@drawbridge/drawbridge-utils 0.0.115 → 0.0.117

package/dist/connections/index.cjs

@@ -477,7 +477,13 @@ var attentive_default2 = {
   // connection DOCUMENT carries its own `errors` array and is spread OVER the
   // resolved manifest downstream, so a top-level one would never render.
   content: {
-    confirm: "Disconnecting revokes Drawbridge's access to your Attentive account. Your subscribers stay in both Attentive and Drawbridge \u2014 neither list is deleted.",
+    // SAYS WHAT ACTUALLY HAPPENS. This used to promise that disconnecting
+    // revokes Drawbridge's access, and it cannot: Attentive documents no
+    // revocation endpoint, and their authentication page states an access
+    // token "does not expire". So the grant survives a disconnect forever
+    // unless the merchant removes the integration at Attentive, and the copy
+    // has to say so rather than let them believe otherwise.
+    confirm: "Disconnecting removes Drawbridge's stored Attentive token. Attentive does not offer a way for us to revoke it, so remove the Drawbridge integration in Attentive as well if you want its access fully withdrawn. Your subscribers stay in both Attentive and Drawbridge \u2014 neither list is deleted.",
     description: [
       "Attentive is where your SMS marketing lives, and this connection is becoming the way your Drawbridge contacts sync into an Attentive segment.",
       "You authorize Drawbridge from inside Attentive and can revoke that access there at any time. Drawbridge never sees or stores your Attentive password.",
@@ -518,8 +524,15 @@ var attentive_default2 = {
       // account-identity endpoint to enrich them with — Klaviyo's connect
       // reads the account name back; this has nothing cited to read. The
       // callback stores the tokens and skips enrichment on `unimplemented`.
-      connect: {},
-      disconnect: {},
+      // FALSE, NOT {}. `{}` means "supported, implemented in the repo with the
+      // dependencies", and nothing anywhere implements either of these —
+      // there is nothing for them to do. The exchange already yields the
+      // tokens and Attentive documents no account-identity endpoint to
+      // enrich them with, so connect has nothing to add; and they document
+      // no revocation endpoint at all, so disconnect has nothing to call.
+      // Recorded as a decision rather than left as an unkept promise.
+      connect: false,
+      disconnect: false,
       probe: false,
       scopes: false,
       // THE ONE THING WRAPPED, and it is about the response rather than the
@@ -622,6 +635,197 @@ var attentive_default2 = {
   title: "Attentive"
 };
 
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/hubspot.js
+var HUBSPOT_BASE = "https://api.hubapi.com";
+var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  return (fetcher || request)({
+    body,
+    headers: {
+      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+    },
+    method,
+    query,
+    url: HUBSPOT_BASE + path
+  });
+};
+var UTM_PROPERTIES = {
+  campaign: "utm_campaign",
+  content: "utm_content",
+  id: "utm_id",
+  medium: "utm_medium",
+  source: "utm_source",
+  term: "utm_term"
+};
+var CLICK_PROPERTIES = {
+  fbclid: "hs_facebook_click_id",
+  gclid: "hs_google_click_id",
+  liFatId: "hs_linkedin_click_id",
+  msclkid: "hs_bing_click_id",
+  ttclid: "hs_tiktok_click_id"
+};
+var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
+var isUtmProperty = (key) => DROPPABLE.has(key);
+var toProperties = ({ email, firstName, lastName, utm }) => {
+  var _a;
+  const properties = {};
+  if (email !== void 0) properties.email = email;
+  if (firstName !== void 0) properties.firstname = firstName;
+  if (lastName !== void 0) properties.lastname = lastName;
+  if (utm) {
+    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
+      if (utm[key]) properties[property] = utm[key];
+    }
+    ;
+    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
+      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
+    }
+    ;
+  }
+  ;
+  return properties;
+};
+var send = async ({ doc, fetcher, method, path, token }) => {
+  const properties = toProperties(doc);
+  try {
+    return await hubspotRequest({
+      body: { properties },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  } catch (error) {
+    const enriched = Object.keys(properties).some(isUtmProperty);
+    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
+    return await hubspotRequest({
+      body: {
+        properties: Object.fromEntries(
+          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
+        )
+      },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  }
+};
+var lookup = async ({ email, fetcher, token }) => {
+  var _a, _b;
+  if (!token || !email) return;
+  try {
+    const body = await hubspotRequest({
+      body: {
+        filterGroups: [
+          {
+            filters: [
+              {
+                operator: "EQ",
+                propertyName: "email",
+                value: email
+              }
+            ]
+          }
+        ],
+        limit: 1,
+        properties: ["email"]
+      },
+      fetcher,
+      method: "POST",
+      path: "/crm/v3/objects/contacts/search",
+      token
+    });
+    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
+  } catch (error) {
+  }
+};
+var contacts = {
+  // FORGET A CONTACT, by id or by email. Account deletion — the caller had
+  // to search then remove, which is one round trip it should not have to
+  // know about.
+  remove: async ({ email, fetcher, id, token }) => {
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    const contact = id || await lookup({ email, fetcher, token: key });
+    if (!contact) return;
+    return hubspotRequest({
+      fetcher,
+      method: "DELETE",
+      path: "/crm/v3/objects/contacts/" + contact,
+      token: key
+    });
+  },
+  // Connect an account to its contact by email, creating it if absent, and
+  // return the contact id. Unlike SendGrid, HubSpot renames a contact's
+  // email in place, so an email change is a plain PATCH on the cached id —
+  // no delete-old-then-create-new.
+  //
+  // Prefer the cached hubspotId; fall back to a search; create last.
+  sync: async ({ doc, fetcher, token }) => {
+    var _a, _b;
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    if (doc == null ? void 0 : doc.hubspotId) {
+      try {
+        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+      } catch (error) {
+        if ((error == null ? void 0 : error.status) !== 404) throw error;
+      }
+    }
+    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+    return (_b = await send({
+      doc,
+      fetcher,
+      method: existing ? "PATCH" : "POST",
+      path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
+      token: key
+    })) == null ? void 0 : _b.id;
+  }
+};
+
 // lib/connections/icons/drawbridge.js
 var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="#BAEC5F"/>
@@ -1259,7 +1463,15 @@ var drawbridge_default2 = {
       token: false
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // DRAWBRIDGE'S OWN CRM. Not a merchant's — this keeps our HubSpot portal in
+    // step with account signups, and drawbridge-sync's user stream calls it.
+    //
+    // A real implementation here rather than `{}` because the bodies are pure
+    // HTTP against a token: no controller, no queue, nothing that would have to
+    // live in the service. lib/hubspot.js holds them, beside lib/sendgrid.js
+    // and lib/twilio.js, which are the same kind of thing — vendor clients for
+    // accounts DRAWBRIDGE holds rather than ones a merchant connects.
+    contacts,
     email: {
       digest: {},
       // To organization members. NEVER suppressed and never billed: an
@@ -1284,6 +1496,17 @@ var drawbridge_default2 = {
   icon: drawbridge_default,
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
+  // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
+  //
+  // `requires` gates AVAILABILITY: a name in it that is unset removes the whole
+  // connection. This one is private and contributes every base workflow step —
+  // email.send, sms.send, segment.sync — so gating it on a CRM token would take
+  // all of them away from any deployment without a HubSpot portal, to protect a
+  // sync that is best-effort and already no-ops without a token.
+  //
+  // The test 'a vendor is only available when its environment is configured'
+  // caught exactly that: availableConnections({}) went from [ 'drawbridge' ] to
+  // empty the moment this was added.
   requires: [],
   slug: "drawbridge",
   // Always on. There is no credential that could go bad and no configuration a
@@ -1407,251 +1630,6 @@ var drawbridge_default2 = {
   title: "Drawbridge"
 };
 
-// lib/http.js
-var DEFAULT_TIMEOUT_MS = 15e3;
-var request = async ({
-  body,
-  headers = {},
-  method = "GET",
-  query,
-  timeout = DEFAULT_TIMEOUT_MS,
-  type = "json",
-  url
-}) => {
-  const fullUrl = new URL(url);
-  if (query) {
-    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
-  }
-  ;
-  const isForm = type === "form";
-  const response = await fetch(fullUrl.toString(), {
-    method,
-    headers: {
-      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
-      ...headers
-    },
-    signal: AbortSignal.timeout(timeout),
-    ...body !== void 0 && {
-      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
-    }
-  });
-  if (!response.ok) {
-    const text2 = await response.text().catch(() => "");
-    const error = new Error(text2 || response.statusText);
-    error.status = response.status;
-    throw error;
-  }
-  ;
-  const text = await response.text();
-  try {
-    return text ? JSON.parse(text) : null;
-  } catch {
-    return null;
-  }
-};
-
-// lib/connections/hubspot.js
-var HUBSPOT_BASE = "https://api.hubapi.com";
-var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
-  return (fetcher || request)({
-    body,
-    headers: {
-      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
-    },
-    method,
-    query,
-    url: HUBSPOT_BASE + path
-  });
-};
-var UTM_PROPERTIES = {
-  campaign: "utm_campaign",
-  content: "utm_content",
-  id: "utm_id",
-  medium: "utm_medium",
-  source: "utm_source",
-  term: "utm_term"
-};
-var CLICK_PROPERTIES = {
-  fbclid: "hs_facebook_click_id",
-  gclid: "hs_google_click_id",
-  liFatId: "hs_linkedin_click_id",
-  msclkid: "hs_bing_click_id",
-  ttclid: "hs_tiktok_click_id"
-};
-var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
-var isUtmProperty = (key) => DROPPABLE.has(key);
-var toProperties = ({ email, firstName, lastName, utm }) => {
-  var _a;
-  const properties = {};
-  if (email !== void 0) properties.email = email;
-  if (firstName !== void 0) properties.firstname = firstName;
-  if (lastName !== void 0) properties.lastname = lastName;
-  if (utm) {
-    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
-      if (utm[key]) properties[property] = utm[key];
-    }
-    ;
-    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
-      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
-    }
-    ;
-  }
-  ;
-  return properties;
-};
-var send = async ({ doc, fetcher, method, path, token }) => {
-  const properties = toProperties(doc);
-  try {
-    return await hubspotRequest({
-      body: { properties },
-      fetcher,
-      method,
-      path,
-      token
-    });
-  } catch (error) {
-    const enriched = Object.keys(properties).some(isUtmProperty);
-    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
-    return await hubspotRequest({
-      body: {
-        properties: Object.fromEntries(
-          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
-        )
-      },
-      fetcher,
-      method,
-      path,
-      token
-    });
-  }
-};
-var lookup = async ({ email, fetcher, token }) => {
-  var _a, _b;
-  if (!token || !email) return;
-  try {
-    const body = await hubspotRequest({
-      body: {
-        filterGroups: [
-          {
-            filters: [
-              {
-                operator: "EQ",
-                propertyName: "email",
-                value: email
-              }
-            ]
-          }
-        ],
-        limit: 1,
-        properties: ["email"]
-      },
-      fetcher,
-      method: "POST",
-      path: "/crm/v3/objects/contacts/search",
-      token
-    });
-    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
-  } catch (error) {
-  }
-};
-var hubspot_default = {
-  auth: {
-    // A Private App token from our own portal. Nothing to connect, nothing to
-    // consent to, and no merchant involved.
-    type: "none"
-  },
-  content: {
-    confirm: "This connection is part of Drawbridge and cannot be disconnected.",
-    description: [
-      "Drawbridge keeps its own HubSpot portal in step with account signups, so the campaign a customer arrived on is on their contact record."
-    ],
-    excerpt: "Drawbridge's own CRM sync.",
-    guide: [
-      "Nothing to do. This is internal to Drawbridge."
-    ]
-  },
-  exclusive: false,
-  fields: [],
-  group: "contacts",
-  hooks: {
-    auth: {
-      connect: false,
-      disconnect: false,
-      probe: false,
-      scopes: false,
-      token: false
-    },
-    commerce: false,
-    contacts: {
-      // FORGET A CONTACT, by id or by email. Account deletion — the caller had
-      // to search then remove, which is one round trip it should not have to
-      // know about.
-      remove: async ({ email, fetcher, id, token }) => {
-        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-        if (!key) return;
-        const contact = id || await lookup({ email, fetcher, token: key });
-        if (!contact) return;
-        return hubspotRequest({
-          fetcher,
-          method: "DELETE",
-          path: "/crm/v3/objects/contacts/" + contact,
-          token: key
-        });
-      },
-      // Connect an account to its contact by email, creating it if absent, and
-      // return the contact id. Unlike SendGrid, HubSpot renames a contact's
-      // email in place, so an email change is a plain PATCH on the cached id —
-      // no delete-old-then-create-new.
-      //
-      // Prefer the cached hubspotId; fall back to a search; create last.
-      sync: async ({ doc, fetcher, token }) => {
-        var _a, _b;
-        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-        if (!key) return;
-        if (doc == null ? void 0 : doc.hubspotId) {
-          try {
-            return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
-          } catch (error) {
-            if ((error == null ? void 0 : error.status) !== 404) throw error;
-          }
-        }
-        const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
-        return (_b = await send({
-          doc,
-          fetcher,
-          method: existing ? "PATCH" : "POST",
-          path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
-          token: key
-        })) == null ? void 0 : _b.id;
-      }
-    },
-    email: false,
-    inbound: false,
-    lifecycle: false,
-    resources: {
-      audiences: false,
-      prices: false,
-      products: false,
-      promotions: false
-    },
-    segment: false,
-    sms: false,
-    webhook: false
-  },
-  icon: drawbridge_default,
-  // Borrowed: the Drawbridge mark, because this is ours and never rendered.
-  private: true,
-  // Absent the token the hooks no-op, so a deployment without a portal simply
-  // contributes nothing rather than failing.
-  requires: ["HUBSPOT_ACCESS_TOKEN"],
-  slug: "hubspot",
-  status: () => "active",
-  // No workflow steps. The hooks are called by the user stream, not the builder.
-  steps: {},
-  tasks: () => [],
-  title: "HubSpot"
-};
-
 // lib/connections/icons/klaviyo.js
 var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="white"/>
@@ -2113,46 +2091,59 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 </svg>`;
 
 // lib/connections/mailchimp.js
-var base = (apiKey) => {
-  const dc = String(apiKey || "").split("-").pop();
-  if (!dc || dc === apiKey) throw new Error("That Mailchimp key carries no data centre suffix, so there is no host to call");
+var base = (dc) => {
+  if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
   return "https://" + dc + ".api.mailchimp.com/3.0";
 };
 var mailchimp_default2 = {
-  // Keys TODAY. Mailchimp integrations authenticate with OAuth 2 (authorization
-  // code) and that is where this goes, so the endpoints are recorded here
-  // rather than researched again later:
+  // OAUTH 2, authorization code. Every url below is quoted from
+  // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
+  // than remembered.
   //
-  //   authorize  https://login.mailchimp.com/oauth2/authorize
-  //   token      https://login.mailchimp.com/oauth2/token
-  //   metadata   https://login.mailchimp.com/oauth2/metadata
+  // THE METADATA CALL IS MAILCHIMP'S QUIRK and cannot be skipped: an access
+  // token alone cannot call the Marketing API, because every account lives
+  // behind a data-centre prefix (us1, us19...) that only GET
+  // login.mailchimp.com/oauth2/metadata returns — and every subsequent request
+  // needs it in the HOST. That is why auth.connect below is a real function:
+  // the standard exchange does not know where to send anything afterwards.
   //
-  // The metadata call is Mailchimp's quirk and cannot be skipped: the access
-  // token alone is not enough to call the Marketing API, because every account
-  // lives behind a data-centre prefix (us1, us19...) that only that call
-  // returns and every subsequent request needs in its host. No PKCE.
+  // No PKCE. No scopes — the docs describe none. And no refresh token: "Mailchimp
+  // Marketing access tokens do not expire, so you don't need to use a
+  // refresh_token", so tokenSettings stores no expiry and isStale reads that as
+  // nothing to refresh toward.
   //
-  // Switching is filling in auth.oauth and moving the apiKey field out. It is
-  // still a publish -- a manifest change always is -- but a value change
-  // rather than a shape one.
+  // auth.token stays false: the exchange is POST form-encoded with grant_type,
+  // client_id, client_secret, redirect_uri and code, which is exactly the
+  // runner's default — nothing to wrap.
   auth: {
-    type: "keys"
+    oauth: {
+      client: {
+        id: "MAILCHIMP_OAUTH_CLIENT_ID",
+        secret: "MAILCHIMP_OAUTH_CLIENT_SECRET"
+      },
+      urls: {
+        authorize: "https://login.mailchimp.com/oauth2/authorize",
+        redirect: "/api/connection/mailchimp/callback",
+        token: "https://login.mailchimp.com/oauth2/token"
+      }
+    },
+    type: "oauth"
   },
   // EVERYTHING A MERCHANT READS. `errors` belongs in here rather than at the
   // top level because the connection DOCUMENT carries its own `errors` array
   // and the document is spread OVER the resolved manifest downstream — a
   // top-level one would be replaced by that array and never render.
   content: {
-    confirm: "Disconnecting removes your stored Mailchimp key. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
+    confirm: "Disconnecting removes Drawbridge's stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
     description: [
       "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
-      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so a key stored here does nothing today."
+      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships."
     ],
     excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
     guide: [
-      "In Mailchimp, open Account & billing, then Extras, then API keys.",
-      "Create a key and copy it.",
-      "Paste it here. The key ends in a data-centre suffix like -us19, which tells Drawbridge which Mailchimp server your account is on."
+      "Press Connect. Drawbridge sends you to Mailchimp to approve access.",
+      "Sign in to Mailchimp if you are not already, and choose the account to connect.",
+      "You come back here to pick the audience your contacts should sync into."
     ]
   },
   // Mailchimp and SendGrid shared a group while they were SENDERS, where an org
@@ -2162,15 +2153,6 @@ var mailchimp_default2 = {
   exclusive: false,
   feature: "organization:connection:mailchimp",
   fields: [
-    {
-      input: "password",
-      key: "apiKey",
-      label: "Mailchimp API key",
-      message: "Your Mailchimp API key",
-      placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022-us1",
-      redact: true,
-      required: true
-    },
     {
       input: "select",
       key: "audience",
@@ -2189,16 +2171,45 @@ var mailchimp_default2 = {
   // contacts.sync are the first to flip.
   hooks: {
     auth: {
-      // Implemented outside this package: storing a typed key needs no vendor
-      // call, so the api's own form handler does it.
-      connect: {},
-      disconnect: {},
+      // WHERE THE ACCOUNT LIVES. Not enrichment — without this the connection
+      // is unusable, because the Marketing API host is per-account and only
+      // this call knows it. The callback merges what this returns into the
+      // stored settings, which is how `dc` reaches every later request.
+      //
+      // The header here is `OAuth <token>`, not Bearer — that is specific to
+      // the metadata endpoint. Marketing API calls take Bearer; see the
+      // audiences hook.
+      connect: async ({ fetcher = fetch, tokens }) => {
+        const response = await fetcher("https://login.mailchimp.com/oauth2/metadata", {
+          headers: {
+            authorization: "OAuth " + (tokens == null ? void 0 : tokens.accessToken)
+          },
+          signal: AbortSignal.timeout(15e3)
+        });
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp would not say which data centre this account is on (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        if (!(body == null ? void 0 : body.dc)) throw new Error("Mailchimp returned no data centre for this account");
+        return { dc: body.dc };
+      },
+      // Nothing to call. A merchant revokes Drawbridge from Mailchimp's own
+      // Authorized Apps page; the docs describe no revocation endpoint for us
+      // to call on their behalf.
+      disconnect: false,
       probe: false,
       scopes: false,
-      // Keys today. When Mailchimp's OAuth lands this becomes a wrapper that
-      // follows the exchange with /oauth2/metadata — the data-centre call that
-      // is the whole reason its OAuth cannot be pure configuration.
-      token: false
+      // The plain exchange. Mailchimp takes the client as FORM FIELDS
+      // (grant_type, client_id, client_secret, redirect_uri, code), which is
+      // the runner's default — so no `basic : true` as Klaviyo needs.
+      //
+      // build() requires an oauth manifest to name this explicitly rather than
+      // letting it default, which caught this file declaring `false` on the
+      // first import after the conversion.
+      token: authToken
     },
     commerce: false,
     contacts: { remove: false, sync: false },
@@ -2220,15 +2231,14 @@ var mailchimp_default2 = {
       // successful — the same silent truncation Klaviyo has, at a different
       // number. Paged against total_items so an account past a thousand still
       // resolves.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings }) => {
-        const key = settings == null ? void 0 : settings.apiKey;
+      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
+        const dc = settings == null ? void 0 : settings.dc;
         const count = Math.min(limit, 1e3);
         const offset = Number(cursor || 0);
         const response = await fetcher(
-          base(key) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          base(dc) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           {
-            // Basic with any username — Mailchimp reads only the password half.
-            headers: { authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64") },
+            headers: { authorization: "Bearer " + token },
             signal: AbortSignal.timeout(15e3)
           }
         );
@@ -2260,6 +2270,13 @@ var mailchimp_default2 = {
     webhook: false
   },
   icon: mailchimp_default,
+  // The OAuth client this deployment registered. Without both, the vendor drops
+  // out of availableConnections rather than offering a Connect button that
+  // cannot complete.
+  requires: [
+    "MAILCHIMP_OAUTH_CLIENT_ID",
+    "MAILCHIMP_OAUTH_CLIENT_SECRET"
+  ],
   slug: "mailchimp",
   // A key with no audience chosen is authenticated and inert. Mailchimp also
   // needs its merge fields created on that audience before any Drawbridge total
@@ -2413,10 +2430,29 @@ var shopify_default2 = {
       // re-registers rather than answering "is this token still good", and
       // scope drift is its own hook because a token can be perfectly valid
       // while the grant is too narrow.
-      connect: {},
-      disconnect: {},
+      //
+      // connect and disconnect are FALSE rather than `{}`: there is nothing to
+      // call on either side. The install already hands the callback everything
+      // it stores, and a Shopify grant is withdrawn by UNINSTALLING the app in
+      // Shopify admin — which Drawbridge learns about from the app_uninstalled
+      // webhook rather than by asking. `{}` claimed a body implemented
+      // elsewhere; none exists, and none could.
+      connect: false,
+      disconnect: false,
       probe: false,
-      scopes: {},
+      // WHETHER THE GRANT IS STILL WIDE ENOUGH. A token can be perfectly valid
+      // and still too narrow — a deploy that adds a scope leaves every existing
+      // install short of it, and no webhook fires to say so.
+      //
+      // The comparison is the vendor's, so it belongs here. Reading WHICH
+      // scopes a store granted is not: that lives in the `shop` collection and
+      // needs a controller, which is precisely what a hook in a published
+      // package must not be handed. The caller reads the grant and passes the
+      // string; this answers what is missing from it.
+      //
+      // `shopify` is injected for the same reason it is everywhere else — this
+      // package cannot import @drawbridge/shopify, which depends on it.
+      scopes: ({ scope, shopify }) => scope ? shopify.oauth.missingScopes(scope) : null,
       // Shopify's install grant is exchanged inside its own app flow, not
       // through the shared OAuth runner.
       token: false
@@ -2879,10 +2915,12 @@ var webhook_default = {
   // connect generates a secret rather than proving a credential.
   hooks: {
     auth: {
-      // Minting and clearing a secret needs no vendor call, so the api's own
-      // handler does both.
-      connect: {},
-      disconnect: {},
+      // FALSE, NOT {}. There is no vendor here at all — connecting mints a
+      // secret and disconnecting clears it, both done by the api's own
+      // handler. `{}` would promise a body implemented elsewhere, and none
+      // exists or could.
+      connect: false,
+      disconnect: false,
       probe: false,
       scopes: false,
       // Nothing to mint. Connecting generates a secret; there is no vendor.
@@ -3127,7 +3165,6 @@ var stepLabels = (catalog = connections) => Object.fromEntries(
 var connections = Object.freeze({
   attentive: build(attentive_default2),
   drawbridge: build(drawbridge_default2),
-  hubspot: build(hubspot_default),
   klaviyo: build(klaviyo_default2),
   mailchimp: build(mailchimp_default2),
   shopify: build(shopify_default2),