-facing mail, workflow steps, and the sign-in codes and
+    // account mail that no plan allowance meters.
+    monthlyCeiling: emailPlans[emailPlan].included,
+    overageCents: emailPlans[emailPlan].overageCents,
+    plan: emailPlan,
+    plans: emailPlans,
+    title: emailPlans[emailPlan].title
+  }
+};
+var channels = {
+  email: {
+    actionsPerSend: 1,
+    includedInAllowance: true
+  },
+  sms: {
+    // Two actions PER SEGMENT (a long message is several segments), billed from
+    // the FIRST segment and never drawn from the plan's included allowance —
+    // carrier cost is real from message one, so there is no free tier of it.
+    actionsPerSegment: 2,
+    includedInAllowance: false
+  }
+};
+
+// lib/connections/drawbridge.js
+var drawbridge_default2 = {
+  auth: {
+    type: "none"
+  },
+  content: {
+    confirm: "This connection is part of Drawbridge and cannot be disconnected.",
+    description: [
+      "Drawbridge sends your notification email and SMS, keeps your segments in sync, and posts to your own endpoints. These are built in rather than connected, so there is nothing here to set up."
+    ],
+    excerpt: "The steps Drawbridge runs itself.",
+    guide: [
+      "Nothing to do. These steps are available in every workflow builder."
+    ]
+  },
+  exclusive: false,
+  fields: [],
+  group: "developer",
+  // EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
+  // suppression collection and the queues; segment sync needs the streams. A
+  // published package carrying those makes every consumer carry them, which is
+  // the reason `{}` exists as an answer.
+  hooks: {
+    auth: {
+      // Nothing to connect, revoke, probe or re-scope.
+      connect: false,
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      token: false
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    email: {
+      digest: {},
+      // To organization members. NEVER suppressed and never billed: an
+      // entrant's opt-out must not silence an alert to staff, and staff mail is
+      // not a metered send.
+      notify: {},
+      // To a lead. Suppression applies and the send is billed.
+      send: {}
+    },
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      audiences: false,
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    segment: { sync: {} },
+    sms: { send: {} },
+    webhook: false
+  },
+  icon: drawbridge_default,
+  // PRIVATE: never in the catalog, always available to the builder.
+  private: true,
+  requires: [],
+  slug: "drawbridge",
+  // Always on. There is no credential that could go bad and no configuration a
+  // merchant could leave half-finished.
+  status: () => "active",
+  // DERIVED FROM drawbridge-api/lib/workflows.js, not invented. Every value
+  // below — trigger, billable, settings — is what that catalog and the workflow
+  // route already enforce today, because this replaces them rather than
+  // competing with them.
+  //
+  // NOT HERE, deliberately:
+  //
+  //   step.segment.sync  a SYSTEM step, dispatched by drawbridge-sync rather
+  //                      than offered in the builder. It fans out, so the shell
+  //                      opens its step document and the chunks close it.
+  steps: {
+    email: {
+      // SCHEDULE-TRIGGERED, not lead-triggered: it is offered under Daily,
+      // Weekly and Monthly. Those triggers had offered no steps at all, so a
+      // scheduled workflow was selectable and inert until this landed.
+      digest: () => ({
+        hook: "email.digest",
+        key: "Email \u2014 Digest",
+        queue: "notification",
+        settings: {
+          // The organization OWNER is always a recipient, resolved in sync,
+          // so this is additional recipients rather than the list. It cannot
+          // be required: the members endpoint is owner-gated and the owner is
+          // not a member document, so a solo merchant has nothing to pick and
+          // could never save the step.
+          members: { of: "string", type: "array" },
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["schedule.day", "schedule.week", "schedule.month"],
+        usage: { actions: 0 }
+      }),
+      // To organization MEMBERS. Never suppressed — an entrant's opt-out must
+      // not silence an alert to staff — and not billed.
+      notify: () => ({
+        hook: "email.notify",
+        key: "Email \u2014 Notification",
+        queue: "notification",
+        settings: {
+          members: { of: "string", type: "array" },
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["lead.insert"],
+        // Zero is a PRICE, and a deliberate one. Declared rather than omitted
+        // so "this is free" and "nobody decided" stay different statements;
+        // completeStep bills only when actions > 0.
+        usage: { actions: 0 }
+      }),
+      // To a LEAD. Suppression applies and the send is billed.
+      send: () => ({
+        hook: "email.send",
+        key: "Email \u2014 Send email",
+        queue: "notification",
+        settings: {
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["lead.insert"],
+        // ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
+        // customer-facing number; the handler read it too, so the same fact
+        // was stated in two places and only one of them was reviewed.
+        usage: { actions: channels.email.actionsPerSend }
+      })
+    },
+    // WITHDRAWN, which is a third thing from builder and system: declared,
+    // routed and runnable, but never offered.
+    //
+    // It went when the twilio connection did — a connection-gated step with no
+    // connection to gate on could only ever render permanently disabled. Stored
+    // workflows still carry it, so it must keep running, and enums.step.type
+    // keeps it for the same reason.
+    //
+    // NO TRIGGERS is what keeps it out of the builder: the catalog derives from
+    // triggers, so a step with none is unreachable by a merchant without a
+    // second list saying so.
+    //
+    // Platform SMS returns as a base step the way email did. That is this entry
+    // gaining triggers, not a new one.
+    sms: {
+      send: () => ({
+        hook: "sms.send",
+        key: "Send an SMS",
+        queue: "notification",
+        settings: {
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        // Priced per SEGMENT and billed from the first, which the send
+        // resolves from the message length. This is the floor.
+        usage: { actions: channels.sms.actionsPerSegment },
+        withdrawn: true
+      })
+    },
+    segment: {
+      // FANS OUT. It evaluates every contact in the organization against every
+      // segment, which is too much for one job — so the hook returns chunks and
+      // the shell defers completion: openStep writes the document with a slot
+      // per chunk, and whichever chunk lands last closes it and resumes the
+      // chain.
+      //
+      // It carries a hook like every other step. An earlier version declared
+      // none, on the theory that fan-out was a second protocol the shell could
+      // not run; it is the same protocol with the ending deferred, and a step
+      // declaring no hook is silently SKIPPED by the runner.
+      sync: () => ({
+        description: "Recalculates segment membership on a daily schedule.",
+        hook: "segment.sync",
+        key: "Segment Sync",
+        queue: "segment",
+        system: true
+      })
+    }
+  },
+  tasks: () => [],
+  title: "Drawbridge"
+};
+
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/connections/hubspot.js
+var HUBSPOT_BASE = "https://api.hubapi.com";
+var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  return (fetcher || request)({
+    body,
+    headers: {
+      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+    },
+    method,
+    query,
+    url: HUBSPOT_BASE + path
+  });
+};
+var UTM_PROPERTIES = {
+  campaign: "utm_campaign",
+  content: "utm_content",
+  id: "utm_id",
+  medium: "utm_medium",
+  source: "utm_source",
+  term: "utm_term"
+};
+var CLICK_PROPERTIES = {
+  fbclid: "hs_facebook_click_id",
+  gclid: "hs_google_click_id",
+  liFatId: "hs_linkedin_click_id",
+  msclkid: "hs_bing_click_id",
+  ttclid: "hs_tiktok_click_id"
+};
+var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
+var isUtmProperty = (key) => DROPPABLE.has(key);
+var toProperties = ({ email, firstName, lastName, utm }) => {
+  var _a;
+  const properties = {};
+  if (email !== void 0) properties.email = email;
+  if (firstName !== void 0) properties.firstname = firstName;
+  if (lastName !== void 0) properties.lastname = lastName;
+  if (utm) {
+    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
+      if (utm[key]) properties[property] = utm[key];
+    }
+    ;
+    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
+      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
+    }
+    ;
+  }
+  ;
+  return properties;
+};
+var send = async ({ doc, fetcher, method, path, token }) => {
+  const properties = toProperties(doc);
+  try {
+    return await hubspotRequest({
+      body: { properties },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  } catch (error) {
+    const enriched = Object.keys(properties).some(isUtmProperty);
+    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
+    return await hubspotRequest({
+      body: {
+        properties: Object.fromEntries(
+          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
+        )
+      },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  }
+};
+var lookup = async ({ email, fetcher, token }) => {
+  var _a, _b;
+  if (!token || !email) return;
+  try {
+    const body = await hubspotRequest({
+      body: {
+        filterGroups: [
+          {
+            filters: [
+              {
+                operator: "EQ",
+                propertyName: "email",
+                value: email
+              }
+            ]
+          }
+        ],
+        limit: 1,
+        properties: ["email"]
+      },
+      fetcher,
+      method: "POST",
+      path: "/crm/v3/objects/contacts/search",
+      token
+    });
+    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
+  } catch (error) {
+  }
+};
+var hubspot_default = {
+  auth: {
+    // A Private App token from our own portal. Nothing to connect, nothing to
+    // consent to, and no merchant involved.
+    type: "none"
+  },
+  content: {
+    confirm: "This connection is part of Drawbridge and cannot be disconnected.",
+    description: [
+      "Drawbridge keeps its own HubSpot portal in step with account signups, so the campaign a customer arrived on is on their contact record."
+    ],
+    excerpt: "Drawbridge's own CRM sync.",
+    guide: [
+      "Nothing to do. This is internal to Drawbridge."
+    ]
+  },
+  exclusive: false,
+  fields: [],
+  group: "contacts",
+  hooks: {
+    auth: {
+      connect: false,
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      token: false
+    },
+    commerce: false,
+    contacts: {
+      // FORGET A CONTACT, by id or by email. Account deletion — the caller had
+      // to search then remove, which is one round trip it should not have to
+      // know about.
+      remove: async ({ email, fetcher, id, token }) => {
+        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+        if (!key) return;
+        const contact = id || await lookup({ email, fetcher, token: key });
+        if (!contact) return;
+        return hubspotRequest({
+          fetcher,
+          method: "DELETE",
+          path: "/crm/v3/objects/contacts/" + contact,
+          token: key
+        });
+      },
+      // Connect an account to its contact by email, creating it if absent, and
+      // return the contact id. Unlike SendGrid, HubSpot renames a contact's
+      // email in place, so an email change is a plain PATCH on the cached id —
+      // no delete-old-then-create-new.
+      //
+      // Prefer the cached hubspotId; fall back to a search; create last.
+      sync: async ({ doc, fetcher, token }) => {
+        var _a, _b;
+        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+        if (!key) return;
+        if (doc == null ? void 0 : doc.hubspotId) {
+          try {
+            return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+          } catch (error) {
+            if ((error == null ? void 0 : error.status) !== 404) throw error;
+          }
+        }
+        const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+        return (_b = await send({
+          doc,
+          fetcher,
+          method: existing ? "PATCH" : "POST",
+          path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
+          token: key
+        })) == null ? void 0 : _b.id;
+      }
+    },
+    email: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      audiences: false,
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    segment: false,
+    sms: false,
+    webhook: false
+  },
+  icon: drawbridge_default,
+  // Borrowed: the Drawbridge mark, because this is ours and never rendered.
+  private: true,
+  // Absent the token the hooks no-op, so a deployment without a portal simply
+  // contributes nothing rather than failing.
+  requires: ["HUBSPOT_ACCESS_TOKEN"],
+  slug: "hubspot",
+  status: () => "active",
+  // No workflow steps. The hooks are called by the user stream, not the builder.
+  steps: {},
+  tasks: () => [],
+  title: "HubSpot"
+};
+
 // lib/connections/icons/klaviyo.js
 var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="white"/>
@@ -282,16 +1398,22 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 </svg>`;
 
 // lib/connections/klaviyo.js
-var REVISION = "2026-07-15";
-var api = async (path, { fetcher = fetch, token }) => {
+var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
+    ...payload && { body: JSON.stringify(payload) },
     headers: {
       // Bearer, not Klaviyo-API-Key — that header is for private keys, and
       // sending it with an OAuth token fails in a way that reads like a bad
       // token rather than a bad scheme.
       authorization: "Bearer " + token,
-      revision: REVISION
+      ...payload && { "content-type": "application/json" },
+      // Klaviyo pins its API by DATE. A request without this header is
+      // refused, and one with an old date keeps the response shape that date
+      // shipped with — which is the point: bumping it is a deliberate act
+      // with a changelog to read, not something that drifts under us.
+      revision: "2026-07-15"
     },
+    method,
     signal: AbortSignal.timeout(15e3)
   });
   if (!response.ok) {
@@ -300,7 +1422,7 @@ var api = async (path, { fetcher = fetch, token }) => {
       { status: response.status }
     );
   }
-  return response.json();
+  return response.status === 204 ? null : response.json();
 };
 var klaviyo_default2 = {
   // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
@@ -308,234 +1430,417 @@ var klaviyo_default2 = {
   // carried. Most vendors treat it as optional hardening; this one does not,
   // which is why it is a descriptor flag and not a global.
   //
-  // clientAuth is the other thing Klaviyo does differently. The token endpoint
-  // wants HTTP Basic — base64( client_id : client_secret ) in an Authorization
-  // header — and rejects the same pair sent as form fields, which is how every
-  // Google product wants it.
+  // HTTP Basic on the token endpoint is the other thing Klaviyo does
+  // differently, and it says so in hooks.auth.token rather than as a flag here.
   auth: {
     oauth: {
-      // TWO DIFFERENT HOSTS, and swapping them fails in opposite directions.
-      //
-      // authorize is a page a HUMAN loads, and it lives on www. Pointing it at
-      // a.klaviyo.com -- their API host -- sends the merchant somewhere that
-      // never renders a consent screen, so the journey stalls with no error
-      // anybody can see.
-      //
-      // token is a server call and must stay on a.klaviyo.com: Klaviyo began
-      // blocking OAuth token traffic through www on 2025-03-31, so the mirror
-      // image of this mistake breaks the exchange instead of the consent.
-      authorize: "https://www.klaviyo.com/oauth/authorize",
       // NAMES the env vars holding OUR application's client. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's
       // data.
+      //
       client: {
         id: "KLAVIYO_OAUTH_CLIENT_ID",
         secret: "KLAVIYO_OAUTH_CLIENT_SECRET"
       },
-      clientAuth: "basic",
-      pkce: true,
-      // DECLARED, never derived from the slug. It is registered in Klaviyo's
-      // app settings and they refuse anything that does not byte-match, so
-      // it is a fact about someone else's records rather than a string this
-      // code computes. Deriving one from a provider key produced
-      // redirect_uri_mismatch on a connection nobody had touched.
       // Klaviyo drops a refresh token after 90 days of NON-USE. The vendor
       // never mentions this at runtime — you discover it when a refresh fails
       // on a connection nobody touched — so it is declared, and it is why
       // auth.probe has to run on a schedule rather than only before a call.
-      idleExpiry: 90 * 24 * 60 * 60,
-      redirect: "/api/connection/klaviyo/callback",
+      //
+      // Token lifetime is NOT declared: the vendor states it on every
+      // exchange, and a copy here would be a second answer that goes stale.
+      expiry: 90 * 24 * 60 * 60,
+      pkce: true,
       // Space separated. accounts:read is required by Klaviyo on every app
       // and must stay in the list; the rest are what a contact sync needs.
       scopes: "accounts:read lists:read lists:write profiles:read profiles:write",
-      token: "https://a.klaviyo.com/oauth/token"
+      // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
+      // the disconnect hook — three vendor addresses, two of them declared,
+      // which is exactly the kind of split that goes unnoticed.
+      urls: {
+        // TWO DIFFERENT HOSTS, and swapping them fails in opposite ways.
+        //
+        // authorize is a page a HUMAN loads, and it lives on www. Pointing it
+        // at a.klaviyo.com — their API host — sends the merchant somewhere
+        // that never renders a consent screen, so the journey stalls with no
+        // error anybody can see.
+        //
+        // token and revoke are server calls and must stay on a.klaviyo.com:
+        // Klaviyo began blocking OAuth token traffic through www on
+        // 2025-03-31, so the mirror image of this mistake breaks the exchange
+        // instead of the consent.
+        authorize: "https://www.klaviyo.com/oauth/authorize",
+        // WHERE THE MERCHANT LANDS — the dashboard, not drawbridge-api. The
+        // `/api/` segment is Next's route-handler convention, which reads as
+        // the api service to everyone who sees it; it is not, and the route
+        // has never moved. build() pins it against the one callback route
+        // that exists, because declared-but-wrong fails AFTER consent — a
+        // 404 for someone who has already granted access.
+        //
+        // Registered in Klaviyo's own app settings, and they refuse anything
+        // that does not byte-match, so it is a fact about someone else's
+        // records rather than a string this code computes.
+        redirect: "/api/connection/klaviyo/callback",
+        revoke: "https://a.klaviyo.com/oauth/revoke",
+        token: "https://a.klaviyo.com/oauth/token"
+      }
     },
     type: "oauth"
   },
-  category: "contacts",
-  confirm: "Disconnecting revokes Drawbridge's access to your Klaviyo account. Your profiles and lists stay in both Klaviyo and Drawbridge \u2014 neither is deleted.",
-  connect: {
+  // EVERYTHING A MERCHANT READS. Grouped by who it is for rather than by what
+  // kind of sentence it is, so the question on the next vendor is "does a person
+  // read this", which nobody gets wrong, instead of "is this marketing", which
+  // someone will.
+  //
+  // `errors` is in here rather than at the top level, and that is not a
+  // preference. The connection DOCUMENT carries its own `errors` array of
+  // scope-drift entries, and the document is spread OVER the resolved manifest
+  // downstream — so a top-level `errors` here would be silently replaced by that
+  // array and this copy would never render. `fields`/`settings` already carry a
+  // comment about the same collision.
+  content: {
+    // Shown at disconnect, so it says what is lost and what is not.
+    confirm: "Disconnecting revokes Drawbridge's access to your Klaviyo account. Your profiles and lists stay in both Klaviyo and Drawbridge \u2014 neither is deleted.",
+    description: [
+      "Connecting Klaviyo lets Drawbridge sync the contacts your campaigns collect into a Klaviyo list, so the people who enter a giveaway can be marketed to alongside the rest of your audience.",
+      "You authorize Drawbridge from inside Klaviyo and can revoke that access there at any time. Drawbridge never sees or stores your Klaviyo password, and only asks for the permissions listed on the consent screen.",
+      "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing."
+    ],
+    // KEYED BY WHAT FAILED, not nested inside it. Errors are the thing most
+    // likely to grow — resources.* has already earned somewhere to put "we
+    // could not load your lists" — so a new area adds a key here rather than a
+    // second errors object somewhere else.
+    //
+    // `connect` no longer exists as a container above: its only other member
+    // was `redirect`, which moved to auth.oauth.urls with the rest of the
+    // vendor's addresses.
     errors: {
-      denied: "The Klaviyo authorization was declined, so nothing was connected.",
-      invalid: "We couldn't complete the Klaviyo connection. Try connecting again."
-    }
+      connect: {
+        denied: "The Klaviyo authorization was declined, so nothing was connected.",
+        invalid: "We couldn't complete the Klaviyo connection. Try connecting again."
+      }
+    },
+    excerpt: "Sync the contacts your campaigns collect into a Klaviyo list.",
+    // HOW TO CONNECT, in the merchant's words. Was `setup`, which nothing
+    // rendered — four useful instructions no component displayed.
+    guide: [
+      "Press Connect. Drawbridge sends you to Klaviyo to approve access.",
+      "Sign in to Klaviyo if you are not already, and choose the account to connect.",
+      "Approve the permissions Klaviyo lists. You are returned here and the connection shows Active.",
+      "You can revoke access at any time from Klaviyo, under Integrations."
+    ]
   },
-  description: [
-    "Connecting Klaviyo lets Drawbridge sync the contacts your campaigns collect into a Klaviyo list, so the people who enter a giveaway can be marketed to alongside the rest of your audience.",
-    "You authorize Drawbridge from inside Klaviyo and can revoke that access there at any time. Drawbridge never sees or stores your Klaviyo password, and only asks for the permissions listed on the consent screen.",
-    "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing."
-  ],
-  excerpt: "Sync the contacts your campaigns collect into a Klaviyo list.",
+  // CAN A MERCHANT KEEP TWO OF THESE AT ONCE?
+  //
+  // Required, and false is a decision rather than a default. Shopify is
+  // exclusive because a store maps to exactly one organization. Contact syncs
+  // are destinations — someone can reasonably keep Klaviyo and Mailchimp both
+  // current — so the exclusivity that once applied when these were SENDERS is
+  // deliberately gone. That was removed once already; declaring it out loud is
+  // what stops it coming back by inference.
+  exclusive: false,
   feature: "organization:connection:klaviyo",
-  // Nothing typed. The consent returns the grant, and the account it belongs to
-  // is read back from Klaviyo rather than asked for.
   fields: [
     {
       key: "account",
       label: "Klaviyo account"
     },
     {
+      // The choices come from the merchant's own account, so the field names
+      // the capability and the client composes the url.
+      hook: "resources.audiences",
       input: "select",
       key: "list",
       label: "Klaviyo list",
       message: "Contacts your campaigns collect are synced into this list.",
       required: true,
-      // The choices come from the merchant's own account, not from here — see
-      // catalog.audiences below. Static options would mean asking somebody to
-      // paste a list id copied out of another browser tab.
-      source: "catalog.audiences"
+      // Klaviyo's list endpoint carries no name filter, so the hook can only
+      // match what it already fetched. A search box that searches one page is
+      // worse than none, so the picker does not offer one.
+      search: false
     }
   ],
-  // The three auth hooks, all pure HTTP against Klaviyo — which is why they
-  // live here rather than in sync. A vendor's own protocol belongs beside the
-  // vendor.
+  // WHAT KIND OF THING THIS IS. One field, not two — `category` said the same
+  // thing and was read by nothing, while `group` was quietly doing double duty
+  // as the mutual-exclusion key. The exclusion moved to `exclusive` above, so
+  // this is purely how a connection is grouped and labelled.
+  group: "contacts",
+  // Nothing typed at connect. The consent returns the grant, and the account it
+  // belongs to is read back from Klaviyo rather than asked for.
   hooks: {
-    // Turn a fresh grant into settings worth showing. Without this the card
-    // renders an empty "Klaviyo account" field, because the merchant is never
-    // asked which account they connected — the consent already decided it and
-    // asking again would be a question we can answer ourselves.
-    "auth.connect": async ({ fetcher, tokens }) => {
-      var _a, _b, _c;
-      const body = await api("/accounts", { fetcher, token: tokens.accessToken });
-      const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
-      return {
-        account: ((_c = (_b = account == null ? void 0 : account.attributes) == null ? void 0 : _b.contact_information) == null ? void 0 : _c.organization_name) || (account == null ? void 0 : account.id) || null,
-        accountId: (account == null ? void 0 : account.id) || null
-      };
+    auth: {
+      // Turn a fresh grant into settings worth showing. Without this the card
+      // renders an empty "Klaviyo account" field, because the merchant is
+      // never asked which account they connected — the consent already
+      // decided it, and asking again would be a question we can answer.
+      connect: async ({ fetcher, tokens }) => {
+        var _a, _b, _c;
+        const body = await api("/accounts", { fetcher, token: tokens.accessToken });
+        const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
+        return {
+          account: ((_c = (_b = account == null ? void 0 : account.attributes) == null ? void 0 : _b.contact_information) == null ? void 0 : _c.organization_name) || (account == null ? void 0 : account.id) || null,
+          accountId: (account == null ? void 0 : account.id) || null
+        };
+      },
+      // Revoke at KLAVIYO, not just locally. Forgetting our copy leaves the
+      // grant live in the merchant's account, so a disconnect that looks
+      // complete here still shows Drawbridge with access over there.
+      //
+      // Basic auth with our client, exactly like the token exchange — the
+      // token being revoked is the subject, not the credential.
+      disconnect: async ({ clientId, clientSecret, fetcher = fetch, manifest, settings }) => {
+        const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
+        if (!token) return { revoked: false };
+        const response = await fetcher(manifest.auth.oauth.urls.revoke, {
+          body: new URLSearchParams({
+            token,
+            token_type_hint: (settings == null ? void 0 : settings.refreshToken) ? "refresh_token" : "access_token"
+          }),
+          headers: {
+            authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64"),
+            "content-type": "application/x-www-form-urlencoded"
+          },
+          method: "POST",
+          signal: AbortSignal.timeout(15e3)
+        });
+        return { revoked: response.ok };
+      },
+      // THE MINT IS THE PROBE. Asking "is this token still good" by
+      // inspecting what we stored answers the wrong question — a grant
+      // revoked inside Klaviyo still looks perfect in our database. Spending
+      // the refresh token is the only thing that asks Klaviyo.
+      //
+      // It also keeps the grant warm against the 90-day idle window above.
+      probe: async ({ clientId, clientSecret, fetcher, manifest, settings }) => {
+        const token = await accessToken({
+          clientId,
+          clientSecret,
+          fetcher,
+          // Mint even if the stored token still looks good — a probe that
+          // short-circuits never reaches Klaviyo and reports healthy on a
+          // grant revoked an hour ago.
+          force: true,
+          manifest,
+          settings
+        });
+        return { ok: Boolean(token) };
+      },
+      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
+      scopes: false,
+      // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
+      // client_id/client_secret pair as body fields. Everything else about the
+      // request is standard, so this is the shared implementation told the one
+      // thing that differs — in Klaviyo's own file, beside the rest of what
+      // makes Klaviyo unusual, rather than as a flag a caller has to know to
+      // read.
+      token: (args) => authToken({ ...args, basic: true })
     },
-    // Revoke at KLAVIYO, not just locally. Forgetting our copy leaves the
-    // grant live in the merchant's account, so a disconnect that looks
-    // complete here still shows Drawbridge with access over there.
-    //
-    // Basic auth with our client, exactly like the token exchange — the token
-    // being revoked is the subject, not the credential.
-    // The lists a merchant can sync into, for the picker on their connection.
-    //
-    // PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to it,
-    // so a single call quietly returns the first ten lists and an account with
-    // more would show a picker missing the one they wanted — with nothing to
-    // indicate anything was cut. Follows links.next, bounded so a runaway
-    // cursor cannot spin forever.
-    "catalog.audiences": async ({ cursor, fetcher, limit = 100, search, token }) => {
-      var _a, _b;
-      const audiences = [];
-      let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
-      let pages = 0;
-      while (next && audiences.length < limit && pages < 20) {
-        const body = await api(next, { fetcher, token });
-        for (const list of (body == null ? void 0 : body.data) || []) {
-          audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
-        }
-        const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
-        next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
-        pages = pages + 1;
+    // No commerce here. Klaviyo tracks orders, but Drawbridge's order data comes
+    // from the store that took the money — a second source for the same event
+    // is two answers to "did this person buy", and the one we can bill from is
+    // the store's.
+    commerce: false,
+    // The verb the contacts.sync step points at. It does the work — including
+    // writing the profile id back onto the lead — and returns what happened.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from deleting the profile.
+      remove: false,
+      sync: async ({ contact, fetcher, lead, settings, suppressed, token }) => {
+        var _a, _b, _c;
+        const list = settings == null ? void 0 : settings.list;
+        if (!list) return { message: "No Klaviyo list is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        if (!email) return { message: "That lead has no email address to sync.", skipped: true };
+        const totals = (contact == null ? void 0 : contact.totals) || {};
+        const profile = await api("/profiles/", {
+          fetcher,
+          method: "POST",
+          payload: {
+            data: {
+              attributes: {
+                email,
+                ...(lead == null ? void 0 : lead.name) && { first_name: String(lead.name).trim().split(/\s+/)[0] },
+                properties: {
+                  drawbridge_campaigns: ((contact == null ? void 0 : contact.campaigns) || []).length,
+                  drawbridge_draws: totals.draws || 0,
+                  drawbridge_entries: totals.entries || 0,
+                  drawbridge_orders: totals.orders || 0,
+                  // Campaign-attributed, NOT lifetime. A merchant running
+                  // Shopify already has lifetime revenue in Klaviyo through
+                  // Klaviyo's own integration; what only we can say is how
+                  // much a campaign drove. Named so the two cannot be
+                  // mistaken for one another in a segment builder.
+                  drawbridge_revenue: totals.gross || 0
+                }
+              },
+              type: "profile"
+            }
+          },
+          token
+        });
+        const profileId = (_c = profile == null ? void 0 : profile.data) == null ? void 0 : _c.id;
+        if (!profileId) return { message: "Klaviyo returned no profile id.", skipped: true };
+        await api("/profile-subscription-bulk-create-jobs/", {
+          fetcher,
+          method: "POST",
+          payload: {
+            data: {
+              attributes: {
+                profiles: {
+                  data: [{
+                    attributes: {
+                      email,
+                      subscriptions: {
+                        email: { marketing: { consent: suppressed ? "UNSUBSCRIBED" : "SUBSCRIBED" } }
+                      }
+                    },
+                    type: "profile"
+                  }]
+                }
+              },
+              relationships: { list: { data: { id: list, type: "list" } } },
+              type: "profile-subscription-bulk-create-job"
+            }
+          },
+          token
+        });
+        return {
+          // Merged into `context` for later steps in this run.
+          context: { klaviyoProfileId: profileId },
+          message: suppressed ? "Synced to Klaviyo as unsubscribed \u2014 this contact has opted out." : "Synced to the Klaviyo list.",
+          // Recorded on the run for support to read back, not a write
+          // instruction — the hook has already written what it needed to.
+          response: { klaviyoProfileId: profileId }
+        };
       }
-      const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
-      const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
-      return {
-        items,
-        pageInfo: {
-          endCursor: next,
-          hasNextPage: Boolean(next)
-        }
-      };
     },
-    "auth.disconnect": async ({ clientId, clientSecret, fetcher = fetch, settings }) => {
-      const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
-      if (!token) return { revoked: false };
-      const response = await fetcher("https://a.klaviyo.com/oauth/revoke", {
-        body: new URLSearchParams({
-          token,
-          token_type_hint: (settings == null ? void 0 : settings.refreshToken) ? "refresh_token" : "access_token"
-        }),
-        headers: {
-          authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64"),
-          "content-type": "application/x-www-form-urlencoded"
-        },
-        method: "POST",
-        signal: AbortSignal.timeout(15e3)
-      });
-      return { revoked: response.ok };
+    // A WHOLE DOMAIN CAN DECLINE AT ONCE. Klaviyo sends us nothing and we
+    // register nothing with it, so listing four falses would be noise around a
+    // single decision. Still explicit — absence would not say whether anybody
+    // considered it.
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    // Nothing to set up or tear down at the vendor: the grant is the whole
+    // integration, and revoking it is auth.disconnect's job.
+    lifecycle: false,
+    resources: {
+      // The lists a merchant can sync into, for the picker on their
+      // connection.
+      //
+      // PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to
+      // it, so one call quietly returns the first ten lists and an account
+      // with more shows a picker missing the one they wanted, with nothing to
+      // indicate anything was cut.
+      audiences: async ({ cursor, fetcher, limit = 100, search, token }) => {
+        var _a, _b;
+        const audiences = [];
+        let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
+        let pages = 0;
+        while (next && audiences.length < limit && pages < 20) {
+          const body = await api(next, { fetcher, token });
+          for (const list of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          }
+          const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
+          next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
+          pages = pages + 1;
+        }
+        const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
+        return {
+          items: term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences,
+          pageInfo: {
+            endCursor: next,
+            hasNextPage: Boolean(next)
+          }
+        };
+      },
+      // Klaviyo sells no products and mints no discount codes.
+      prices: false,
+      products: false,
+      promotions: false
     },
-    // THE MINT IS THE PROBE. Asking "is this token still good" by inspecting
-    // what we stored answers the wrong question — a grant revoked inside
-    // Klaviyo still looks perfect in our database. Spending the refresh token
-    // is the only thing that asks Klaviyo.
-    //
-    // It also keeps the grant warm: Klaviyo expires a refresh token after 90
-    // days of NON-USE, so a connection nobody touches dies silently without
-    // this running.
-    "auth.probe": async ({ clientId, clientSecret, fetcher, manifest, settings }) => {
-      const token = await accessToken({
-        clientId,
-        clientSecret,
-        fetcher,
-        // Mint even if the stored token still looks good — a probe that
-        // short-circuits never reaches Klaviyo and reports healthy on a
-        // grant revoked an hour ago.
-        force: true,
-        manifest,
-        settings
-      });
-      return { ok: Boolean(token) };
-    }
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
   },
   icon: klaviyo_default,
-  // A grant with no list chosen is authenticated and useless. The list cannot
-  // be part of the consent flow — enumerating lists needs the token the consent
-  // returns — so it is always a second step, and the card must say so rather
-  // than showing Active over nothing.
-  incomplete: (data) => {
-    var _a;
-    return ((_a = data == null ? void 0 : data.settings) == null ? void 0 : _a.list) ? null : "Choose which Klaviyo list your contacts should sync into.";
-  },
-  label: "klaviyo",
   requires: [
     "KLAVIYO_OAUTH_CLIENT_ID",
     "KLAVIYO_OAUTH_CLIENT_SECRET"
   ],
-  setup: [
-    "Press Connect. Drawbridge sends you to Klaviyo to approve access.",
-    "Sign in to Klaviyo if you are not already, and choose the account to connect.",
-    "Approve the permissions Klaviyo lists. You are returned here and the connection shows Active.",
-    "You can revoke access at any time from Klaviyo, under Integrations."
-  ],
   slug: "klaviyo",
-  // No steps yet. The sync itself is unbuilt, and a step offered in the builder
-  // that nothing runs is worse than no step at all — the merchant configures it
-  // and waits for something that never happens.
-  steps: {},
-  supports: {
-    "auth.connect": true,
-    "auth.disconnect": true,
-    // The refresh mint IS the probe: a revoked or rotated grant fails there in
-    // Klaviyo's own words rather than as an empty sync three steps later.
-    "auth.probe": true,
-    // Klaviyo scopes are fixed at app level and re-consented, not drifted.
-    "auth.scopes": false,
-    "catalog.audiences": true,
-    "catalog.prices": false,
-    "catalog.products": false,
-    "catalog.promotions": false,
-    "inbound.event": false,
-    "inbound.process": false,
-    "inbound.receive": false,
-    "inbound.verify": false,
-    "lifecycle.cleanup": false,
-    "lifecycle.register": false,
-    "lifecycle.rehydrate": false
-  },
-  tasks: () => [
-    // Mailchimp carries the same warning, deliberately worded the same way. A
-    // merchant who connects either one and is told nothing reasonably assumes
-    // contacts are flowing, and finds out weeks later that they are not.
-    {
-      message: "Contact syncing to Klaviyo lists has not shipped yet. Connecting stores your authorization so it is ready, but nothing is being sent to Klaviyo right now.",
-      title: "List sync not available yet",
-      type: "warning"
+  // ONE OF THE FOUR STATES AND NOTHING ELSE — the reason sits in `tasks`, which
+  // is already the merchant-facing copy channel and is already rendered.
+  //
+  // A grant with no list chosen is authenticated and useless. The list cannot be
+  // part of the consent flow — enumerating lists needs the token the consent
+  // returns — so it is always a second step, and the card must say Pending
+  // rather than Active over nothing.
+  //
+  // Otherwise the credential's own verdict stands. A manifest can only ever
+  // DOWNGRADE: it can see the settings, and it cannot see whether the grant was
+  // revoked at Klaviyo an hour ago.
+  //
+  // Computed at read time rather than written, for the same reason
+  // shopifyMissingScopes is: it becomes true the moment a merchant clears the
+  // list, without waiting for something to notice and write it down.
+  status: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? data2.status : "pending";
+  },
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. It names the hook that does the work, and
+      // says where that hook's values belong. Nested like the hooks, and the
+      // nesting IS the name: this is `step.contacts.sync`, which is what a
+      // workflow document stores.
+      //
+      // A function, so it can depend on what this deployment or this
+      // merchant's connection knows — a static object would have to be true
+      // for every deployment at publish time.
+      sync: ({ data: data2 }) => {
+        var _a;
+        return {
+          hook: "contacts.sync",
+          // The account the merchant actually connected, read back by
+          // auth.connect. The builder reads "Sync contact to Acme Co" rather
+          // than a label that could be any of their Klaviyo accounts.
+          key: "Sync contact to " + (((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.account) || "Klaviyo"),
+          queue: "connection",
+          // Nothing for a merchant to configure on the step itself — the list
+          // is chosen once on the connection. Declared empty rather than
+          // omitted, so "this step takes no settings" and "nobody thought about
+          // settings" are different statements.
+          settings: {},
+          // BOTH triggers. lead.insert alone only ever fires for someone with
+          // no history yet — a brand-new entrant has no orders and no revenue,
+          // so a profile written then carries an email and nothing else.
+          // Crossing into a segment is the moment the ranking data exists.
+          triggers: ["lead.insert", "segment.contact.add"],
+          // One source for cost: what the builder discloses before a merchant
+          // adds this step, and what is charged when it runs.
+          usage: { actions: 1 }
+        };
+      }
     }
-  ],
+  },
+  // WHY, in the merchant's words, and what to do about it.
+  tasks: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [
+      {
+        message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose a list"
+      }
+    ];
+  },
   title: "Klaviyo"
 };
 
@@ -572,13 +1877,28 @@ var mailchimp_default2 = {
   auth: {
     type: "keys"
   },
-  category: "contacts",
-  confirm: "Disconnecting removes your stored Mailchimp key. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
-  description: [
-    "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
-    "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so a key stored here does nothing today."
-  ],
-  excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
+  // EVERYTHING A MERCHANT READS. `errors` belongs in here rather than at the
+  // top level because the connection DOCUMENT carries its own `errors` array
+  // and the document is spread OVER the resolved manifest downstream — a
+  // top-level one would be replaced by that array and never render.
+  content: {
+    confirm: "Disconnecting removes your stored Mailchimp key. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
+    description: [
+      "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
+      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so a key stored here does nothing today."
+    ],
+    excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
+    guide: [
+      "In Mailchimp, open Account & billing, then Extras, then API keys.",
+      "Create a key and copy it.",
+      "Paste it here. The key ends in a data-centre suffix like -us19, which tells Drawbridge which Mailchimp server your account is on."
+    ]
+  },
+  // Mailchimp and SendGrid shared a group while they were SENDERS, where an org
+  // picking two providers to send the same mail was meaningless. As contact
+  // syncs they are destinations, and a merchant could reasonably keep several
+  // up to date, so the exclusivity is gone.
+  exclusive: false,
   feature: "organization:connection:mailchimp",
   fields: [
     {
@@ -595,99 +1915,120 @@ var mailchimp_default2 = {
       key: "audience",
       label: "Mailchimp audience",
       message: "Contacts your campaigns collect are synced into this audience.",
+      hook: "resources.audiences",
       required: true,
-      source: "catalog.audiences"
+      // Mailchimp's /lists takes no name filter either — same reason.
+      search: false
     }
   ],
-  // The audiences a merchant can sync into, for the picker on their connection.
-  //
-  // count DEFAULTS TO 10 and maxes at 1000 (their own OpenAPI spec), so leaving
-  // it unset returns the first ten audiences and looks entirely successful —
-  // the same silent truncation Klaviyo has, at a different number. Paged
-  // against total_items so an account past a thousand still resolves.
+  group: "contacts",
+  // A HOOK'S VALUE IS ITS ANSWER. A key is stored and can be removed; nothing
+  // else is built yet, because audience sync has not shipped. Every false here
+  // is "not yet" rather than "never" — when the sync lands, probe and
+  // contacts.sync are the first to flip.
   hooks: {
-    "catalog.audiences": async ({ cursor, fetcher = fetch, limit = 100, search, settings }) => {
-      const key = settings == null ? void 0 : settings.apiKey;
-      const count = Math.min(limit, 1e3);
-      const offset = Number(cursor || 0);
-      const response = await fetcher(
-        base(key) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
-        {
-          // Basic with any username — Mailchimp reads only the password half.
-          headers: { authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64") },
-          signal: AbortSignal.timeout(15e3)
-        }
-      );
-      if (!response.ok) {
-        throw Object.assign(
-          new Error("Mailchimp refused the request (" + response.status + ")"),
-          { status: response.status }
+    auth: {
+      // Implemented outside this package: storing a typed key needs no vendor
+      // call, so the api's own form handler does it.
+      connect: {},
+      disconnect: {},
+      probe: false,
+      scopes: false,
+      // Keys today. When Mailchimp's OAuth lands this becomes a wrapper that
+      // follows the exchange with /oauth2/metadata — the data-centre call that
+      // is the whole reason its OAuth cannot be pure configuration.
+      token: false
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      // The audiences a merchant can sync into, for the picker on their
+      // connection.
+      //
+      // count DEFAULTS TO 10 and maxes at 1000 (Mailchimp's own OpenAPI spec),
+      // so leaving it unset returns the first ten audiences and looks entirely
+      // successful — the same silent truncation Klaviyo has, at a different
+      // number. Paged against total_items so an account past a thousand still
+      // resolves.
+      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings }) => {
+        const key = settings == null ? void 0 : settings.apiKey;
+        const count = Math.min(limit, 1e3);
+        const offset = Number(cursor || 0);
+        const response = await fetcher(
+          base(key) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          {
+            // Basic with any username — Mailchimp reads only the password half.
+            headers: { authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64") },
+            signal: AbortSignal.timeout(15e3)
+          }
         );
-      }
-      const body = await response.json();
-      const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
-      const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
-      const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
-      const nextOffset = offset + count;
-      const more = nextOffset < Number((body == null ? void 0 : body.total_items) || 0);
-      return {
-        items,
-        pageInfo: {
-          endCursor: more ? String(nextOffset) : null,
-          hasNextPage: more
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp refused the request (" + response.status + ")"),
+            { status: response.status }
+          );
         }
-      };
-    }
+        const body = await response.json();
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
+        const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
+        const nextOffset = offset + count;
+        const more = nextOffset < Number((body == null ? void 0 : body.total_items) || 0);
+        return {
+          items,
+          pageInfo: {
+            endCursor: more ? String(nextOffset) : null,
+            hasNextPage: more
+          }
+        };
+      },
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
   },
   icon: mailchimp_default,
+  slug: "mailchimp",
   // A key with no audience chosen is authenticated and inert. Mailchimp also
   // needs its merge fields created on that audience before any Drawbridge total
   // can be written to a member — unlike Klaviyo, its custom fields are not
   // schemaless — so the audience must be picked before lifecycle.register has
   // anything to register against.
-  incomplete: (data) => {
+  status: (data2) => {
     var _a;
-    return ((_a = data == null ? void 0 : data.settings) == null ? void 0 : _a.audience) ? null : "Choose which Mailchimp audience your contacts should sync into.";
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? data2.status : "pending";
   },
-  label: "mailchimp",
-  // Uniform surface, honest answers. A key is stored and can be removed; nothing
-  // else is built yet, because audience sync has not shipped. Every false here
-  // is "not yet", not "never" — when the sync lands, probe and catalog become
-  // the first two to flip.
-  supports: {
-    "auth.connect": true,
-    "auth.disconnect": true,
-    "auth.probe": false,
-    "auth.scopes": false,
-    "catalog.audiences": true,
-    "catalog.prices": false,
-    "catalog.products": false,
-    "catalog.promotions": false,
-    "inbound.event": false,
-    "inbound.process": false,
-    "inbound.receive": false,
-    "inbound.verify": false,
-    "lifecycle.cleanup": false,
-    "lifecycle.register": false,
-    "lifecycle.rehydrate": false
-  },
-  setup: [
-    "In Mailchimp, open Account & billing, then Extras, then API keys.",
-    "Create a key and copy it.",
-    "Paste it here. The key ends in a data-centre suffix like -us19, which tells Drawbridge which Mailchimp server your account is on."
-  ],
-  slug: "mailchimp",
   // No steps: audience sync has not shipped, so this vendor contributes nothing
   // to a workflow yet. An empty steps object is the honest declaration — the
   // catalog renders the connection, and no builder offers a step it cannot run.
   steps: {},
-  tasks: () => [
-    {
-      message: "Contact syncing to Mailchimp audiences has not shipped yet, and this connection no longer sends your email. Nothing is being sent to Mailchimp right now.",
-      title: "Audience sync not available yet",
-      type: "warning"
-    }
-  ],
+  tasks: (data2) => {
+    var _a;
+    return [
+      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
+        {
+          message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
+          title: "Choose an audience"
+        }
+      ],
+      {
+        message: "Contact syncing to Mailchimp audiences has not shipped yet, and this connection no longer sends your email. Nothing is being sent to Mailchimp right now.",
+        title: "Audience sync not available yet",
+        type: "warning"
+      }
+    ];
+  },
   title: "Mailchimp"
 };
 
@@ -743,31 +2084,48 @@ var shopify_default2 = {
   auth: {
     type: "install"
   },
-  category: "commerce",
-  confirm: "Disconnecting deactivates all products from this store, drafts any advertisements that use them, disables Shopify steps in your workflows until you reconnect, and stops revenue tracking for this organization.",
-  // How connecting is DESCRIBED — the copy and destination. What kind of connect
-  // it is lives in auth.type, once, so the two cannot disagree.
+  // EVERYTHING A MERCHANT READS.
+  //
+  // `errors` is in here rather than at the top level, and that is not a
+  // preference: the connection DOCUMENT carries its own `errors` array of
+  // scope-drift entries, and the document is spread OVER the resolved manifest
+  // downstream — a top-level one would be replaced by that array and never
+  // render.
   //
-  // The redirect title is copy: it names where the link GOES rather than what it
-  // does, since installing happens on the App Store listing and the dashboard
-  // must never imply a store can be linked from inside it.
-  connect: {
+  // `connect` no longer exists as a container. Its other member was `redirect`,
+  // which is a URL and now sits with the vendor's other addresses.
+  content: {
+    confirm: "Disconnecting deactivates all products from this store, drafts any advertisements that use them, disables Shopify steps in your workflows until you reconnect, and stops revenue tracking for this organization.",
+    description: [
+      "Installing the Drawbridge app from the Shopify App Store links your store to a single Drawbridge organization and makes your product catalog available inside Drawbridge, so you can feature products in your campaigns and advertisements.",
+      "Drawbridge attributes orders that originate from your campaigns \u2014 matched through cart parameters and lead-mapped discount codes \u2014 so you can see the revenue each campaign drives.",
+      "On connect, Drawbridge registers webhooks for product and order updates to keep your catalog and revenue in sync. Disconnecting removes those webhooks and unlinks the resources."
+    ],
     errors: {
-      conflict: "This store is already connected to another Drawbridge organization.",
-      currency: "This store settles in a currency we can't bill yet. Connect a store with a supported settlement currency.",
-      invalid: "We couldn't verify the install. Please try connecting again from the Shopify App Store."
+      connect: {
+        conflict: "This store is already connected to another Drawbridge organization.",
+        currency: "This store settles in a currency we can't bill yet. Connect a store with a supported settlement currency.",
+        invalid: "We couldn't verify the install. Please try connecting again from the Shopify App Store."
+      }
     },
+    excerpt: "Connect your Shopify store to feature products in your campaigns and track conversions.",
+    guide: [
+      "Open the Drawbridge listing on the Shopify App Store.",
+      "Install the app on the store you want to connect. It opens in Shopify admin and stays there.",
+      "Choose a plan when Shopify asks. The connection shows Pending until you do, then Active.",
+      "Come back here \u2014 the connections list updates on its own once the install lands."
+    ],
+    // Names where the link GOES rather than what it does: installing happens on
+    // the App Store listing, and the dashboard must never imply a store can be
+    // linked from inside it.
     redirect: {
       env: "SHOPIFY_APP_LISTING_URL",
       title: "View on the Shopify App Store"
     }
   },
-  description: [
-    "Installing the Drawbridge app from the Shopify App Store links your store to a single Drawbridge organization and makes your product catalog available inside Drawbridge, so you can feature products in your campaigns and advertisements.",
-    "Drawbridge attributes orders that originate from your campaigns \u2014 matched through cart parameters and lead-mapped discount codes \u2014 so you can see the revenue each campaign drives.",
-    "On connect, Drawbridge registers webhooks for product and order updates to keep your catalog and revenue in sync. Disconnecting removes those webhooks and unlinks the catalog."
-  ],
-  excerpt: "Connect your Shopify store to feature products in your campaigns and track conversions.",
+  // ONE STORE PER ORGANIZATION. Two Shopify stores on one org would give every
+  // attributed order two possible sources.
+  exclusive: true,
   feature: "organization:connection:shopify",
   fields: [
     {
@@ -778,12 +2136,9 @@ var shopify_default2 = {
       label: "Store domain"
     }
   ],
-  group: "ecommerce",
-  // The install is the whole configuration — Shopify hands back the shop and
-  // there is nothing further to choose. `shop` absent means the install did not
-  // finish, which is a credential problem rather than a setup one, so the
-  // stored status already says so.
-  incomplete: () => null,
+  // Was `category : 'commerce'` AND `group : 'ecommerce'` — two words for one
+  // fact, which left nobody able to say which one a page read.
+  group: "commerce",
   // verify and event lean entirely on the shared HMAC helper — Shopify's scheme
   // is exactly the shape it covers, so there is nothing vendor-specific to
   // write for either. receive is the one hook that genuinely differs by
@@ -791,25 +2146,91 @@ var shopify_default2 = {
   // /compliance enforces the topic allowlist above, because answering one late
   // is a legal deadline rather than a retry.
   hooks: {
-    "inbound.event": (args) => readEventHeader({ ...args, descriptor: inbound }),
-    "inbound.receive": ({ channel, event, headers, payload }) => {
-      if (channel === "compliance" && !COMPLIANCE_TOPICS.has(event)) {
-        throw Object.assign(new Error("Unrecognized compliance topic: " + event), { status: 401 });
-      }
-      return {
-        // Compliance payloads already carry shop_domain in the body — Shopify's
-        // own GDPR shape. The app-level event stream does not; that domain
-        // lives only in the header, so it is stamped on here rather than left
-        // for drawbridge-sync to reach into headers nobody hands it.
-        data: channel === "compliance" ? payload : { ...payload, shop_domain: headers[inbound.headers.shop] || null },
-        provider: { id: headers[inbound.headers.id] || null }
-      };
+    auth: {
+      // The install completes inside Shopify admin; the api's callback stores
+      // what it hands back. auth.probe is false deliberately: the health check
+      // re-registers rather than answering "is this token still good", and
+      // scope drift is its own hook because a token can be perfectly valid
+      // while the grant is too narrow.
+      connect: {},
+      disconnect: {},
+      probe: false,
+      scopes: {},
+      // Shopify's install grant is exchanged inside its own app flow, not
+      // through the shared OAuth runner.
+      token: false
     },
-    "inbound.verify": (args) => verifySignature({ ...args, descriptor: inbound })
+    // Implemented in drawbridge-sync, which owns the attribution and the
+    // controllers it needs. Declared here so the steps below can point at them:
+    // a step naming a hook the vendor does not implement is a workflow that
+    // accepts the step and then silently does nothing.
+    commerce: {
+      code: {},
+      customer: {},
+      order: {},
+      product: {}
+    },
+    contacts: { remove: false, sync: false },
+    // verify and event lean entirely on the shared HMAC helper — Shopify's
+    // scheme is exactly the shape it covers, so there is nothing vendor-specific
+    // to write for either. receive is the one hook that genuinely differs by
+    // channel: /events buffers whatever arrives with the shop domain stamped on;
+    // /compliance enforces the topic allowlist above, because answering one late
+    // is a legal deadline rather than a retry.
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: {
+      event: (args) => readEventHeader({ ...args, descriptor: inbound }),
+      process: {},
+      receive: ({ channel, event, headers, payload }) => {
+        if (channel === "compliance" && !COMPLIANCE_TOPICS.has(event)) {
+          throw Object.assign(new Error("Unrecognized compliance topic: " + event), { status: 401 });
+        }
+        return {
+          // Compliance payloads already carry shop_domain in the body — Shopify's
+          // own GDPR shape. The app-level event stream does not; that domain
+          // lives only in the header, so it is stamped on here rather than left
+          // for drawbridge-sync to reach into headers nobody hands it.
+          data: channel === "compliance" ? payload : { ...payload, shop_domain: headers[inbound.headers.shop] || null },
+          provider: { id: headers[inbound.headers.id] || null }
+        };
+      },
+      verify: (args) => verifySignature({ ...args, descriptor: inbound })
+    },
+    lifecycle: { cleanup: {}, health: {}, register: {}, rehydrate: {} },
+    resources: {
+      audiences: false,
+      // Shopify has no separate price resource — a price belongs to a product
+      // variant and arrives with it, so there is nothing for prices to answer
+      // that products does not already.
+      prices: false,
+      products: {},
+      promotions: {}
+    },
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
   },
   icon: shopify_default,
   inbound,
-  label: "shopify",
+  // THE DEEP LINK into this store's Drawbridge app inside Shopify admin.
+  //
+  // Here rather than in drawbridge-api, which had `slug === 'shopify' && {...}`
+  // in the shared resolver — a hardcoded vendor branch in code every vendor runs
+  // through, which is the arrangement these manifests exist to remove.
+  //
+  // Undefined until a shop is linked, so the Manage button only appears on a
+  // connected connection. The app handle is NAMED by `requires` and read from
+  // the env the resolver passes, never from process.env here.
+  manage: (data2, env) => {
+    var _a;
+    const shop = (data2 == null ? void 0 : data2.shop) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.domain);
+    return shop ? "https://admin.shopify.com/store/" + String(shop).replace(".myshopify.com", "") + "/apps/" + (env == null ? void 0 : env.SHOPIFY_APP_HANDLE) : void 0;
+  },
   // A pre-launch integration: it only surfaces once the App Store listing
   // exists and the app is fully configured. Requiring all four means it can
   // never render half-configured — and absence of any one excludes the
@@ -820,133 +2241,273 @@ var shopify_default2 = {
     "SHOPIFY_APP_LISTING_URL",
     "SHOPIFY_APP_HANDLE"
   ],
-  // The only vendor implementing most of the surface, which is why it was the
-  // one every slug branch in three repos was written for.
-  //
-  // auth.probe is false deliberately: the health check re-registers webhooks
-  // rather than answering "is this token still good", and scope drift is its own
-  // hook because a token can be perfectly valid while the grant is too narrow.
-  supports: {
-    "auth.connect": true,
-    "auth.disconnect": true,
-    "auth.probe": false,
-    "auth.scopes": true,
-    // Shopify has no separate price resource — a price belongs to a product
-    // variant and arrives with it, so there is nothing for prices to answer
-    // that products does not already.
-    "catalog.audiences": false,
-    "catalog.prices": false,
-    "catalog.products": true,
-    "catalog.promotions": true,
-    "inbound.event": true,
-    "inbound.process": true,
-    "inbound.receive": true,
-    "inbound.verify": true,
-    "lifecycle.cleanup": true,
-    "lifecycle.register": true,
-    "lifecycle.rehydrate": true
-  },
-  setup: [
-    "Open the Drawbridge listing on the Shopify App Store.",
-    "Install the app on the store you want to connect. It opens in Shopify admin and stays there.",
-    "Choose a plan when Shopify asks. The connection shows Pending until you do, then Active.",
-    "Come back here \u2014 the connections list updates on its own once the install lands."
-  ],
   slug: "shopify",
+  // The install is the whole configuration — Shopify hands back the shop and
+  // there is nothing further to choose. `shop` absent means the install did not
+  // finish, which is a credential problem rather than a setup one, so the
+  // stored status already says so.
+  // Nothing to add — no setting can make this connection unusable, so the
+  // credential's own verdict stands.
+  status: (data2) => data2 == null ? void 0 : data2.status,
   // Step types name the CAPABILITY, not this vendor. A second store platform
   // implements the same four commerce steps, and the connection on the step
   // says which store it runs against — so a merchant sees one "Create
   // customer", not one per platform. The three connection.* steps are not
   // commerce at all: any vendor holding a rotating credential needs them.
+  // Step types name the CAPABILITY, not this vendor. A second store platform
+  // implements the same commerce steps, and the connection on the step says
+  // which store it runs against — so a merchant sees one "Create customer", not
+  // one per platform.
+  //
+  // Nested for readability and flattened to the stored name, at whatever depth:
+  // steps.commerce.customer.insert is `step.commerce.customer.insert` on a
+  // workflow document, and those strings cannot be renamed without a backfill.
+  //
+  // EVERY LEAF IS A FUNCTION so a step can read the merchant's own connection.
+  // The bodies these point at still live in drawbridge-sync; moving them is the
+  // next unit, and commerce.order.record is the one that decides whether the
+  // shape holds — 569 lines and 15 controller calls.
   steps: {
-    "step.commerce.customer.insert": {
-      billable: true,
-      key: "Create customer",
-      queue: "connection",
-      returns: [
-        { key: "shopifyCustomerId", label: "Shopify Customer ID" }
-      ],
-      settings: {},
-      triggers: ["lead.insert"]
-    },
-    "step.commerce.code.issue": {
-      billable: true,
-      key: "Issue a discount code",
-      queue: "connection",
-      returns: [
-        { key: "shopifyDiscountCode", label: "Shopify Discount Code" },
-        { key: "shopifyDiscountId", label: "Shopify Discount ID" }
-      ],
-      settings: {
-        discount: {
-          required: true,
-          shape: {
-            id: { required: true, type: "string" }
+    commerce: {
+      code: {
+        issue: () => ({
+          hook: "commerce.code",
+          key: "Issue a discount code",
+          queue: "connection",
+          settings: {
+            discount: {
+              required: true,
+              shape: {
+                id: { required: true, type: "string" }
+              },
+              type: "object"
+            }
           },
-          type: "object"
-        }
+          triggers: ["lead.insert"],
+          usage: { actions: 1 }
+        })
       },
-      triggers: ["lead.insert"]
-    },
-    // System steps: dispatched by sync itself rather than offered in the
-    // builder, so they carry no trigger. They are declared because the
-    // routing table and the system-workflow descriptions both read from here.
-    // Not a webhook monitor, despite the name it carried. Webhooks are
-    // declarative — declared in the app's toml, applied by Shopify to every
-    // install — so nothing registers or checks them here. This rotates the
-    // access token before Shopify's idle window closes, and reconciles the
-    // scopes the store granted against the ones the app now needs.
-    "step.connection.health.check": {
-      description: "Keeps store access working \u2014 refreshes the access token before it goes stale and reports when the store's approved permissions fall behind.",
-      key: "Shopify Connection Health",
-      queue: "connection",
-      system: true
-    },
-    "step.commerce.order.record": {
-      description: "Records an order and billing charge when a purchase is made via a Drawbridge campaign link.",
-      key: "Shopify Order Tracking",
-      queue: "connection",
-      system: true
-    },
-    "step.commerce.product.sync": {
-      description: "Syncs Shopify product data on webhook updates.",
-      key: "Shopify Product Sync",
-      queue: "connection",
-      system: true
-    },
-    // Audit-only. The "Shopify Token Activity" system workflow lists these for
-    // descriptive grouping, but its audit step docs are written manually at
-    // OAuth time — the workflow is never dispatched. Routing is declared
-    // defensively so that if it ever IS dispatched, the job lands on a real
-    // queue and the handler lookup misses cleanly instead of throwing
-    // "Unknown step type".
-    "step.connection.token.exchange": {
-      key: "Shopify Token Exchange",
-      queue: "connection",
-      system: true
+      customer: {
+        insert: () => ({
+          hook: "commerce.customer",
+          key: "Create customer",
+          queue: "connection",
+          settings: {},
+          triggers: ["lead.insert"],
+          usage: { actions: 1 }
+        })
+      },
+      // SYSTEM STEPS: dispatched by drawbridge-sync itself rather than offered
+      // in the builder, so they carry no trigger and no usage. Declared because
+      // the routing table and the system-workflow descriptions both read here.
+      order: {
+        record: () => ({
+          description: "Records an order and billing charge when a purchase is made via a Drawbridge campaign link.",
+          hook: "commerce.order",
+          key: "Shopify Order Tracking",
+          queue: "connection",
+          system: true
+        })
+      },
+      product: {
+        sync: () => ({
+          description: "Syncs Shopify product data on webhook updates.",
+          hook: "commerce.product",
+          key: "Shopify Product Sync",
+          queue: "connection",
+          system: true
+        })
+      }
     },
-    "step.connection.token.refresh": {
-      key: "Shopify Token Refresh",
-      queue: "connection",
-      system: true
+    connection: {
+      // Not a webhook monitor, despite the name it once carried. Webhooks are
+      // declarative — declared in the app's toml, applied by Shopify to every
+      // install — so nothing registers or checks them here. This rotates the
+      // access token before Shopify's idle window closes, and reconciles the
+      // scopes the store granted against the ones the app now needs.
+      health: {
+        check: () => ({
+          description: "Keeps store access working \u2014 refreshes the access token before it goes stale and reports when the store's approved permissions fall behind.",
+          hook: "lifecycle.health",
+          key: "Shopify Connection Health",
+          queue: "connection",
+          system: true
+        })
+      },
+      // Audit-only. The "Shopify Token Activity" system workflow lists these
+      // for descriptive grouping, but its audit step docs are written manually
+      // at OAuth time — the workflow is never dispatched. Routing is declared
+      // defensively so that if it ever IS dispatched, the job lands on a real
+      // queue and the handler lookup misses cleanly instead of throwing
+      // "Unknown step type".
+      token: {
+        exchange: () => ({
+          description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
+          key: "Shopify Token Exchange",
+          queue: "connection",
+          system: true
+        }),
+        refresh: () => ({
+          description: "Records a token rotation. Audit only \u2014 never dispatched.",
+          key: "Shopify Token Refresh",
+          queue: "connection",
+          system: true
+        })
+      }
     }
   },
+  // Shopify sits pending between the install landing and the merchant choosing a
+  // plan, and nothing on our side can move it — so the card says what they need
+  // to go and do rather than showing Pending with no next step.
+  //
+  // Scope drift is NOT here: drawbridge-sync writes it onto the connection
+  // document, and the document's own warnings render beside these.
+  tasks: (data2) => (data2 == null ? void 0 : data2.status) === "pending" ? [
+    {
+      message: "Open the Drawbridge app in your Shopify admin and choose a plan. The connection activates once Shopify confirms it.",
+      title: "Choose a plan in Shopify"
+    }
+  ] : [],
   title: "Shopify"
 };
 
-// lib/connections/icons/drawbridge.js
-var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="#BAEC5F"/>
-<g clip-path="url(#clip0_2115_2832)">
-<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
-</g>
-<defs>
-<clipPath id="clip0_2115_2832">
-<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
-</clipPath>
-</defs>
-</svg>`;
+// lib/connections/webhook.js
+import crypto from "crypto";
+
+// lib/safe-http.js
+import dns2 from "dns";
+import * as http2 from "http";
+import * as https2 from "https";
+
+// lib/axios.js
+import axiosLib from "axios";
+import dns from "dns";
+import * as http from "http";
+import * as https from "https";
+import net from "net";
+var dnsLookup = dns.promises.lookup;
+var isBlockedIPv4 = (ip) => {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51) return true;
+  if (a === 203 && b === 0) return true;
+  if (a >= 224) return true;
+  return false;
+};
+var isBlockedIPv6 = (ip) => {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (/^fe[89ab]/.test(lower)) return true;
+  if (lower.startsWith("ff")) return true;
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice(7);
+    return isBlockedIPv4(v4);
+  }
+  ;
+  return false;
+};
+var isBlockedIP = (ip) => {
+  const version = net.isIP(ip);
+  if (version === 4) return isBlockedIPv4(ip);
+  if (version === 6) return isBlockedIPv6(ip);
+  return true;
+};
+var axios = axiosLib.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
+
+// lib/safe-http.js
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+var resolveSafeHost = async (url) => {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("Only http(s) URLs are allowed");
+  }
+  const records = await dns2.promises.lookup(parsed.hostname, { all: true });
+  if (!(records == null ? void 0 : records.length)) {
+    throw new Error("Host could not be resolved");
+  }
+  for (const record of records) {
+    if (isBlockedIP(record.address)) {
+      throw new Error("Host resolves to a blocked IP range");
+    }
+  }
+  return { parsed, records };
+};
+var pinnedAgent = async (url) => {
+  const { parsed, records } = await resolveSafeHost(url);
+  const pinned = records[0];
+  const lookup2 = (hostname, options, callback) => {
+    if (options == null ? void 0 : options.all) {
+      callback(null, [{ address: pinned.address, family: pinned.family }]);
+    } else {
+      callback(null, pinned.address, pinned.family);
+    }
+  };
+  return {
+    protocol: parsed.protocol,
+    agent: parsed.protocol === "https:" ? new https2.Agent({ lookup: lookup2 }) : new http2.Agent({ lookup: lookup2 })
+  };
+};
+var safeRequest = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS2,
+  type = "json",
+  url
+}) => {
+  const full = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
+  }
+  const { protocol, agent } = await pinnedAgent(full.toString());
+  const isForm = type === "form";
+  try {
+    const response = await axios({
+      method,
+      url: full.toString(),
+      headers: {
+        "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+        ...headers
+      },
+      ...body !== void 0 && {
+        data: isForm ? new URLSearchParams(body).toString() : body
+      },
+      timeout,
+      maxRedirects: 0,
+      httpAgent: protocol === "http:" ? agent : void 0,
+      httpsAgent: protocol === "https:" ? agent : void 0,
+      responseType: "json",
+      validateStatus: (status) => status >= 200 && status < 300
+    });
+    return response.data || null;
+  } catch (error) {
+    if (error == null ? void 0 : error.response) {
+      const normalized = new Error(
+        typeof error.response.data === "string" ? error.response.data : error.message || "Request failed"
+      );
+      normalized.status = error.response.status;
+      normalized.response = error.response.data;
+      throw normalized;
+    }
+    throw error;
+  }
+};
 
 // lib/connections/webhook.js
 var webhook_default = {
@@ -961,13 +2522,26 @@ var webhook_default = {
   auth: {
     type: "generated"
   },
-  category: "developer",
-  confirm: "Disconnecting stops Drawbridge from sending signed webhook payloads to your endpoint.",
-  description: [
-    "Drawbridge can POST event payloads to your endpoint as activity happens in your account, so your own systems can react in real time.",
-    "Generate a signing secret and Drawbridge signs every request with it. Your endpoint recomputes the signature to confirm each payload genuinely came from Drawbridge before acting on it."
-  ],
-  excerpt: "Sign outgoing webhook payloads with an HMAC secret to verify authenticity.",
+  // EVERYTHING A MERCHANT READS. `errors` would belong here too — the
+  // connection DOCUMENT carries its own `errors` array and is spread OVER the
+  // resolved manifest downstream, so a top-level one is replaced by that array.
+  content: {
+    confirm: "Disconnecting stops Drawbridge from sending signed webhook payloads to your endpoint.",
+    description: [
+      "Drawbridge can POST event payloads to your endpoint as activity happens in your account, so your own systems can react in real time.",
+      "Generate a signing secret and Drawbridge signs every request with it. Your endpoint recomputes the signature to confirm each payload genuinely came from Drawbridge before acting on it."
+    ],
+    excerpt: "Sign outgoing webhook payloads with an HMAC secret to verify authenticity.",
+    guide: [
+      "Press Connect. Drawbridge generates a signing secret and shows it here.",
+      "Copy the secret into your own endpoint.",
+      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+    ]
+  },
+  // Nothing to be exclusive with — there is no second webhook vendor, and a
+  // merchant with two endpoints is a step-level choice rather than a second
+  // connection.
+  exclusive: false,
   feature: "organization:connection:webhook",
   fields: [
     {
@@ -980,14 +2554,66 @@ var webhook_default = {
       label: "Signing secret"
     }
   ],
+  group: "developer",
+  // OUTBOUND ONLY. inbound.* is false because the direction is the point: we
+  // sign and POST to the merchant's endpoint, they never call us. Every other
+  // false follows from there being no third party to authenticate against —
+  // connect generates a secret rather than proving a credential.
+  hooks: {
+    auth: {
+      // Minting and clearing a secret needs no vendor call, so the api's own
+      // handler does both.
+      connect: {},
+      disconnect: {},
+      probe: false,
+      scopes: false,
+      // Nothing to mint. Connecting generates a secret; there is no vendor.
+      token: false
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      audiences: false,
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    // THE BODY IS HERE, not in drawbridge-sync. It needs `crypto` and an HTTP
+    // client and nothing else — no controller, no queue, no database — so
+    // there was never a reason for it to live in another repo.
+    //
+    // That is the rule the whole split runs on: a hook lives in sync only if it
+    // needs Drawbridge's own database, sockets or queues. This one does not.
+    webhook: {
+      send: async ({ context, controller, request: send2 = safeRequest, settings, step }) => {
+        const { headers = {}, method = "POST", url } = step.settings || {};
+        const request2 = { method, url: url || null };
+        if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        const lead = (context == null ? void 0 : context.lead) ? await controller.get({ collection: "lead", query: { id: context.lead } }) : null;
+        const body = lead || context;
+        request2.body = body;
+        const outgoing = { ...headers };
+        if (settings == null ? void 0 : settings.secret) {
+          outgoing["X-Drawbridge-Signature"] = "sha256=" + crypto.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+        }
+        const response = await send2({ body, headers: outgoing, method, url });
+        return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
+      }
+    }
+  },
   // Borrowed: this is the Drawbridge mark, because Webhooks has none of its own.
   // It is the one card that reads wrong — our logo among vendor logos — and it
   // wants a mark of its own when there is one.
   icon: drawbridge_default,
-  // The destination url is supplied per step, not per connection, so there is
-  // nothing to finish here — generating the secret IS connecting.
-  incomplete: () => null,
-  label: "webhook",
   // Gated on the encryption secret: without it the signing secret could not be
   // stored safely, so the connection must not be offered at all.
   requires: ["ENCRYPT_CONNECTION_SECRET"],
@@ -995,39 +2621,28 @@ var webhook_default = {
   // sign and POST to the merchant's endpoint, they never call us. Every other
   // false follows from there being no third party to authenticate against —
   // connect generates a secret rather than proving a credential.
-  supports: {
-    "auth.connect": true,
-    "auth.disconnect": true,
-    "auth.probe": false,
-    "auth.scopes": false,
-    "catalog.audiences": false,
-    "catalog.prices": false,
-    "catalog.products": false,
-    "catalog.promotions": false,
-    "inbound.event": false,
-    "inbound.process": false,
-    "inbound.receive": false,
-    "inbound.verify": false,
-    "lifecycle.cleanup": false,
-    "lifecycle.register": false,
-    "lifecycle.rehydrate": false
-  },
-  setup: [
-    "Press Connect. Drawbridge generates a signing secret and shows it here.",
-    "Copy the secret into your own endpoint.",
-    "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
-  ],
   slug: "webhook",
+  // The destination url is supplied per step, not per connection, so there is
+  // nothing to finish here — generating the secret IS connecting, and no
+  // setting can make this connection unusable. The credential's own verdict
+  // stands.
+  status: (data2) => data2 == null ? void 0 : data2.status,
   steps: {
-    "step.webhook.send": {
-      billable: true,
-      key: "Send webhook",
-      queue: "webhook",
-      returns: [],
-      settings: {
-        url: { format: "url", required: true, type: "string" }
-      },
-      triggers: ["lead.insert", "lead.delete"]
+    webhook: {
+      send: () => ({
+        hook: "webhook.send",
+        key: "Send webhook",
+        queue: "webhook",
+        settings: {
+          url: { format: "url", required: true, type: "string" }
+        },
+        triggers: ["lead.insert", "lead.delete"],
+        // Replaces `billable : true`, which fed BILLABLE_STEP_TYPES, which set
+        // workflow.billable at save, which sync then checked against a usage
+        // the handler returned — three hops for one fact, two of which could
+        // disagree silently.
+        usage: { actions: 1 }
+      })
     }
   },
   // The card the connection page raises. Before connecting it explains what
@@ -1051,31 +2666,41 @@ var webhook_default = {
 
 // lib/connections/index.js
 var QUEUES = ["connection", "notification", "segment", "webhook"];
+var implemented = (hooks, path) => {
+  const hook = path.split(".").reduce((node, key) => node == null ? void 0 : node[key], hooks);
+  return typeof hook === "function" || !!hook && typeof hook === "object";
+};
+var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
+  ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
+);
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
-  if (!(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
-  if (!(manifest == null ? void 0 : manifest.excerpt)) throw new Error(manifest.slug + " needs an excerpt for its card");
-  if (!Array.isArray(manifest == null ? void 0 : manifest.description) || !manifest.description.length) {
-    throw new Error(manifest.slug + " needs a description \u2014 an array of paragraphs for its page");
+  if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
+  if (!((_a = manifest == null ? void 0 : manifest.content) == null ? void 0 : _a.excerpt)) throw new Error(manifest.slug + " needs content.excerpt for its card");
+  if (!Array.isArray((_b = manifest == null ? void 0 : manifest.content) == null ? void 0 : _b.description) || !manifest.content.description.length) {
+    throw new Error(manifest.slug + " needs content.description \u2014 an array of paragraphs for its page");
   }
-  for (const field of manifest.fields || []) {
-    if (!(field == null ? void 0 : field.key) || !(field == null ? void 0 : field.label)) {
+  for (const field2 of manifest.fields || []) {
+    if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
       throw new Error(manifest.slug + " declares a field with no key or label");
     }
-    if (field.input && !INPUTS.includes(field.input)) {
-      throw new Error(manifest.slug + "." + field.key + " declares an unknown input: " + field.input + " \u2014 one of " + INPUTS.join(", "));
+    if (field2.input && !INPUTS.includes(field2.input)) {
+      throw new Error(manifest.slug + "." + field2.key + " declares an unknown input: " + field2.input + " \u2014 one of " + INPUTS.join(", "));
     }
-    if (field.input === "select" && !(field.options || []).length && !field.source) {
-      throw new Error(manifest.slug + "." + field.key + " is a select and must declare options or a source");
+    if (field2.input === "select" && !(field2.options || []).length && !field2.hook) {
+      throw new Error(manifest.slug + "." + field2.key + " is a select and must declare options or a hook");
     }
-    if (field.source) {
-      if (!HOOK_NAMES.includes(field.source)) {
-        throw new Error(manifest.slug + "." + field.key + " sources options from an unknown hook: " + field.source);
+    if (field2.hook) {
+      if (!HOOK_NAMES.includes(field2.hook)) {
+        throw new Error(manifest.slug + "." + field2.key + " names an unknown hook: " + field2.hook);
       }
-      if (((_a = manifest.supports) == null ? void 0 : _a[field.source]) !== true) {
-        throw new Error(manifest.slug + "." + field.key + " sources options from " + field.source + ", which it declares unsupported");
+      if (!field2.hook.startsWith("resources.")) {
+        throw new Error(manifest.slug + "." + field2.key + " reads from " + field2.hook + " \u2014 a picker may only read resources.*");
+      }
+      if (!implemented(manifest.hooks, field2.hook)) {
+        throw new Error(manifest.slug + "." + field2.key + " reads " + field2.hook + ", which this vendor does not implement");
       }
     }
   }
@@ -1088,82 +2713,102 @@ var build = (manifest) => {
   if (manifest.icon.includes("<image")) {
     throw new Error(manifest.slug + " icon wraps a raster \u2014 re-export it as vector shapes");
   }
-  if (!CATEGORIES.includes(manifest == null ? void 0 : manifest.category)) {
-    throw new Error(manifest.slug + " needs a category \u2014 one of " + CATEGORIES.join(", "));
+  if (!GROUPS.includes(manifest == null ? void 0 : manifest.group)) {
+    throw new Error(manifest.slug + " needs a group \u2014 one of " + GROUPS.join(", "));
   }
-  if ((_b = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _b.type) {
+  if ((_c = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _c.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_c = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _c.type)) {
+  if (!AUTH_TYPES.includes((_d = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _d.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
-    for (const field of OAUTH_FIELDS) {
-      if (!((_d = manifest.auth.oauth) == null ? void 0 : _d[field])) {
-        throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field);
+    for (const field2 of OAUTH_FIELDS) {
+      if (!((_e = manifest.auth.oauth) == null ? void 0 : _e[field2])) {
+        throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field2);
+      }
+    }
+    if (typeof ((_g = (_f = manifest.hooks) == null ? void 0 : _f.auth) == null ? void 0 : _g.token) !== "function") {
+      throw new Error(manifest.slug + " is oauth and must implement hooks.auth.token \u2014 point it at authToken() or wrap it");
+    }
+    for (const url of OAUTH_URLS) {
+      if (!((_i = (_h = manifest.auth.oauth) == null ? void 0 : _h.urls) == null ? void 0 : _i[url])) {
+        throw new Error(manifest.slug + " is oauth and must declare auth.oauth.urls." + url);
       }
     }
-    if (manifest.auth.oauth.redirect !== "/api/connection/" + manifest.slug + "/callback") {
+    if (manifest.auth.oauth.urls.redirect !== "/api/connection/" + manifest.slug + "/callback") {
       throw new Error(
-        manifest.slug + " declares auth.oauth.redirect " + manifest.auth.oauth.redirect + " but the only callback route is /api/connection/" + manifest.slug + "/callback"
+        manifest.slug + " declares auth.oauth.urls.redirect " + manifest.auth.oauth.urls.redirect + " but the only callback route is /api/connection/" + manifest.slug + "/callback"
       );
     }
   }
-  if (((_e = manifest.supports) == null ? void 0 : _e["inbound.event"]) && !((_g = (_f = manifest.inbound) == null ? void 0 : _f.headers) == null ? void 0 : _g.event)) {
-    throw new Error(manifest.slug + " supports inbound.event but declares no inbound.headers.event");
+  if (implemented(manifest.hooks, "inbound.event") && !((_k = (_j = manifest.inbound) == null ? void 0 : _j.headers) == null ? void 0 : _k.event)) {
+    throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (((_h = manifest.supports) == null ? void 0 : _h["inbound.verify"]) && !((_j = (_i = manifest.inbound) == null ? void 0 : _i.headers) == null ? void 0 : _j.signature)) {
-    throw new Error(manifest.slug + " supports inbound.verify but declares no inbound.headers.signature");
+  if (implemented(manifest.hooks, "inbound.verify") && !((_m = (_l = manifest.inbound) == null ? void 0 : _l.headers) == null ? void 0 : _m.signature)) {
+    throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
-  if (typeof (manifest == null ? void 0 : manifest.incomplete) !== "function") {
-    throw new Error(manifest.slug + " must declare incomplete( data ) \u2014 return null when the connection is usable, or the reason it is not");
+  if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
+    throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray(manifest == null ? void 0 : manifest.setup) || !manifest.setup.length) {
-    throw new Error(manifest.slug + " needs a setup guide \u2014 an array of steps for its page");
+  if (!Array.isArray((_n = manifest == null ? void 0 : manifest.content) == null ? void 0 : _n.guide) || !manifest.content.guide.length) {
+    throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
-  for (const [name, hook] of Object.entries(manifest.hooks || {})) {
-    if (!HOOK_NAMES.includes(name)) {
-      throw new Error(manifest.slug + " implements an unknown hook: " + name);
-    }
-    if (typeof hook !== "function") {
-      throw new Error(manifest.slug + " declares hook " + name + " but it is not a function");
-    }
-    if (((_k = manifest.supports) == null ? void 0 : _k[name]) !== true) {
-      throw new Error(manifest.slug + " implements " + name + " but declares supports[ '" + name + "' ] false");
-    }
+  if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
+    throw new Error(manifest.slug + " must declare status( data ) \u2014 one of " + STATUSES.join(", "));
   }
-  const supports = manifest.supports || {};
-  for (const name of HOOK_NAMES) {
-    if (typeof supports[name] !== "boolean") {
-      throw new Error(manifest.slug + " must declare supports[ '" + name + "' ] as true or false");
+  const status = manifest.status({});
+  if (status != null && !STATUSES.includes(status)) {
+    throw new Error(manifest.slug + " status() returned " + status + " \u2014 must be one of " + STATUSES.join(", "));
+  }
+  for (const [domain, verbs] of Object.entries(HOOKS)) {
+    for (const verb of verbs) {
+      const hook = (_p = (_o = manifest.hooks) == null ? void 0 : _o[domain]) == null ? void 0 : _p[verb];
+      if (((_q = manifest.hooks) == null ? void 0 : _q[domain]) === false) continue;
+      if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
+        throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
+      }
     }
   }
-  for (const name of Object.keys(supports)) {
-    if (!HOOK_NAMES.includes(name)) {
-      throw new Error(manifest.slug + " declares an unknown hook: " + name);
+  for (const [domain, verbs] of Object.entries(manifest.hooks || {})) {
+    if (!HOOKS[domain]) throw new Error(manifest.slug + " implements an unknown hook domain: " + domain);
+    for (const verb of Object.keys(verbs === false ? {} : verbs)) {
+      if (!HOOKS[domain].includes(verb)) {
+        throw new Error(manifest.slug + " implements an unknown hook: " + domain + "." + verb);
+      }
     }
   }
-  for (const [type, step] of Object.entries(manifest.steps || {})) {
-    if (!type.startsWith("step.")) {
-      throw new Error(manifest.slug + " declares a step type that is not step.<domain>.<verb>: " + type);
+  for (const [name, step] of leaves(manifest.steps)) {
+    const type = "step." + name;
+    if (!STEPS[name]) {
+      throw new Error(manifest.slug + " declares an unknown step: " + type + " \u2014 add it to STEPS in contract.js");
     }
-    if (!(step == null ? void 0 : step.key)) throw new Error(manifest.slug + " step " + type + " needs a key \u2014 the label the builder shows");
-    if (!QUEUES.includes(step == null ? void 0 : step.queue)) {
+    const declared = step({});
+    if (!(declared == null ? void 0 : declared.key)) throw new Error(manifest.slug + " step " + type + " needs a key \u2014 the label the builder shows");
+    if (!QUEUES.includes(declared == null ? void 0 : declared.queue)) {
       throw new Error(manifest.slug + " step " + type + " needs a queue \u2014 one of " + QUEUES.join(", "));
     }
+    if (declared.hook && !implemented(manifest.hooks, declared.hook)) {
+      throw new Error(manifest.slug + " step " + type + " points at hook " + declared.hook + ", which this vendor does not implement");
+    }
   }
   return Object.freeze({
     ...manifest,
     fields: Object.freeze(manifest.fields || []),
     hooks: Object.freeze(manifest.hooks || {}),
     inbound: Object.freeze(manifest.inbound || {}),
-    setup: Object.freeze(manifest.setup || []),
-    supports: Object.freeze(supports),
     requires: Object.freeze(manifest.requires || []),
     steps: Object.freeze(manifest.steps || {})
   });
 };
+var stepLabels = (catalog = connections) => Object.fromEntries(
+  Object.values(catalog).flatMap(
+    (vendor) => leaves(vendor.steps).map(([name]) => ["step." + name, STEP_LABELS["step." + name]])
+  )
+);
 var connections = Object.freeze({
+  drawbridge: build(drawbridge_default2),
+  hubspot: build(hubspot_default),
   klaviyo: build(klaviyo_default2),
   mailchimp: build(mailchimp_default2),
   shopify: build(shopify_default2),
@@ -1172,7 +2817,8 @@ var connections = Object.freeze({
 (() => {
   const owners = {};
   for (const [slug, manifest] of Object.entries(connections)) {
-    for (const type of Object.keys(manifest.steps)) {
+    for (const [name] of leaves(manifest.steps)) {
+      const type = "step." + name;
       if (owners[type]) {
         throw new Error("Step " + type + " is declared by both " + owners[type] + " and " + slug);
       }
@@ -1185,23 +2831,27 @@ var availableConnections = (env = {}) => Object.fromEntries(
     ([, manifest]) => manifest.requires.every((name) => Boolean(env[name]))
   )
 );
+var catalogConnections = (env = {}) => Object.fromEntries(
+  Object.entries(availableConnections(env)).filter(([, manifest]) => !manifest.private)
+);
 var publicSettingsBySlug = Object.fromEntries(
   Object.entries(connections).map(([slug, manifest]) => [
     slug,
-    manifest.fields.filter((field) => !field.redact).map((field) => field.key)
+    manifest.fields.filter((field2) => !field2.redact).map((field2) => field2.key)
   ])
 );
 var connectionSteps = (env = {}) => Object.entries(availableConnections(env)).flatMap(
-  ([slug, manifest]) => Object.entries(manifest.steps).map(([type, step]) => ({ ...step, slug, type }))
+  ([slug, manifest]) => leaves(manifest.steps).map(([name, step]) => ({ ...step({}), slug, type: "step." + name }))
 );
 var hookSupport = (name) => ({
-  no: Object.keys(connections).filter((slug) => !connections[slug].supports[name]),
-  yes: Object.keys(connections).filter((slug) => connections[slug].supports[name])
+  no: Object.keys(connections).filter((slug) => !implemented(connections[slug].hooks, name)),
+  yes: Object.keys(connections).filter((slug) => implemented(connections[slug].hooks, name))
 });
 var connectFields = (slug) => {
   var _a;
-  return (((_a = connections[slug]) == null ? void 0 : _a.fields) || []).map(({ copy, from, input, key, label, message, options, placeholder, redact, required }) => ({
+  return (((_a = connections[slug]) == null ? void 0 : _a.fields) || []).map(({ copy, from, hook, input, key, label, message, options, placeholder, redact, required, search }) => ({
     ...copy && { copy: true },
+    ...hook && { hook },
     ...from && { from },
     ...input && { input },
     key,
@@ -1209,6 +2859,9 @@ var connectFields = (slug) => {
     ...message && { message },
     ...options && { options },
     ...placeholder && { placeholder },
+    // Declared false only where the vendor cannot filter, so a picker does not
+    // offer a search box that quietly searches one page.
+    ...search === false && { search: false },
     required: Boolean(required),
     // A UI hint, not a leak: the form uses it to stop requiring the field once
     // the connection exists, and to say "leave blank to keep" — because the GET
@@ -1217,16 +2870,17 @@ var connectFields = (slug) => {
   }));
 };
 var runHook = async (slug, name, args = {}) => {
-  var _a, _b;
   const manifest = connections[slug];
   if (!manifest) return { outcome: OUTCOMES.unsupported, reason: "no such connection: " + slug };
-  if (!((_a = manifest.supports) == null ? void 0 : _a[name])) return { outcome: OUTCOMES.unsupported, reason: slug + " does not implement " + name };
-  const hook = (_b = manifest.hooks) == null ? void 0 : _b[name];
+  const hook = name.split(".").reduce((node, key) => node == null ? void 0 : node[key], manifest.hooks);
+  if (hook === false || hook == null) {
+    return { outcome: OUTCOMES.unsupported, reason: slug + " does not implement " + name };
+  }
   if (typeof hook !== "function") {
     return { outcome: OUTCOMES.unimplemented, reason: slug + " implements " + name + " outside this package" };
   }
   try {
-    return { outcome: OUTCOMES.answered, result: await hook(args) };
+    return { outcome: OUTCOMES.answered, result: await hook({ ...args, manifest }) };
   } catch (error) {
     return { error: (error == null ? void 0 : error.message) || "failed", outcome: OUTCOMES.failed, status: (error == null ? void 0 : error.status) || null };
   }
@@ -1256,22 +2910,26 @@ var redactSettings = ({ slug, settings }) => {
 };
 var publicConnectionKeys = Object.freeze([
   "actions",
-  "category",
-  "confirm",
+  // API-COMPOSED, not manifest-declared: the api's resolve() builds it from
+  // auth.type, content.redirect and the manifest's manage() — the client reads
+  // connect.type to choose entered-vs-installed, connect.redirect for the App
+  // Store link, connect.manage for the admin deep link. It was dropped from
+  // this list when the manifests stopped declaring it, which stripped the
+  // composed object from every response and broke all three.
   "connect",
+  // EVERYTHING A MERCHANT READS, in one key: confirm, description, errors,
+  // excerpt, guide, and any vendor redirect copy.
+  "content",
   "createdAt",
+  // The connection DOCUMENT's own errors array — scope-drift entries written by
+  // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
+  // the document is spread OVER the resolved manifest downstream, so the two
+  // sharing this key means the array silently wins.
   "errors",
-  "description",
-  "excerpt",
   "fields",
   "group",
   "id",
   "image",
-  // The reason a connected vendor still is not usable — a Klaviyo grant with no
-  // list chosen. Public because the card that shows Pending has to say why.
-  "incomplete",
-  "label",
-  "setup",
   "settings",
   "shop",
   "slug",
@@ -1294,31 +2952,36 @@ var projectConnection = (record) => {
     {}
   );
 };
-var resolveConnection = (item, data) => {
+var resolveConnection = (item, data2, env = {}) => {
   if (!item) return item;
   return Object.fromEntries(
     Object.entries(item).filter(([key]) => !["auth", "enabled", "fields", "hooks", "inbound", "requires", "steps", "supports"].includes(key)).map(([key, value]) => [
       key,
-      typeof value === "function" ? value(data) : value
+      typeof value === "function" ? value(data2, env) : value
     ])
   );
 };
 export {
   AUTH_TYPES,
-  CATEGORIES,
+  GROUPS,
   HOOKS,
   HOOK_NAMES,
   INPUTS,
   OAUTH_FIELDS,
   OUTCOMES,
+  RETIRED,
+  STATUSES,
+  STEPS,
+  STEP_TYPES,
   accessToken,
+  authToken,
   availableConnections,
   build,
+  catalogConnections,
   connectFields,
   connectionSteps,
   connections,
   consentUrl,
-  exchange,
   hookSupport,
   isStale,
   mergeSettings,
@@ -1327,10 +2990,10 @@ export {
   publicConnectionKeys,
   publicSettingsBySlug,
   redactSettings,
-  refresh,
   resolveConnection,
   runHook,
   scopesMessage,
+  stepLabels,
   stepQueues,
   tokenSettings
 };