@drawbridge/drawbridge-utils 0.0.115 → 0.0.117

package/dist/connections/index.d.cts

@@ -1,7 +1,7 @@
 import { authToken } from './oauth.cjs';
 export { consentUrl, pkcePair } from './oauth.cjs';
-import { channels } from '../pricing.cjs';
 import { request } from '../http.cjs';
+import { channels } from '../pricing.cjs';
 import crypto, { createHmac, timingSafeEqual } from 'node:crypto';
 import { safeRequest } from '../safe-http.cjs';
 import '../plans.cjs';
@@ -603,7 +603,13 @@ var attentive = {
 	// connection DOCUMENT carries its own `errors` array and is spread OVER the
 	// resolved manifest downstream, so a top-level one would never render.
 	content : {
-		confirm : 'Disconnecting revokes Drawbridge\'s access to your Attentive account. Your subscribers stay in both Attentive and Drawbridge — neither list is deleted.',
+		// SAYS WHAT ACTUALLY HAPPENS. This used to promise that disconnecting
+		// revokes Drawbridge's access, and it cannot: Attentive documents no
+		// revocation endpoint, and their authentication page states an access
+		// token "does not expire". So the grant survives a disconnect forever
+		// unless the merchant removes the integration at Attentive, and the copy
+		// has to say so rather than let them believe otherwise.
+		confirm : 'Disconnecting removes Drawbridge\'s stored Attentive token. Attentive does not offer a way for us to revoke it, so remove the Drawbridge integration in Attentive as well if you want its access fully withdrawn. Your subscribers stay in both Attentive and Drawbridge — neither list is deleted.',
 		description : [
 			'Attentive is where your SMS marketing lives, and this connection is becoming the way your Drawbridge contacts sync into an Attentive segment.',
 			'You authorize Drawbridge from inside Attentive and can revoke that access there at any time. Drawbridge never sees or stores your Attentive password.',
@@ -645,8 +651,15 @@ var attentive = {
 			// account-identity endpoint to enrich them with — Klaviyo's connect
 			// reads the account name back; this has nothing cited to read. The
 			// callback stores the tokens and skips enrichment on `unimplemented`.
-			connect : {},
-			disconnect : {},
+			// FALSE, NOT {}. `{}` means "supported, implemented in the repo with the
+			// dependencies", and nothing anywhere implements either of these —
+			// there is nothing for them to do. The exchange already yields the
+			// tokens and Attentive documents no account-identity endpoint to
+			// enrich them with, so connect has nothing to add; and they document
+			// no revocation endpoint at all, so disconnect has nothing to call.
+			// Recorded as a decision rather than left as an unkept promise.
+			connect : false,
+			disconnect : false,
 			probe : false,
 			scopes : false,
 			// THE ONE THING WRAPPED, and it is about the response rather than the
@@ -762,231 +775,18 @@ var attentive = {
 	title : 'Attentive'
 };
 
-// Drawbridge, exported from the brand kit and left as authored — the fills are the
-// vendor's own mark, not a recolour.
-//
-// A .js wrapper around otherwise untouched SVG so `node --test` can run against
-// lib/ directly. A bare .svg import would need a bundler loader and force the
-// tests onto dist/, which is a worse trade than one line of wrapper.
-var icon$3 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="#BAEC5F"/>
-<g clip-path="url(#clip0_2115_2832)">
-<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
-</g>
-<defs>
-<clipPath id="clip0_2115_2832">
-<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
-</clipPath>
-</defs>
-</svg>`;
-
-// Drawbridge itself — the PRIVATE connection.
+// DRAWBRIDGE'S OWN HUBSPOT PORTAL, kept in step with account signups so the
+// campaign a customer arrived on is on their contact record.
 //
-// Nobody connects this. There is no credential, no consent, and no card on the
-// connections page. It exists because a workflow step points at a hook, and the
-// six most common steps — sending an email, alerting a member, syncing a segment
-// — are things Drawbridge does rather than things a vendor does.
-//
-// Before this, those steps were the exception: every other step resolved through
-// a manifest and these resolved through a hardcoded registry in drawbridge-sync.
-// One exception is all it takes for "every step is a declaration pointing at a
-// hook" to stop being a rule somebody can rely on.
+// It sits beside lib/sendgrid.js and lib/twilio.js because it is the same kind
+// of thing: a vendor client for an account DRAWBRIDGE holds, not one a merchant
+// connects. It used to be a connection manifest of its own, which read as though
+// HubSpot were a vendor a merchant could pick — it never was, and the slug is
+// better kept free for the day a merchant-facing HubSpot connection exists.
 //
-// PRIVATE is a real distinction, not a flag to hide a card. A public connection
-// answers "can this merchant connect it" through `requires` and a plan feature.
-// A private one is always present, in every deployment, for every organization —
-// so it declares neither, and build() knows not to ask.
-var drawbridge = {
-	auth : {
-		type : 'none'
-	},
-	content : {
-		confirm : 'This connection is part of Drawbridge and cannot be disconnected.',
-		description : [
-			'Drawbridge sends your notification email and SMS, keeps your segments in sync, and posts to your own endpoints. These are built in rather than connected, so there is nothing here to set up.'
-		],
-		excerpt : 'The steps Drawbridge runs itself.',
-		guide : [
-			'Nothing to do. These steps are available in every workflow builder.'
-		]
-	},
-	exclusive : false,
-	fields : [],
-	group : 'developer',
-	// EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
-	// suppression collection and the queues; segment sync needs the streams. A
-	// published package carrying those makes every consumer carry them, which is
-	// the reason `{}` exists as an answer.
-	hooks : {
-		auth : {
-			// Nothing to connect, revoke, probe or re-scope.
-			connect : false,
-			disconnect : false,
-			probe : false,
-			scopes : false,
-			token : false
-		},
-		commerce : false,
-		contacts : { remove : false, sync : false },
-		email : {
-			digest : {},
-			// To organization members. NEVER suppressed and never billed: an
-			// entrant's opt-out must not silence an alert to staff, and staff mail is
-			// not a metered send.
-			notify : {},
-			// To a lead. Suppression applies and the send is billed.
-			send : {}
-		},
-		inbound : false,
-		lifecycle : false,
-		resources : {
-			audiences : false,
-			prices : false,
-			products : false,
-			promotions : false
-		},
-		segment : { sync : {} },
-		sms : { send : {} },
-		webhook : false
-	},
-	icon: icon$3,
-	// PRIVATE: never in the catalog, always available to the builder.
-	private : true,
-	requires : [],
-	slug : 'drawbridge',
-	// Always on. There is no credential that could go bad and no configuration a
-	// merchant could leave half-finished.
-	status : () => 'active',
-	// DERIVED FROM drawbridge-api/lib/workflows.js, not invented. Every value
-	// below — trigger, billable, settings — is what that catalog and the workflow
-	// route already enforce today, because this replaces them rather than
-	// competing with them.
-	//
-	// NOT HERE, deliberately:
-	//
-	//   step.segment.sync  a SYSTEM step, dispatched by drawbridge-sync rather
-	//                      than offered in the builder. It fans out, so the shell
-	//                      opens its step document and the chunks close it.
-	steps : {
-
-		email : {
-
-			// SCHEDULE-TRIGGERED, not lead-triggered: it is offered under Daily,
-			// Weekly and Monthly. Those triggers had offered no steps at all, so a
-			// scheduled workflow was selectable and inert until this landed.
-			digest : () => ({
-				hook : 'email.digest',
-				key : 'Email — Digest',
-				queue : 'notification',
-				settings : {
-					// The organization OWNER is always a recipient, resolved in sync,
-					// so this is additional recipients rather than the list. It cannot
-					// be required: the members endpoint is owner-gated and the owner is
-					// not a member document, so a solo merchant has nothing to pick and
-					// could never save the step.
-					members : { of : 'string', type : 'array' },
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
-				},
-				triggers : [ 'schedule.day', 'schedule.week', 'schedule.month' ],
-				usage : { actions : 0 }
-			}),
-
-			// To organization MEMBERS. Never suppressed — an entrant's opt-out must
-			// not silence an alert to staff — and not billed.
-			notify : () => ({
-				hook : 'email.notify',
-				key : 'Email — Notification',
-				queue : 'notification',
-				settings : {
-					members : { of : 'string', type : 'array' },
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
-				},
-				triggers : [ 'lead.insert' ],
-				// Zero is a PRICE, and a deliberate one. Declared rather than omitted
-				// so "this is free" and "nobody decided" stay different statements;
-				// completeStep bills only when actions > 0.
-				usage : { actions : 0 }
-			}),
-
-			// To a LEAD. Suppression applies and the send is billed.
-			send : () => ({
-				hook : 'email.send',
-				key : 'Email — Send email',
-				queue : 'notification',
-				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
-				},
-				triggers : [ 'lead.insert' ],
-				// ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
-				// customer-facing number; the handler read it too, so the same fact
-				// was stated in two places and only one of them was reviewed.
-				usage : { actions : channels.email.actionsPerSend }
-			})
-
-		},
-
-		// WITHDRAWN, which is a third thing from builder and system: declared,
-		// routed and runnable, but never offered.
-		//
-		// It went when the twilio connection did — a connection-gated step with no
-		// connection to gate on could only ever render permanently disabled. Stored
-		// workflows still carry it, so it must keep running, and enums.step.type
-		// keeps it for the same reason.
-		//
-		// NO TRIGGERS is what keeps it out of the builder: the catalog derives from
-		// triggers, so a step with none is unreachable by a merchant without a
-		// second list saying so.
-		//
-		// Platform SMS returns as a base step the way email did. That is this entry
-		// gaining triggers, not a new one.
-		sms : {
-
-			send : () => ({
-				hook : 'sms.send',
-				key : 'Send an SMS',
-				queue : 'notification',
-				settings : {
-					message : { required : true, type : 'string' },
-					subject : { required : true, type : 'string' }
-				},
-				// Priced per SEGMENT and billed from the first, which the send
-				// resolves from the message length. This is the floor.
-				usage : { actions : channels.sms.actionsPerSegment },
-				withdrawn : true
-			})
-
-		},
-
-		segment : {
-
-			// FANS OUT. It evaluates every contact in the organization against every
-			// segment, which is too much for one job — so the hook returns chunks and
-			// the shell defers completion: openStep writes the document with a slot
-			// per chunk, and whichever chunk lands last closes it and resumes the
-			// chain.
-			//
-			// It carries a hook like every other step. An earlier version declared
-			// none, on the theory that fan-out was a second protocol the shell could
-			// not run; it is the same protocol with the ending deferred, and a step
-			// declaring no hook is silently SKIPPED by the runner.
-			sync : () => ({
-				description : 'Recalculates segment membership on a daily schedule.',
-				hook : 'segment.sync',
-				key : 'Segment Sync',
-				queue : 'segment',
-				system : true
-			})
+// The hooks are wired into the private `drawbridge` manifest's contacts slot;
+// drawbridge-sync's user stream calls them by that name.
 
-		}
-
-	},
-	tasks : () => [],
-	title : 'Drawbridge'
-};
 
 // HubSpot — PRIVATE, and Drawbridge's own CRM rather than a merchant's.
 //
@@ -1207,35 +1007,7 @@ const lookup = async ({ email, fetcher, token }) => {
 
 };
 
-var hubspot = {
-	auth : {
-		// A Private App token from our own portal. Nothing to connect, nothing to
-		// consent to, and no merchant involved.
-		type : 'none'
-	},
-	content : {
-		confirm : 'This connection is part of Drawbridge and cannot be disconnected.',
-		description : [
-			'Drawbridge keeps its own HubSpot portal in step with account signups, so the campaign a customer arrived on is on their contact record.'
-		],
-		excerpt : 'Drawbridge\'s own CRM sync.',
-		guide : [
-			'Nothing to do. This is internal to Drawbridge.'
-		]
-	},
-	exclusive : false,
-	fields : [],
-	group : 'contacts',
-	hooks : {
-		auth : {
-			connect : false,
-			disconnect : false,
-			probe : false,
-			scopes : false,
-			token : false
-		},
-		commerce : false,
-		contacts : {
+const contacts = {
 
 			// FORGET A CONTACT, by id or by email. Account deletion — the caller had
 			// to search then remove, which is one round trip it should not have to
@@ -1301,8 +1073,92 @@ var hubspot = {
 
 			}
 
+};
+
+// Drawbridge, exported from the brand kit and left as authored — the fills are the
+// vendor's own mark, not a recolour.
+//
+// A .js wrapper around otherwise untouched SVG so `node --test` can run against
+// lib/ directly. A bare .svg import would need a bundler loader and force the
+// tests onto dist/, which is a worse trade than one line of wrapper.
+var icon$3 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#BAEC5F"/>
+<g clip-path="url(#clip0_2115_2832)">
+<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
+<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
+</g>
+<defs>
+<clipPath id="clip0_2115_2832">
+<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
+</clipPath>
+</defs>
+</svg>`;
+
+// Drawbridge itself — the PRIVATE connection.
+//
+// Nobody connects this. There is no credential, no consent, and no card on the
+// connections page. It exists because a workflow step points at a hook, and the
+// six most common steps — sending an email, alerting a member, syncing a segment
+// — are things Drawbridge does rather than things a vendor does.
+//
+// Before this, those steps were the exception: every other step resolved through
+// a manifest and these resolved through a hardcoded registry in drawbridge-sync.
+// One exception is all it takes for "every step is a declaration pointing at a
+// hook" to stop being a rule somebody can rely on.
+//
+// PRIVATE is a real distinction, not a flag to hide a card. A public connection
+// answers "can this merchant connect it" through `requires` and a plan feature.
+// A private one is always present, in every deployment, for every organization —
+// so it declares neither, and build() knows not to ask.
+var drawbridge = {
+	auth : {
+		type : 'none'
+	},
+	content : {
+		confirm : 'This connection is part of Drawbridge and cannot be disconnected.',
+		description : [
+			'Drawbridge sends your notification email and SMS, keeps your segments in sync, and posts to your own endpoints. These are built in rather than connected, so there is nothing here to set up.'
+		],
+		excerpt : 'The steps Drawbridge runs itself.',
+		guide : [
+			'Nothing to do. These steps are available in every workflow builder.'
+		]
+	},
+	exclusive : false,
+	fields : [],
+	group : 'developer',
+	// EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
+	// suppression collection and the queues; segment sync needs the streams. A
+	// published package carrying those makes every consumer carry them, which is
+	// the reason `{}` exists as an answer.
+	hooks : {
+		auth : {
+			// Nothing to connect, revoke, probe or re-scope.
+			connect : false,
+			disconnect : false,
+			probe : false,
+			scopes : false,
+			token : false
+		},
+		commerce : false,
+		// DRAWBRIDGE'S OWN CRM. Not a merchant's — this keeps our HubSpot portal in
+		// step with account signups, and drawbridge-sync's user stream calls it.
+		//
+		// A real implementation here rather than `{}` because the bodies are pure
+		// HTTP against a token: no controller, no queue, nothing that would have to
+		// live in the service. lib/hubspot.js holds them, beside lib/sendgrid.js
+		// and lib/twilio.js, which are the same kind of thing — vendor clients for
+		// accounts DRAWBRIDGE holds rather than ones a merchant connects.
+		contacts,
+		email : {
+			digest : {},
+			// To organization members. NEVER suppressed and never billed: an
+			// entrant's opt-out must not silence an alert to staff, and staff mail is
+			// not a metered send.
+			notify : {},
+			// To a lead. Suppression applies and the send is billed.
+			send : {}
 		},
-		email : false,
 		inbound : false,
 		lifecycle : false,
 		resources : {
@@ -1311,22 +1167,157 @@ var hubspot = {
 			products : false,
 			promotions : false
 		},
-		segment : false,
-		sms : false,
+		segment : { sync : {} },
+		sms : { send : {} },
 		webhook : false
 	},
 	icon: icon$3,
-	// Borrowed: the Drawbridge mark, because this is ours and never rendered.
+	// PRIVATE: never in the catalog, always available to the builder.
 	private : true,
-	// Absent the token the hooks no-op, so a deployment without a portal simply
-	// contributes nothing rather than failing.
-	requires : [ 'HUBSPOT_ACCESS_TOKEN' ],
-	slug : 'hubspot',
+	// NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
+	//
+	// `requires` gates AVAILABILITY: a name in it that is unset removes the whole
+	// connection. This one is private and contributes every base workflow step —
+	// email.send, sms.send, segment.sync — so gating it on a CRM token would take
+	// all of them away from any deployment without a HubSpot portal, to protect a
+	// sync that is best-effort and already no-ops without a token.
+	//
+	// The test 'a vendor is only available when its environment is configured'
+	// caught exactly that: availableConnections({}) went from [ 'drawbridge' ] to
+	// empty the moment this was added.
+	requires : [],
+	slug : 'drawbridge',
+	// Always on. There is no credential that could go bad and no configuration a
+	// merchant could leave half-finished.
 	status : () => 'active',
-	// No workflow steps. The hooks are called by the user stream, not the builder.
-	steps : {},
+	// DERIVED FROM drawbridge-api/lib/workflows.js, not invented. Every value
+	// below — trigger, billable, settings — is what that catalog and the workflow
+	// route already enforce today, because this replaces them rather than
+	// competing with them.
+	//
+	// NOT HERE, deliberately:
+	//
+	//   step.segment.sync  a SYSTEM step, dispatched by drawbridge-sync rather
+	//                      than offered in the builder. It fans out, so the shell
+	//                      opens its step document and the chunks close it.
+	steps : {
+
+		email : {
+
+			// SCHEDULE-TRIGGERED, not lead-triggered: it is offered under Daily,
+			// Weekly and Monthly. Those triggers had offered no steps at all, so a
+			// scheduled workflow was selectable and inert until this landed.
+			digest : () => ({
+				hook : 'email.digest',
+				key : 'Email — Digest',
+				queue : 'notification',
+				settings : {
+					// The organization OWNER is always a recipient, resolved in sync,
+					// so this is additional recipients rather than the list. It cannot
+					// be required: the members endpoint is owner-gated and the owner is
+					// not a member document, so a solo merchant has nothing to pick and
+					// could never save the step.
+					members : { of : 'string', type : 'array' },
+					message : { required : true, type : 'string' },
+					subject : { required : true, type : 'string' }
+				},
+				triggers : [ 'schedule.day', 'schedule.week', 'schedule.month' ],
+				usage : { actions : 0 }
+			}),
+
+			// To organization MEMBERS. Never suppressed — an entrant's opt-out must
+			// not silence an alert to staff — and not billed.
+			notify : () => ({
+				hook : 'email.notify',
+				key : 'Email — Notification',
+				queue : 'notification',
+				settings : {
+					members : { of : 'string', type : 'array' },
+					message : { required : true, type : 'string' },
+					subject : { required : true, type : 'string' }
+				},
+				triggers : [ 'lead.insert' ],
+				// Zero is a PRICE, and a deliberate one. Declared rather than omitted
+				// so "this is free" and "nobody decided" stay different statements;
+				// completeStep bills only when actions > 0.
+				usage : { actions : 0 }
+			}),
+
+			// To a LEAD. Suppression applies and the send is billed.
+			send : () => ({
+				hook : 'email.send',
+				key : 'Email — Send email',
+				queue : 'notification',
+				settings : {
+					message : { required : true, type : 'string' },
+					subject : { required : true, type : 'string' }
+				},
+				triggers : [ 'lead.insert' ],
+				// ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
+				// customer-facing number; the handler read it too, so the same fact
+				// was stated in two places and only one of them was reviewed.
+				usage : { actions : channels.email.actionsPerSend }
+			})
+
+		},
+
+		// WITHDRAWN, which is a third thing from builder and system: declared,
+		// routed and runnable, but never offered.
+		//
+		// It went when the twilio connection did — a connection-gated step with no
+		// connection to gate on could only ever render permanently disabled. Stored
+		// workflows still carry it, so it must keep running, and enums.step.type
+		// keeps it for the same reason.
+		//
+		// NO TRIGGERS is what keeps it out of the builder: the catalog derives from
+		// triggers, so a step with none is unreachable by a merchant without a
+		// second list saying so.
+		//
+		// Platform SMS returns as a base step the way email did. That is this entry
+		// gaining triggers, not a new one.
+		sms : {
+
+			send : () => ({
+				hook : 'sms.send',
+				key : 'Send an SMS',
+				queue : 'notification',
+				settings : {
+					message : { required : true, type : 'string' },
+					subject : { required : true, type : 'string' }
+				},
+				// Priced per SEGMENT and billed from the first, which the send
+				// resolves from the message length. This is the floor.
+				usage : { actions : channels.sms.actionsPerSegment },
+				withdrawn : true
+			})
+
+		},
+
+		segment : {
+
+			// FANS OUT. It evaluates every contact in the organization against every
+			// segment, which is too much for one job — so the hook returns chunks and
+			// the shell defers completion: openStep writes the document with a slot
+			// per chunk, and whichever chunk lands last closes it and resumes the
+			// chain.
+			//
+			// It carries a hook like every other step. An earlier version declared
+			// none, on the theory that fan-out was a second protocol the shell could
+			// not run; it is the same protocol with the ending deferred, and a step
+			// declaring no hook is silently SKIPPED by the runner.
+			sync : () => ({
+				description : 'Recalculates segment membership on a daily schedule.',
+				hook : 'segment.sync',
+				key : 'Segment Sync',
+				queue : 'segment',
+				system : true
+			})
+
+		}
+
+	},
 	tasks : () => [],
-	title : 'HubSpot'
+	title : 'Drawbridge'
 };
 
 // Klaviyo, exported from the brand kit and left as authored — the fills are the
@@ -1931,15 +1922,16 @@ var icon$1 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 <path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
 </svg>`;
 
-// EVERY ACCOUNT LIVES BEHIND A DATA-CENTRE PREFIX, and the key carries it as a
-// suffix — `...-us19` means us19.api.mailchimp.com. There is no fixed host to
-// call, which is Mailchimp's oldest quirk and the reason its future OAuth flow
-// needs a metadata call the other vendors do not.
-const base = ( apiKey ) => {
-
-	const dc = String( apiKey || '' ).split( '-' ).pop();
+// EVERY ACCOUNT LIVES BEHIND A DATA-CENTRE PREFIX — us1, us19 — and there is no
+// fixed host to call. Mailchimp's oldest quirk, and the reason its OAuth needs a
+// metadata call the other vendors do not.
+//
+// Under keys the prefix was the key's own suffix (`...-us19`). Under OAuth it is
+// whatever auth.connect stored from /oauth2/metadata, which is why that hook is
+// not enrichment: without `dc` there is nowhere to send a request.
+const base = ( dc ) => {
 
-	if( ! dc || dc === apiKey ) throw new Error( 'That Mailchimp key carries no data centre suffix, so there is no host to call' );
+	if( ! dc ) throw new Error( 'This Mailchimp connection has no data centre stored, so there is no host to call' );
 
 	return 'https://' + dc + '.api.mailchimp.com/3.0';
 
@@ -1947,40 +1939,54 @@ const base = ( apiKey ) => {
 
 // Mailchimp — contact sync, not a sender.
 var mailchimp = {
-	// Keys TODAY. Mailchimp integrations authenticate with OAuth 2 (authorization
-	// code) and that is where this goes, so the endpoints are recorded here
-	// rather than researched again later:
+	// OAUTH 2, authorization code. Every url below is quoted from
+	// mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
+	// than remembered.
 	//
-	//   authorize  https://login.mailchimp.com/oauth2/authorize
-	//   token      https://login.mailchimp.com/oauth2/token
-	//   metadata   https://login.mailchimp.com/oauth2/metadata
+	// THE METADATA CALL IS MAILCHIMP'S QUIRK and cannot be skipped: an access
+	// token alone cannot call the Marketing API, because every account lives
+	// behind a data-centre prefix (us1, us19...) that only GET
+	// login.mailchimp.com/oauth2/metadata returns — and every subsequent request
+	// needs it in the HOST. That is why auth.connect below is a real function:
+	// the standard exchange does not know where to send anything afterwards.
 	//
-	// The metadata call is Mailchimp's quirk and cannot be skipped: the access
-	// token alone is not enough to call the Marketing API, because every account
-	// lives behind a data-centre prefix (us1, us19...) that only that call
-	// returns and every subsequent request needs in its host. No PKCE.
+	// No PKCE. No scopes — the docs describe none. And no refresh token: "Mailchimp
+	// Marketing access tokens do not expire, so you don't need to use a
+	// refresh_token", so tokenSettings stores no expiry and isStale reads that as
+	// nothing to refresh toward.
 	//
-	// Switching is filling in auth.oauth and moving the apiKey field out. It is
-	// still a publish -- a manifest change always is -- but a value change
-	// rather than a shape one.
+	// auth.token stays false: the exchange is POST form-encoded with grant_type,
+	// client_id, client_secret, redirect_uri and code, which is exactly the
+	// runner's default — nothing to wrap.
 	auth : {
-		type : 'keys'
+		oauth : {
+			client : {
+				id : 'MAILCHIMP_OAUTH_CLIENT_ID',
+				secret : 'MAILCHIMP_OAUTH_CLIENT_SECRET'
+			},
+			urls : {
+				authorize : 'https://login.mailchimp.com/oauth2/authorize',
+				redirect : '/api/connection/mailchimp/callback',
+				token : 'https://login.mailchimp.com/oauth2/token'
+			}
+		},
+		type : 'oauth'
 	},
 	// EVERYTHING A MERCHANT READS. `errors` belongs in here rather than at the
 	// top level because the connection DOCUMENT carries its own `errors` array
 	// and the document is spread OVER the resolved manifest downstream — a
 	// top-level one would be replaced by that array and never render.
 	content : {
-		confirm : 'Disconnecting removes your stored Mailchimp key. Your contacts stay in both Drawbridge and Mailchimp — neither list is deleted.',
+		confirm : 'Disconnecting removes Drawbridge\'s stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp — neither list is deleted.',
 		description : [
 			'Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.',
-			'This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so a key stored here does nothing today.'
+			'This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships.'
 		],
 		excerpt : 'Sync your Drawbridge contacts into a Mailchimp audience.',
 		guide : [
-			'In Mailchimp, open Account & billing, then Extras, then API keys.',
-			'Create a key and copy it.',
-			'Paste it here. The key ends in a data-centre suffix like -us19, which tells Drawbridge which Mailchimp server your account is on.'
+			'Press Connect. Drawbridge sends you to Mailchimp to approve access.',
+			'Sign in to Mailchimp if you are not already, and choose the account to connect.',
+			'You come back here to pick the audience your contacts should sync into.'
 		]
 	},
 	// Mailchimp and SendGrid shared a group while they were SENDERS, where an org
@@ -1990,15 +1996,6 @@ var mailchimp = {
 	exclusive : false,
 	feature : 'organization:connection:mailchimp',
 	fields : [
-		{
-			input : 'password',
-			key : 'apiKey',
-			label : 'Mailchimp API key',
-			message : 'Your Mailchimp API key',
-			placeholder : '••••••••••••••••••••••••••••••••-us1',
-			redact : true,
-			required : true
-		},
 		{
 			input : 'select',
 			key : 'audience',
@@ -2018,16 +2015,55 @@ var mailchimp = {
 	hooks : {
 
 		auth : {
-			// Implemented outside this package: storing a typed key needs no vendor
-			// call, so the api's own form handler does it.
-			connect : {},
-			disconnect : {},
+			// WHERE THE ACCOUNT LIVES. Not enrichment — without this the connection
+			// is unusable, because the Marketing API host is per-account and only
+			// this call knows it. The callback merges what this returns into the
+			// stored settings, which is how `dc` reaches every later request.
+			//
+			// The header here is `OAuth <token>`, not Bearer — that is specific to
+			// the metadata endpoint. Marketing API calls take Bearer; see the
+			// audiences hook.
+			connect : async ({ fetcher = fetch, tokens }) => {
+
+				const response = await fetcher( 'https://login.mailchimp.com/oauth2/metadata', {
+					headers : {
+						authorization : 'OAuth ' + tokens?.accessToken
+					},
+					signal : AbortSignal.timeout( 15000 )
+				});
+
+				if( ! response.ok ){
+
+					throw Object.assign(
+						new Error( 'Mailchimp would not say which data centre this account is on (' + response.status + ')' ),
+						{ status : response.status }
+					);
+
+				}
+
+				const body = await response.json();
+
+				// No dc means no host to call. Failing here is better than storing a
+				// connection that reads Active and 404s on its first request.
+				if( ! body?.dc ) throw new Error( 'Mailchimp returned no data centre for this account' );
+
+				return { dc : body.dc };
+
+			},
+			// Nothing to call. A merchant revokes Drawbridge from Mailchimp's own
+			// Authorized Apps page; the docs describe no revocation endpoint for us
+			// to call on their behalf.
+			disconnect : false,
 			probe : false,
 			scopes : false,
-			// Keys today. When Mailchimp's OAuth lands this becomes a wrapper that
-			// follows the exchange with /oauth2/metadata — the data-centre call that
-			// is the whole reason its OAuth cannot be pure configuration.
-			token : false
+			// The plain exchange. Mailchimp takes the client as FORM FIELDS
+			// (grant_type, client_id, client_secret, redirect_uri, code), which is
+			// the runner's default — so no `basic : true` as Klaviyo needs.
+			//
+			// build() requires an oauth manifest to name this explicitly rather than
+			// letting it default, which caught this file declaring `false` on the
+			// first import after the conversion.
+			token : authToken
 		},
 		commerce : false,
 		contacts : { remove : false, sync : false },
@@ -2050,18 +2086,21 @@ var mailchimp = {
 			// successful — the same silent truncation Klaviyo has, at a different
 			// number. Paged against total_items so an account past a thousand still
 			// resolves.
-			audiences : async ({ cursor, fetcher = fetch, limit = 100, search, settings }) => {
+			audiences : async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
 
-				const key = settings?.apiKey;
+				// Bearer, not Basic. Mailchimp's fundamentals doc states "API keys and
+				// OAuth 2 tokens can be used to make authenticated requests the same
+				// way", so one header serves both — the Basic form this used under
+				// keys was never OAuth-compatible.
+				const dc = settings?.dc;
 
 				const count = Math.min( limit, 1000 );
 				const offset = Number( cursor || 0 );
 
 				const response = await fetcher(
-					base( key ) + '/lists?count=' + count + '&offset=' + offset + '&fields=lists.id,lists.name,total_items',
+					base( dc ) + '/lists?count=' + count + '&offset=' + offset + '&fields=lists.id,lists.name,total_items',
 					{
-						// Basic with any username — Mailchimp reads only the password half.
-						headers : { authorization : 'Basic ' + Buffer.from( 'drawbridge:' + key ).toString( 'base64' ) },
+						headers : { authorization : 'Bearer ' + token },
 						signal : AbortSignal.timeout( 15000 )
 					}
 				);
@@ -2111,6 +2150,13 @@ var mailchimp = {
 		webhook : false
 	},
 	icon: icon$1,
+	// The OAuth client this deployment registered. Without both, the vendor drops
+	// out of availableConnections rather than offering a Connect button that
+	// cannot complete.
+	requires : [
+		'MAILCHIMP_OAUTH_CLIENT_ID',
+		'MAILCHIMP_OAUTH_CLIENT_SECRET'
+	],
 	slug : 'mailchimp',
 	// A key with no audience chosen is authenticated and inert. Mailchimp also
 	// needs its merge fields created on that audience before any Drawbridge total
@@ -2322,10 +2368,30 @@ var shopify = {
 			// re-registers rather than answering "is this token still good", and
 			// scope drift is its own hook because a token can be perfectly valid
 			// while the grant is too narrow.
-			connect : {},
-			disconnect : {},
+			//
+			// connect and disconnect are FALSE rather than `{}`: there is nothing to
+			// call on either side. The install already hands the callback everything
+			// it stores, and a Shopify grant is withdrawn by UNINSTALLING the app in
+			// Shopify admin — which Drawbridge learns about from the app_uninstalled
+			// webhook rather than by asking. `{}` claimed a body implemented
+			// elsewhere; none exists, and none could.
+			connect : false,
+			disconnect : false,
 			probe : false,
-			scopes : {},
+
+			// WHETHER THE GRANT IS STILL WIDE ENOUGH. A token can be perfectly valid
+			// and still too narrow — a deploy that adds a scope leaves every existing
+			// install short of it, and no webhook fires to say so.
+			//
+			// The comparison is the vendor's, so it belongs here. Reading WHICH
+			// scopes a store granted is not: that lives in the `shop` collection and
+			// needs a controller, which is precisely what a hook in a published
+			// package must not be handed. The caller reads the grant and passes the
+			// string; this answers what is missing from it.
+			//
+			// `shopify` is injected for the same reason it is everywhere else — this
+			// package cannot import @drawbridge/shopify, which depends on it.
+			scopes : ({ scope, shopify }) => ( scope ? shopify.oauth.missingScopes( scope ) : null ),
 			// Shopify's install grant is exchanged inside its own app flow, not
 			// through the shared OAuth runner.
 			token : false
@@ -2683,10 +2749,12 @@ var webhook = {
 	// connect generates a secret rather than proving a credential.
 	hooks : {
 		auth : {
-			// Minting and clearing a secret needs no vendor call, so the api's own
-			// handler does both.
-			connect : {},
-			disconnect : {},
+			// FALSE, NOT {}. There is no vendor here at all — connecting mints a
+			// secret and disconnecting clears it, both done by the api's own
+			// handler. `{}` would promise a body implemented elsewhere, and none
+			// exists or could.
+			connect : false,
+			disconnect : false,
 			probe : false,
 			scopes : false,
 			// Nothing to mint. Connecting generates a secret; there is no vendor.
@@ -3250,7 +3318,6 @@ const stepLabels = ( catalog = connections ) => Object.fromEntries(
 const connections = Object.freeze({
 	attentive : build( attentive ),
 	drawbridge : build( drawbridge ),
-	hubspot : build( hubspot ),
 	klaviyo : build( klaviyo ),
 	mailchimp : build( mailchimp ),
 	shopify : build( shopify ),