@drawbridge/drawbridge-utils 0.0.116 → 0.0.118

package/dist/connections/index.cjs

@@ -635,6 +635,197 @@ var attentive_default2 = {
   title: "Attentive"
 };
 
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/hubspot.js
+var HUBSPOT_BASE = "https://api.hubapi.com";
+var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  return (fetcher || request)({
+    body,
+    headers: {
+      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+    },
+    method,
+    query,
+    url: HUBSPOT_BASE + path
+  });
+};
+var UTM_PROPERTIES = {
+  campaign: "utm_campaign",
+  content: "utm_content",
+  id: "utm_id",
+  medium: "utm_medium",
+  source: "utm_source",
+  term: "utm_term"
+};
+var CLICK_PROPERTIES = {
+  fbclid: "hs_facebook_click_id",
+  gclid: "hs_google_click_id",
+  liFatId: "hs_linkedin_click_id",
+  msclkid: "hs_bing_click_id",
+  ttclid: "hs_tiktok_click_id"
+};
+var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
+var isUtmProperty = (key) => DROPPABLE.has(key);
+var toProperties = ({ email, firstName, lastName, utm }) => {
+  var _a;
+  const properties = {};
+  if (email !== void 0) properties.email = email;
+  if (firstName !== void 0) properties.firstname = firstName;
+  if (lastName !== void 0) properties.lastname = lastName;
+  if (utm) {
+    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
+      if (utm[key]) properties[property] = utm[key];
+    }
+    ;
+    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
+      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
+    }
+    ;
+  }
+  ;
+  return properties;
+};
+var send = async ({ doc, fetcher, method, path, token }) => {
+  const properties = toProperties(doc);
+  try {
+    return await hubspotRequest({
+      body: { properties },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  } catch (error) {
+    const enriched = Object.keys(properties).some(isUtmProperty);
+    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
+    return await hubspotRequest({
+      body: {
+        properties: Object.fromEntries(
+          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
+        )
+      },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  }
+};
+var lookup = async ({ email, fetcher, token }) => {
+  var _a, _b;
+  if (!token || !email) return;
+  try {
+    const body = await hubspotRequest({
+      body: {
+        filterGroups: [
+          {
+            filters: [
+              {
+                operator: "EQ",
+                propertyName: "email",
+                value: email
+              }
+            ]
+          }
+        ],
+        limit: 1,
+        properties: ["email"]
+      },
+      fetcher,
+      method: "POST",
+      path: "/crm/v3/objects/contacts/search",
+      token
+    });
+    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
+  } catch (error) {
+  }
+};
+var contacts = {
+  // FORGET A CONTACT, by id or by email. Account deletion — the caller had
+  // to search then remove, which is one round trip it should not have to
+  // know about.
+  remove: async ({ email, fetcher, id, token }) => {
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    const contact = id || await lookup({ email, fetcher, token: key });
+    if (!contact) return;
+    return hubspotRequest({
+      fetcher,
+      method: "DELETE",
+      path: "/crm/v3/objects/contacts/" + contact,
+      token: key
+    });
+  },
+  // Connect an account to its contact by email, creating it if absent, and
+  // return the contact id. Unlike SendGrid, HubSpot renames a contact's
+  // email in place, so an email change is a plain PATCH on the cached id —
+  // no delete-old-then-create-new.
+  //
+  // Prefer the cached hubspotId; fall back to a search; create last.
+  sync: async ({ doc, fetcher, token }) => {
+    var _a, _b;
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    if (doc == null ? void 0 : doc.hubspotId) {
+      try {
+        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+      } catch (error) {
+        if ((error == null ? void 0 : error.status) !== 404) throw error;
+      }
+    }
+    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+    return (_b = await send({
+      doc,
+      fetcher,
+      method: existing ? "PATCH" : "POST",
+      path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
+      token: key
+    })) == null ? void 0 : _b.id;
+  }
+};
+
 // lib/connections/icons/drawbridge.js
 var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="#BAEC5F"/>
@@ -1272,7 +1463,15 @@ var drawbridge_default2 = {
       token: false
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // DRAWBRIDGE'S OWN CRM. Not a merchant's — this keeps our HubSpot portal in
+    // step with account signups, and drawbridge-sync's user stream calls it.
+    //
+    // A real implementation here rather than `{}` because the bodies are pure
+    // HTTP against a token: no controller, no queue, nothing that would have to
+    // live in the service. lib/hubspot.js holds them, beside lib/sendgrid.js
+    // and lib/twilio.js, which are the same kind of thing — vendor clients for
+    // accounts DRAWBRIDGE holds rather than ones a merchant connects.
+    contacts,
     email: {
       digest: {},
       // To organization members. NEVER suppressed and never billed: an
@@ -1297,6 +1496,17 @@ var drawbridge_default2 = {
   icon: drawbridge_default,
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
+  // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
+  //
+  // `requires` gates AVAILABILITY: a name in it that is unset removes the whole
+  // connection. This one is private and contributes every base workflow step —
+  // email.send, sms.send, segment.sync — so gating it on a CRM token would take
+  // all of them away from any deployment without a HubSpot portal, to protect a
+  // sync that is best-effort and already no-ops without a token.
+  //
+  // The test 'a vendor is only available when its environment is configured'
+  // caught exactly that: availableConnections({}) went from [ 'drawbridge' ] to
+  // empty the moment this was added.
   requires: [],
   slug: "drawbridge",
   // Always on. There is no credential that could go bad and no configuration a
@@ -1420,251 +1630,6 @@ var drawbridge_default2 = {
   title: "Drawbridge"
 };
 
-// lib/http.js
-var DEFAULT_TIMEOUT_MS = 15e3;
-var request = async ({
-  body,
-  headers = {},
-  method = "GET",
-  query,
-  timeout = DEFAULT_TIMEOUT_MS,
-  type = "json",
-  url
-}) => {
-  const fullUrl = new URL(url);
-  if (query) {
-    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
-  }
-  ;
-  const isForm = type === "form";
-  const response = await fetch(fullUrl.toString(), {
-    method,
-    headers: {
-      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
-      ...headers
-    },
-    signal: AbortSignal.timeout(timeout),
-    ...body !== void 0 && {
-      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
-    }
-  });
-  if (!response.ok) {
-    const text2 = await response.text().catch(() => "");
-    const error = new Error(text2 || response.statusText);
-    error.status = response.status;
-    throw error;
-  }
-  ;
-  const text = await response.text();
-  try {
-    return text ? JSON.parse(text) : null;
-  } catch {
-    return null;
-  }
-};
-
-// lib/connections/hubspot.js
-var HUBSPOT_BASE = "https://api.hubapi.com";
-var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
-  return (fetcher || request)({
-    body,
-    headers: {
-      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
-    },
-    method,
-    query,
-    url: HUBSPOT_BASE + path
-  });
-};
-var UTM_PROPERTIES = {
-  campaign: "utm_campaign",
-  content: "utm_content",
-  id: "utm_id",
-  medium: "utm_medium",
-  source: "utm_source",
-  term: "utm_term"
-};
-var CLICK_PROPERTIES = {
-  fbclid: "hs_facebook_click_id",
-  gclid: "hs_google_click_id",
-  liFatId: "hs_linkedin_click_id",
-  msclkid: "hs_bing_click_id",
-  ttclid: "hs_tiktok_click_id"
-};
-var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
-var isUtmProperty = (key) => DROPPABLE.has(key);
-var toProperties = ({ email, firstName, lastName, utm }) => {
-  var _a;
-  const properties = {};
-  if (email !== void 0) properties.email = email;
-  if (firstName !== void 0) properties.firstname = firstName;
-  if (lastName !== void 0) properties.lastname = lastName;
-  if (utm) {
-    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
-      if (utm[key]) properties[property] = utm[key];
-    }
-    ;
-    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
-      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
-    }
-    ;
-  }
-  ;
-  return properties;
-};
-var send = async ({ doc, fetcher, method, path, token }) => {
-  const properties = toProperties(doc);
-  try {
-    return await hubspotRequest({
-      body: { properties },
-      fetcher,
-      method,
-      path,
-      token
-    });
-  } catch (error) {
-    const enriched = Object.keys(properties).some(isUtmProperty);
-    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
-    return await hubspotRequest({
-      body: {
-        properties: Object.fromEntries(
-          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
-        )
-      },
-      fetcher,
-      method,
-      path,
-      token
-    });
-  }
-};
-var lookup = async ({ email, fetcher, token }) => {
-  var _a, _b;
-  if (!token || !email) return;
-  try {
-    const body = await hubspotRequest({
-      body: {
-        filterGroups: [
-          {
-            filters: [
-              {
-                operator: "EQ",
-                propertyName: "email",
-                value: email
-              }
-            ]
-          }
-        ],
-        limit: 1,
-        properties: ["email"]
-      },
-      fetcher,
-      method: "POST",
-      path: "/crm/v3/objects/contacts/search",
-      token
-    });
-    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
-  } catch (error) {
-  }
-};
-var hubspot_default = {
-  auth: {
-    // A Private App token from our own portal. Nothing to connect, nothing to
-    // consent to, and no merchant involved.
-    type: "none"
-  },
-  content: {
-    confirm: "This connection is part of Drawbridge and cannot be disconnected.",
-    description: [
-      "Drawbridge keeps its own HubSpot portal in step with account signups, so the campaign a customer arrived on is on their contact record."
-    ],
-    excerpt: "Drawbridge's own CRM sync.",
-    guide: [
-      "Nothing to do. This is internal to Drawbridge."
-    ]
-  },
-  exclusive: false,
-  fields: [],
-  group: "contacts",
-  hooks: {
-    auth: {
-      connect: false,
-      disconnect: false,
-      probe: false,
-      scopes: false,
-      token: false
-    },
-    commerce: false,
-    contacts: {
-      // FORGET A CONTACT, by id or by email. Account deletion — the caller had
-      // to search then remove, which is one round trip it should not have to
-      // know about.
-      remove: async ({ email, fetcher, id, token }) => {
-        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-        if (!key) return;
-        const contact = id || await lookup({ email, fetcher, token: key });
-        if (!contact) return;
-        return hubspotRequest({
-          fetcher,
-          method: "DELETE",
-          path: "/crm/v3/objects/contacts/" + contact,
-          token: key
-        });
-      },
-      // Connect an account to its contact by email, creating it if absent, and
-      // return the contact id. Unlike SendGrid, HubSpot renames a contact's
-      // email in place, so an email change is a plain PATCH on the cached id —
-      // no delete-old-then-create-new.
-      //
-      // Prefer the cached hubspotId; fall back to a search; create last.
-      sync: async ({ doc, fetcher, token }) => {
-        var _a, _b;
-        const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-        if (!key) return;
-        if (doc == null ? void 0 : doc.hubspotId) {
-          try {
-            return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
-          } catch (error) {
-            if ((error == null ? void 0 : error.status) !== 404) throw error;
-          }
-        }
-        const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
-        return (_b = await send({
-          doc,
-          fetcher,
-          method: existing ? "PATCH" : "POST",
-          path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
-          token: key
-        })) == null ? void 0 : _b.id;
-      }
-    },
-    email: false,
-    inbound: false,
-    lifecycle: false,
-    resources: {
-      audiences: false,
-      prices: false,
-      products: false,
-      promotions: false
-    },
-    segment: false,
-    sms: false,
-    webhook: false
-  },
-  icon: drawbridge_default,
-  // Borrowed: the Drawbridge mark, because this is ours and never rendered.
-  private: true,
-  // Absent the token the hooks no-op, so a deployment without a portal simply
-  // contributes nothing rather than failing.
-  requires: ["HUBSPOT_ACCESS_TOKEN"],
-  slug: "hubspot",
-  status: () => "active",
-  // No workflow steps. The hooks are called by the user stream, not the builder.
-  steps: {},
-  tasks: () => [],
-  title: "HubSpot"
-};
-
 // lib/connections/icons/klaviyo.js
 var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="white"/>
@@ -2126,46 +2091,59 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 </svg>`;
 
 // lib/connections/mailchimp.js
-var base = (apiKey) => {
-  const dc = String(apiKey || "").split("-").pop();
-  if (!dc || dc === apiKey) throw new Error("That Mailchimp key carries no data centre suffix, so there is no host to call");
+var base = (dc) => {
+  if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
   return "https://" + dc + ".api.mailchimp.com/3.0";
 };
 var mailchimp_default2 = {
-  // Keys TODAY. Mailchimp integrations authenticate with OAuth 2 (authorization
-  // code) and that is where this goes, so the endpoints are recorded here
-  // rather than researched again later:
+  // OAUTH 2, authorization code. Every url below is quoted from
+  // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
+  // than remembered.
   //
-  //   authorize  https://login.mailchimp.com/oauth2/authorize
-  //   token      https://login.mailchimp.com/oauth2/token
-  //   metadata   https://login.mailchimp.com/oauth2/metadata
+  // THE METADATA CALL IS MAILCHIMP'S QUIRK and cannot be skipped: an access
+  // token alone cannot call the Marketing API, because every account lives
+  // behind a data-centre prefix (us1, us19...) that only GET
+  // login.mailchimp.com/oauth2/metadata returns — and every subsequent request
+  // needs it in the HOST. That is why auth.connect below is a real function:
+  // the standard exchange does not know where to send anything afterwards.
   //
-  // The metadata call is Mailchimp's quirk and cannot be skipped: the access
-  // token alone is not enough to call the Marketing API, because every account
-  // lives behind a data-centre prefix (us1, us19...) that only that call
-  // returns and every subsequent request needs in its host. No PKCE.
+  // No PKCE. No scopes — the docs describe none. And no refresh token: "Mailchimp
+  // Marketing access tokens do not expire, so you don't need to use a
+  // refresh_token", so tokenSettings stores no expiry and isStale reads that as
+  // nothing to refresh toward.
   //
-  // Switching is filling in auth.oauth and moving the apiKey field out. It is
-  // still a publish -- a manifest change always is -- but a value change
-  // rather than a shape one.
+  // auth.token stays false: the exchange is POST form-encoded with grant_type,
+  // client_id, client_secret, redirect_uri and code, which is exactly the
+  // runner's default — nothing to wrap.
   auth: {
-    type: "keys"
+    oauth: {
+      client: {
+        id: "MAILCHIMP_OAUTH_CLIENT_ID",
+        secret: "MAILCHIMP_OAUTH_CLIENT_SECRET"
+      },
+      urls: {
+        authorize: "https://login.mailchimp.com/oauth2/authorize",
+        redirect: "/api/connection/mailchimp/callback",
+        token: "https://login.mailchimp.com/oauth2/token"
+      }
+    },
+    type: "oauth"
   },
   // EVERYTHING A MERCHANT READS. `errors` belongs in here rather than at the
   // top level because the connection DOCUMENT carries its own `errors` array
   // and the document is spread OVER the resolved manifest downstream — a
   // top-level one would be replaced by that array and never render.
   content: {
-    confirm: "Disconnecting removes your stored Mailchimp key. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
+    confirm: "Disconnecting removes Drawbridge's stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
     description: [
       "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
-      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so a key stored here does nothing today."
+      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships."
     ],
     excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
     guide: [
-      "In Mailchimp, open Account & billing, then Extras, then API keys.",
-      "Create a key and copy it.",
-      "Paste it here. The key ends in a data-centre suffix like -us19, which tells Drawbridge which Mailchimp server your account is on."
+      "Press Connect. Drawbridge sends you to Mailchimp to approve access.",
+      "Sign in to Mailchimp if you are not already, and choose the account to connect.",
+      "You come back here to pick the audience your contacts should sync into."
     ]
   },
   // Mailchimp and SendGrid shared a group while they were SENDERS, where an org
@@ -2175,15 +2153,6 @@ var mailchimp_default2 = {
   exclusive: false,
   feature: "organization:connection:mailchimp",
   fields: [
-    {
-      input: "password",
-      key: "apiKey",
-      label: "Mailchimp API key",
-      message: "Your Mailchimp API key",
-      placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022-us1",
-      redact: true,
-      required: true
-    },
     {
       input: "select",
       key: "audience",
@@ -2202,20 +2171,45 @@ var mailchimp_default2 = {
   // contacts.sync are the first to flip.
   hooks: {
     auth: {
-      // FALSE, NOT {}. `{}` promises an implementation living in the repo that
-      // holds the dependencies, and there is no implementation anywhere
-      // because there is nothing to implement: storing and clearing a typed
-      // key needs no vendor call, and the api's own form handler does it.
-      // Declaring `{}` made the coverage check chase a body that does not
-      // exist, and made a caller wait on an answer that never comes.
-      connect: false,
+      // WHERE THE ACCOUNT LIVES. Not enrichment — without this the connection
+      // is unusable, because the Marketing API host is per-account and only
+      // this call knows it. The callback merges what this returns into the
+      // stored settings, which is how `dc` reaches every later request.
+      //
+      // The header here is `OAuth <token>`, not Bearer — that is specific to
+      // the metadata endpoint. Marketing API calls take Bearer; see the
+      // audiences hook.
+      connect: async ({ fetcher = fetch, tokens }) => {
+        const response = await fetcher("https://login.mailchimp.com/oauth2/metadata", {
+          headers: {
+            authorization: "OAuth " + (tokens == null ? void 0 : tokens.accessToken)
+          },
+          signal: AbortSignal.timeout(15e3)
+        });
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp would not say which data centre this account is on (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        if (!(body == null ? void 0 : body.dc)) throw new Error("Mailchimp returned no data centre for this account");
+        return { dc: body.dc };
+      },
+      // Nothing to call. A merchant revokes Drawbridge from Mailchimp's own
+      // Authorized Apps page; the docs describe no revocation endpoint for us
+      // to call on their behalf.
       disconnect: false,
       probe: false,
       scopes: false,
-      // Keys today. When Mailchimp's OAuth lands this becomes a wrapper that
-      // follows the exchange with /oauth2/metadata — the data-centre call that
-      // is the whole reason its OAuth cannot be pure configuration.
-      token: false
+      // The plain exchange. Mailchimp takes the client as FORM FIELDS
+      // (grant_type, client_id, client_secret, redirect_uri, code), which is
+      // the runner's default — so no `basic : true` as Klaviyo needs.
+      //
+      // build() requires an oauth manifest to name this explicitly rather than
+      // letting it default, which caught this file declaring `false` on the
+      // first import after the conversion.
+      token: authToken
     },
     commerce: false,
     contacts: { remove: false, sync: false },
@@ -2237,15 +2231,14 @@ var mailchimp_default2 = {
       // successful — the same silent truncation Klaviyo has, at a different
       // number. Paged against total_items so an account past a thousand still
       // resolves.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings }) => {
-        const key = settings == null ? void 0 : settings.apiKey;
+      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
+        const dc = settings == null ? void 0 : settings.dc;
         const count = Math.min(limit, 1e3);
         const offset = Number(cursor || 0);
         const response = await fetcher(
-          base(key) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          base(dc) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           {
-            // Basic with any username — Mailchimp reads only the password half.
-            headers: { authorization: "Basic " + Buffer.from("drawbridge:" + key).toString("base64") },
+            headers: { authorization: "Bearer " + token },
             signal: AbortSignal.timeout(15e3)
           }
         );
@@ -2277,6 +2270,13 @@ var mailchimp_default2 = {
     webhook: false
   },
   icon: mailchimp_default,
+  // The OAuth client this deployment registered. Without both, the vendor drops
+  // out of availableConnections rather than offering a Connect button that
+  // cannot complete.
+  requires: [
+    "MAILCHIMP_OAUTH_CLIENT_ID",
+    "MAILCHIMP_OAUTH_CLIENT_SECRET"
+  ],
   slug: "mailchimp",
   // A key with no audience chosen is authenticated and inert. Mailchimp also
   // needs its merge fields created on that audience before any Drawbridge total
@@ -3165,7 +3165,6 @@ var stepLabels = (catalog = connections) => Object.fromEntries(
 var connections = Object.freeze({
   attentive: build(attentive_default2),
   drawbridge: build(drawbridge_default2),
-  hubspot: build(hubspot_default),
   klaviyo: build(klaviyo_default2),
   mailchimp: build(mailchimp_default2),
   shopify: build(shopify_default2),