@drawbridge/drawbridge-utils 0.0.117 → 0.0.118

package/dist/providers.cjs

@@ -0,0 +1,3336 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all2) => {
+  for (var name in all2)
+    __defProp(target, name, { get: all2[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/providers.js
+var providers_exports = {};
+__export(providers_exports, {
+  cacheKey: () => cacheKey,
+  hydrateEnvironment: () => hydrateEnvironment,
+  isLive: () => isLive,
+  mask: () => mask,
+  providerCredentials: () => providerCredentials,
+  providerEnvNames: () => providerEnvNames,
+  providerFields: () => providerFields,
+  providerSettings: () => providerSettings,
+  providerSlugs: () => providerSlugs,
+  saveProviderSettings: () => saveProviderSettings
+});
+module.exports = __toCommonJS(providers_exports);
+
+// lib/connections/contract.js
+var HOOKS = Object.freeze({
+  // Proving and holding the credential.
+  auth: Object.freeze([
+    // Accept what the merchant supplied — a form submission or an OAuth
+    // callback — and store what is needed to call the vendor later.
+    "connect",
+    // Is the stored credential still good? Answered by the cheapest real call
+    // the vendor offers, never by inspecting what we stored: a key that was
+    // revoked at the vendor still looks perfect in our database.
+    "probe",
+    // Which permissions we asked for and no longer hold. Distinct from probe:
+    // the credential can be valid and the grant still be too narrow.
+    "scopes",
+    // Revoke at the vendor and drop what we hold.
+    "disconnect",
+    // MINT A TOKEN — from a consent code, or from a stored refresh token. Both
+    // are the same POST, so they are one hook.
+    //
+    // The default body is authToken() in oauth.js and most vendors point
+    // straight at it. It is a hook rather than a declared flag because the
+    // vendors that differ, differ in ways config cannot express: Klaviyo needs
+    // HTTP Basic where others want body fields, and Mailchimp cannot use the
+    // token it receives until a second call tells it which data centre the
+    // account is behind.
+    "token"
+  ]),
+  // What happens around connecting and disconnecting, beyond the credential.
+  lifecycle: Object.freeze([
+    // KEEP ACCESS WORKING. Rotate a credential before its window closes, prove
+    // it still works, and reconcile whatever the vendor has changed underneath
+    // — scopes, webhooks. Distinct from auth.probe, which only answers "is this
+    // still good": this one FIXES what it can and reports what it cannot.
+    "health",
+    // Post-connect setup: register the vendor's webhooks, create the system
+    // workflows that describe them.
+    "register",
+    // Re-pull vendor state we mirror, after a reconnect or on a schedule.
+    "rehydrate",
+    // Undo `register` — deregister webhooks, release anything reserved.
+    "cleanup"
+  ]),
+  // Receiving from the vendor.
+  //
+  // Split across TWO SERVICES, and the split is the point. `verify` and `event`
+  // and `receive` run in drawbridge-webhooks against the vendor's open
+  // connection, where the budget is whatever that vendor's timeout is —
+  // Shopify's is about five seconds, and missing it means they retry and the
+  // delivery is buffered twice. `process` runs in drawbridge-sync off the
+  // buffer, where it can take as long as it needs and retry without the vendor
+  // ever knowing.
+  //
+  // One hook spanning that seam would hide it, and the thing it hides is the
+  // one most likely to bite: slow work written on the receiving side turns
+  // into duplicate deliveries.
+  inbound: Object.freeze([
+    // Prove the request came from the vendor, AND return the payload it
+    // carries. One hook rather than two because for some vendors they are
+    // genuinely one operation: a JWT-bodied webhook (Kinde) cannot be decoded
+    // into anything trustworthy without verifying it first, and a decode that
+    // runs before the signature check is exactly the bug this shape prevents.
+    //
+    // So the raw bytes stop here. Everything downstream receives the payload
+    // this returned, which means nothing downstream can act on unverified
+    // data even by mistake.
+    //
+    // It is also where a request gets refused for any other reason — an event
+    // outside the allowlist, a connection in the wrong state. Anything that
+    // can reject belongs here, so the route holds no rules of its own.
+    "verify",
+    // Name the event, from wherever this vendor puts it. A header for
+    // Shopify, the route itself for Twilio, a claim in the payload for a
+    // JWT-bodied vendor.
+    "event",
+    // What to buffer and what to answer RIGHT NOW, while the vendor waits.
+    // Thin by obligation. Most vendors only shape a buffer doc here; one that
+    // must reply with content (Twilio answers HELP inline with TwiML, which
+    // carriers require) returns that too.
+    "receive",
+    // Do the work the event implies. Runs in drawbridge-sync, off the buffer.
+    //
+    // DECLARED here, IMPLEMENTED there — the same split as the step handlers,
+    // and for the same reason: this half needs controllers, queues and vendor
+    // SDKs, and putting those behind a published package makes every consumer
+    // carry them. The declaration is what proves the implementation exists.
+    "process"
+  ]),
+  // WHAT A WORKFLOW STEP DOES, as a verb like any other. Step handlers used to
+  // live in drawbridge-sync keyed by step type, which meant a vendor's logic sat
+  // in a repo the vendor file could not see — the split this whole exercise
+  // exists to close.
+  //
+  // A `steps` entry points at one of these; the step says when it runs and what
+  // it costs, the hook does the work.
+  contacts: Object.freeze([
+    // Forget a contact at the vendor. Distinct from suppression, which keeps the
+    // record and marks it unsubscribed: this is deletion, for account closure.
+    "remove",
+    // Push one contact into the audience the merchant chose, honouring
+    // suppression rather than omitting an opted-out person — omission lets them
+    // quietly reappear on the next sync.
+    "sync"
+  ]),
+  commerce: Object.freeze([
+    // Mint a discount code against this merchant's store, mapped to one lead.
+    "code",
+    // Create the buyer at the vendor, so an order can be attributed to them.
+    "customer",
+    // An order arrived at the vendor: attribute it, record it, update totals.
+    "order",
+    // Pull product data across on a vendor update.
+    "product"
+  ]),
+  // WHAT DRAWBRIDGE ITSELF DOES. These are not a third party's verbs — nobody
+  // connects an account to send email through Drawbridge — but they are steps a
+  // workflow runs, and a step points at a hook. So they live on a PRIVATE
+  // connection: one that contributes steps and never appears in the catalog.
+  //
+  // Without it the base steps stay the exception the shell has to know about,
+  // and "every step is a declaration pointing at a hook" stops being true the
+  // moment somebody looks at the six most common ones.
+  email: Object.freeze([
+    // To a lead. Suppression applies, and the send is billed.
+    "send",
+    // To organization members. Never suppressed — an entrant's opt-out must not
+    // silence an alert to staff — and never billed.
+    "notify",
+    // A batched summary to members.
+    "digest"
+  ]),
+  sms: Object.freeze(["send"]),
+  segment: Object.freeze(["sync"]),
+  // OUTBOUND DELIVERY to an address the merchant owns, rather than to a vendor.
+  // The Webhooks connection is the only thing here with no third party behind
+  // it, and the destination is per STEP rather than per connection.
+  webhook: Object.freeze(["send"]),
+  // Vendor data we READ — the things a merchant picks from. Named `resources`
+  // rather than `catalog` because it also holds audiences, and a catalog is a
+  // commerce word for something that is not only commerce. It matches the
+  // pickers that render it, too: InputResource and ListResource.
+  //
+  // The verbs are named for what every vendor has, not for what one calls it:
+  // Shopify says discounts, Stripe says coupons and promotion codes,
+  // BigCommerce says coupons and promotions.
+  //
+  // ONE SHAPE FOR ALL OF THEM — searchable and cursor-paged:
+  //
+  //   ({ connection, cursor, limit, search, settings, token })
+  //     -> { items : [ { id, title, ... } ], pageInfo : { endCursor, hasNextPage } }
+  //
+  // Lifted from what the Shopify product picker already does, rather than
+  // invented: that endpoint takes cursor/limit/search and returns items plus a
+  // pageInfo, and ListResource consumes exactly that. It was a good contract
+  // written once for one vendor; this makes it the contract.
+  //
+  // `title` is not arbitrary — ListResource searches `[ 'title' ]` by default,
+  // so normalising to { id, title } is what lets a picker work with no
+  // per-vendor configuration.
+  //
+  // HOW a vendor searches is its own business, which is the point of a hook.
+  // Shopify pushes the term into its GraphQL query, Klaviyo has a filter
+  // parameter, and Mailchimp's /lists has no name filter at all so its hook
+  // matches against what it fetched. The caller never learns which.
+  resources: Object.freeze([
+    // The named groups a contact can be synced INTO. Klaviyo calls them lists,
+    // Mailchimp calls them audiences; `audiences` is the industry-generic term
+    // and belongs to neither vendor's API. Read at form time, so a merchant
+    // picks from what actually exists in their account rather than pasting an
+    // id from another tab.
+    "audiences",
+    "products",
+    // Shopify folds price into the product variant; Stripe makes Price a
+    // first-class object beside Product. Declared so a vendor that separates
+    // them has somewhere to answer.
+    "prices",
+    "promotions"
+  ])
+});
+var STEPS = Object.freeze({
+  "commerce.code.issue": "Issue discount code",
+  "commerce.customer.insert": "Create customer",
+  "commerce.order.record": "Record order",
+  "commerce.product.sync": "Sync product",
+  // Not commerce at all — connection lifecycle, and they generalise to any
+  // vendor holding a rotating credential.
+  "connection.health.check": "Connection health check",
+  "connection.token.exchange": "Exchange token",
+  "connection.token.refresh": "Refresh token",
+  "contacts.sync": "Sync contact",
+  "email.digest": "Digest",
+  "email.notify": "Notification",
+  "email.send": "Send email",
+  "segment.sync": "Sync segment",
+  "sms.send": "Send SMS",
+  "webhook.send": "Send webhook"
+});
+var RETIRED = Object.freeze({
+  "step.shopify.customer.insert": "step.commerce.customer.insert",
+  "step.shopify.discount.update": "step.commerce.code.issue",
+  "step.shopify.health.check": "step.connection.health.check",
+  "step.shopify.order.record": "step.commerce.order.record",
+  "step.shopify.product.sync": "step.commerce.product.sync",
+  "step.shopify.token.exchange": "step.connection.token.exchange",
+  "step.shopify.token.refresh": "step.connection.token.refresh"
+});
+var STEP_TYPES = Object.freeze(Object.keys(STEPS).map((name) => "step." + name));
+var STEP_LABELS = Object.freeze(Object.fromEntries(
+  Object.entries(STEPS).map(([name, label]) => ["step." + name, label])
+));
+var HOOK_NAMES = Object.freeze(
+  Object.entries(HOOKS).flatMap(([domain, verbs]) => verbs.map((verb) => domain + "." + verb))
+);
+var OUTCOMES = Object.freeze({
+  answered: "answered",
+  disconnected: "disconnected",
+  failed: "failed",
+  // Declared supported, implemented in a consumer rather than in this package —
+  // sync owns the step handlers and lifecycle jobs. Different from unsupported,
+  // which means the vendor cannot do it at all.
+  unimplemented: "unimplemented",
+  unsupported: "unsupported"
+});
+var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var AUTH_TYPES = Object.freeze(["generated", "install", "keys", "none", "oauth"]);
+var GROUPS = Object.freeze(["commerce", "contacts", "developer", "messaging"]);
+var OAUTH_FIELDS = Object.freeze(["client"]);
+var OAUTH_URLS = Object.freeze(["authorize", "redirect", "token"]);
+var INPUTS = Object.freeze([
+  "checkbox",
+  "email",
+  "number",
+  "password",
+  "select",
+  "text",
+  "textarea",
+  "url"
+]);
+
+// lib/connections/oauth.js
+var import_node_crypto = require("crypto");
+var credentials = ({ basic, clientId, clientSecret }) => basic ? {
+  body: {},
+  headers: { authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64") }
+} : {
+  body: { client_id: clientId, client_secret: clientSecret },
+  headers: {}
+};
+var authToken = async ({
+  basic,
+  clientId,
+  clientSecret,
+  code: code2,
+  descriptor,
+  fetcher = fetch,
+  redirect,
+  refreshToken,
+  verifier
+} = {}) => {
+  var _a;
+  if (!clientId || !clientSecret) throw new Error("This deployment has no OAuth client configured, so no token can be minted");
+  if (!((_a = descriptor == null ? void 0 : descriptor.urls) == null ? void 0 : _a.token)) throw new Error("This connection declares no token url");
+  const renewing = !code2;
+  if (renewing && !refreshToken) throw new Error("Nothing has been consented to yet, so there is no refresh token to spend");
+  if (!renewing && descriptor.pkce && !verifier) throw new Error("This connection requires PKCE, so the code verifier is not optional");
+  const client = credentials({ basic, clientId, clientSecret });
+  const response = await fetcher(descriptor.urls.token, {
+    body: new URLSearchParams({
+      ...client.body,
+      ...renewing ? { grant_type: "refresh_token", refresh_token: refreshToken } : {
+        code: decodeURIComponent(String(code2 || "").trim()),
+        grant_type: "authorization_code",
+        redirect_uri: redirect,
+        ...descriptor.pkce && { code_verifier: verifier }
+      }
+    }),
+    headers: { "content-type": "application/x-www-form-urlencoded", ...client.headers },
+    method: "POST",
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(
+      renewing ? "The vendor refused the refresh token (" + response.status + ") \u2014 reconnect the connection" : "The vendor refused the exchange (" + response.status + ")" + ((body == null ? void 0 : body.error) ? ": " + body.error : "")
+    );
+  }
+  if (!renewing && !body.access_token) throw new Error("The vendor returned no access token");
+  return {
+    accessToken: body.access_token,
+    expiresIn: body.expires_in || null,
+    // A REFRESH TOKEN IS NOT UNIVERSAL. Google returns one only with
+    // access_type=offline; Mailchimp's tokens do not expire and it returns none
+    // at all, so its absence cannot be an error here.
+    //
+    // On a RENEWAL the same null matters for the opposite reason: a vendor that
+    // rotates returns a new one, and dropping it silently invalidates the stored
+    // grant on the NEXT refresh — a failure a day late and nowhere near its
+    // cause. tokenSettings() keeps the existing one when this is null.
+    refreshToken: body.refresh_token || null,
+    scope: body.scope || null
+  };
+};
+
+// lib/connections/token.js
+var SKEW_SECONDS = 120;
+var isStale = (settings, now = Date.now()) => {
+  if (!(settings == null ? void 0 : settings.expiresAt)) return false;
+  return new Date(settings.expiresAt).getTime() - SKEW_SECONDS * 1e3 <= now;
+};
+var tokenSettings = ({ existing = {}, now = Date.now(), tokens }) => ({
+  accessToken: tokens.accessToken,
+  // A vendor that does not rotate its refresh token returns none on a refresh
+  // (Klaviyo). Keeping the existing one is what makes the NEXT refresh work —
+  // dropping it invalidates the grant one call later, nowhere near the cause.
+  ...(tokens.refreshToken || existing.refreshToken) && {
+    refreshToken: tokens.refreshToken || existing.refreshToken
+  },
+  // Absent when the vendor issues non-expiring tokens, and absent is meaningful
+  // — isStale reads it as "nothing to refresh toward".
+  ...tokens.expiresIn && {
+    expiresAt: new Date(now + tokens.expiresIn * 1e3).toISOString()
+  },
+  ...tokens.scope && { scope: tokens.scope }
+});
+var accessToken = async ({
+  clientId,
+  clientSecret,
+  fetcher,
+  force = false,
+  manifest,
+  now = Date.now(),
+  save,
+  settings
+} = {}) => {
+  if (!(settings == null ? void 0 : settings.accessToken) && !(settings == null ? void 0 : settings.refreshToken)) {
+    throw new Error("This connection holds no credential, so there is no token to use");
+  }
+  if (!force && !isStale(settings, now)) return settings.accessToken;
+  if (!settings.refreshToken) {
+    throw new Error("This connection has expired and cannot be renewed automatically. Reconnect it.");
+  }
+  const minted = await manifest.hooks.auth.token({
+    clientId,
+    clientSecret,
+    descriptor: manifest.auth.oauth,
+    ...fetcher && { fetcher },
+    refreshToken: settings.refreshToken
+  });
+  const next = tokenSettings({ existing: settings, now, tokens: minted });
+  if (save) await save(next);
+  return next.accessToken;
+};
+
+// lib/connections/icons/attentive.js
+var attentive_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#FFD967"/>
+<path d="M239.369 127.404C260.863 122.013 284.964 132.569 295.576 152.039C321.796 201.286 347.928 250.567 374.131 299.825C380.149 311.989 381.244 326.564 376.733 339.41C371.446 355.097 358.039 367.69 342.107 372.089C326.274 376.67 308.351 372.871 295.741 362.255C288.865 356.892 284.161 349.359 280.354 341.629C261.869 306.95 243.478 272.217 225.071 237.501C214.409 218.614 187.221 212.656 169.622 225.315C168.104 227.309 164.159 226.857 164.72 223.796C176.911 202.569 189.361 181.497 201.662 160.331C205.183 154.428 208.214 148.129 212.967 143.091C219.844 135.272 229.263 129.782 239.374 127.404" fill="#1E1C1C"/>
+<path d="M166.04 261.805C180.228 259.107 195.528 261.893 207.581 269.971C218.512 277.079 226.908 288.136 230.604 300.657C234.835 314.103 233.614 329.124 227.485 341.788C220.097 356.875 205.782 368.543 189.317 372.089C173.957 375.652 157.089 372.386 144.304 363.103C132.971 355.295 124.912 342.989 121.891 329.581C118.943 316.636 120.725 302.656 127.002 290.938C134.699 275.951 149.503 264.933 166.046 261.811" fill="#1E1C1C"/>
+</svg>`;
+
+// lib/connections/attentive.js
+var attentive_default2 = {
+  auth: {
+    oauth: {
+      // NAMES of the env vars holding OUR app's client — set at registration,
+      // never before. No `headers` on the client: Attentive takes credentials
+      // as form fields, which is the runner's default.
+      client: {
+        id: "ATTENTIVE_OAUTH_CLIENT_ID",
+        secret: "ATTENTIVE_OAUTH_CLIENT_SECRET"
+      },
+      urls: {
+        authorize: "https://ui.attentivemobile.com/integrations/oauth-install",
+        redirect: "/api/connection/attentive/callback",
+        token: "https://api.attentivemobile.com/v1/authorization-codes/tokens"
+      }
+    },
+    type: "oauth"
+  },
+  // EVERYTHING A MERCHANT READS. `errors` would live in here too — the
+  // connection DOCUMENT carries its own `errors` array and is spread OVER the
+  // resolved manifest downstream, so a top-level one would never render.
+  content: {
+    // SAYS WHAT ACTUALLY HAPPENS. This used to promise that disconnecting
+    // revokes Drawbridge's access, and it cannot: Attentive documents no
+    // revocation endpoint, and their authentication page states an access
+    // token "does not expire". So the grant survives a disconnect forever
+    // unless the merchant removes the integration at Attentive, and the copy
+    // has to say so rather than let them believe otherwise.
+    confirm: "Disconnecting removes Drawbridge's stored Attentive token. Attentive does not offer a way for us to revoke it, so remove the Drawbridge integration in Attentive as well if you want its access fully withdrawn. Your subscribers stay in both Attentive and Drawbridge \u2014 neither list is deleted.",
+    description: [
+      "Attentive is where your SMS marketing lives, and this connection is becoming the way your Drawbridge contacts sync into an Attentive segment.",
+      "You authorize Drawbridge from inside Attentive and can revoke that access there at any time. Drawbridge never sees or stores your Attentive password.",
+      "Subscriber syncing is not live yet, so connecting today does nothing except choose the segment it will use when it ships."
+    ],
+    excerpt: "Sync your Drawbridge contacts into an Attentive segment.",
+    guide: [
+      "Press Connect. Drawbridge sends you to Attentive to approve access.",
+      "Sign in to Attentive if you are not already, and authorize the permissions listed.",
+      "You are returned here \u2014 choose which Attentive segment your contacts should sync into."
+    ]
+  },
+  // A contact destination, like Klaviyo and Mailchimp — a merchant could
+  // reasonably keep several up to date at once.
+  exclusive: false,
+  feature: "organization:connection:attentive",
+  fields: [
+    {
+      input: "select",
+      key: "segment",
+      label: "Attentive segment",
+      message: "Contacts your campaigns collect are synced into this segment.",
+      hook: "resources.audiences",
+      required: true
+      // No `search : false` here, and that is a first: /v2/segments takes a
+      // `name` filter (partial match, cited above), so this picker searches
+      // the ACCOUNT — Klaviyo and Mailchimp can only match the fetched page.
+    }
+  ],
+  group: "contacts",
+  // A HOOK'S VALUE IS ITS ANSWER. The consent is stored and can be revoked;
+  // nothing else is built yet, because subscriber sync has not shipped. Every
+  // false here is "not yet" rather than "never" — when the sync lands, probe
+  // and contacts.sync are the first to flip.
+  hooks: {
+    auth: {
+      // The exchange already yields the tokens, and Attentive documents no
+      // account-identity endpoint to enrich them with — Klaviyo's connect
+      // reads the account name back; this has nothing cited to read. The
+      // callback stores the tokens and skips enrichment on `unimplemented`.
+      // FALSE, NOT {}. `{}` means "supported, implemented in the repo with the
+      // dependencies", and nothing anywhere implements either of these —
+      // there is nothing for them to do. The exchange already yields the
+      // tokens and Attentive documents no account-identity endpoint to
+      // enrich them with, so connect has nothing to add; and they document
+      // no revocation endpoint at all, so disconnect has nothing to call.
+      // Recorded as a decision rather than left as an unkept promise.
+      connect: false,
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      // THE ONE THING WRAPPED, and it is about the response rather than the
+      // request. Attentive's token reply carries expires_in : 900 while their
+      // auth overview says access tokens "do not expire" — and no refresh
+      // token exists to renew with. Storing that expiry would have
+      // accessToken() declaring the credential spent fifteen minutes after
+      // consent, with nothing to renew it: every connection would demand
+      // reconnecting four times an hour.
+      //
+      // The overview's answer is modelled — the expiry is dropped, so the
+      // token is treated as long-lived. Registration item 1 in the header is
+      // the live exchange that proves this right or wrong.
+      token: async (args) => {
+        const minted = await authToken(args);
+        return { ...minted, expiresIn: null };
+      }
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    email: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      // The segments a merchant can sync into, for the picker on their
+      // connection.
+      //
+      // GET /v2/segments (cited in the header). `limit` caps at 1000 in their
+      // own spec, defaulting to 20 — low enough that leaving it unset would
+      // show a picker quietly missing most of a real account. The response's
+      // only identifier is `externalId`, so an entry without one cannot be
+      // stored and is dropped.
+      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, token }) => {
+        const query = new URLSearchParams({
+          limit: String(Math.min(limit, 1e3)),
+          ...cursor && { cursor },
+          ...(search == null ? void 0 : search.value) && { name: String(search.value).trim() }
+        });
+        const response = await fetcher(
+          "https://api.attentivemobile.com/v2/segments?" + query,
+          {
+            headers: { authorization: "Bearer " + token },
+            signal: AbortSignal.timeout(15e3)
+          }
+        );
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Attentive refused the request (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        return {
+          items: ((body == null ? void 0 : body.segments) || []).filter((segment) => segment == null ? void 0 : segment.externalId).map((segment) => ({ id: segment.externalId, title: (segment == null ? void 0 : segment.name) || segment.externalId })),
+          pageInfo: {
+            endCursor: (body == null ? void 0 : body.hasMore) ? (body == null ? void 0 : body.cursor) || null : null,
+            hasNextPage: Boolean(body == null ? void 0 : body.hasMore)
+          }
+        };
+      },
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    segment: false,
+    sms: false,
+    webhook: false
+  },
+  icon: attentive_default,
+  requires: [
+    "ATTENTIVE_OAUTH_CLIENT_ID",
+    "ATTENTIVE_OAUTH_CLIENT_SECRET"
+  ],
+  slug: "attentive",
+  // A consent with no segment chosen is authenticated and inert — the sync,
+  // when it ships, needs somewhere to put people.
+  status: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? data2.status : "pending";
+  },
+  // No steps: subscriber sync has not shipped, so this vendor contributes
+  // nothing to a workflow yet. An empty steps object is the honest declaration.
+  steps: {},
+  tasks: (data2) => {
+    var _a;
+    return [
+      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? [] : [
+        {
+          message: "Choose which Attentive segment your contacts should sync into. Until you do, nothing is being synced.",
+          title: "Choose a segment"
+        }
+      ],
+      {
+        message: "Contact syncing to Attentive segments has not shipped yet. Nothing is being sent to Attentive right now.",
+        title: "Subscriber sync not available yet",
+        type: "warning"
+      }
+    ];
+  },
+  title: "Attentive"
+};
+
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetch(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/hubspot.js
+var HUBSPOT_BASE = "https://api.hubapi.com";
+var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  return (fetcher || request)({
+    body,
+    headers: {
+      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+    },
+    method,
+    query,
+    url: HUBSPOT_BASE + path
+  });
+};
+var UTM_PROPERTIES = {
+  campaign: "utm_campaign",
+  content: "utm_content",
+  id: "utm_id",
+  medium: "utm_medium",
+  source: "utm_source",
+  term: "utm_term"
+};
+var CLICK_PROPERTIES = {
+  fbclid: "hs_facebook_click_id",
+  gclid: "hs_google_click_id",
+  liFatId: "hs_linkedin_click_id",
+  msclkid: "hs_bing_click_id",
+  ttclid: "hs_tiktok_click_id"
+};
+var DROPPABLE = new Set(Object.values(UTM_PROPERTIES));
+var isUtmProperty = (key) => DROPPABLE.has(key);
+var toProperties = ({ email, firstName, lastName, utm }) => {
+  var _a;
+  const properties = {};
+  if (email !== void 0) properties.email = email;
+  if (firstName !== void 0) properties.firstname = firstName;
+  if (lastName !== void 0) properties.lastname = lastName;
+  if (utm) {
+    for (const [key, property] of Object.entries(UTM_PROPERTIES)) {
+      if (utm[key]) properties[property] = utm[key];
+    }
+    ;
+    for (const [key, property] of Object.entries(CLICK_PROPERTIES)) {
+      if ((_a = utm.click) == null ? void 0 : _a[key]) properties[property] = utm.click[key];
+    }
+    ;
+  }
+  ;
+  return properties;
+};
+var send = async ({ doc, fetcher, method, path, token }) => {
+  const properties = toProperties(doc);
+  try {
+    return await hubspotRequest({
+      body: { properties },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  } catch (error) {
+    const enriched = Object.keys(properties).some(isUtmProperty);
+    if ((error == null ? void 0 : error.status) !== 400 || !enriched) throw error;
+    return await hubspotRequest({
+      body: {
+        properties: Object.fromEntries(
+          Object.entries(properties).filter(([key]) => !isUtmProperty(key))
+        )
+      },
+      fetcher,
+      method,
+      path,
+      token
+    });
+  }
+};
+var lookup = async ({ email, fetcher, token }) => {
+  var _a, _b;
+  if (!token || !email) return;
+  try {
+    const body = await hubspotRequest({
+      body: {
+        filterGroups: [
+          {
+            filters: [
+              {
+                operator: "EQ",
+                propertyName: "email",
+                value: email
+              }
+            ]
+          }
+        ],
+        limit: 1,
+        properties: ["email"]
+      },
+      fetcher,
+      method: "POST",
+      path: "/crm/v3/objects/contacts/search",
+      token
+    });
+    return (_b = (_a = body == null ? void 0 : body.results) == null ? void 0 : _a[0]) == null ? void 0 : _b.id;
+  } catch (error) {
+  }
+};
+var contacts = {
+  // FORGET A CONTACT, by id or by email. Account deletion — the caller had
+  // to search then remove, which is one round trip it should not have to
+  // know about.
+  remove: async ({ email, fetcher, id, token }) => {
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    const contact = id || await lookup({ email, fetcher, token: key });
+    if (!contact) return;
+    return hubspotRequest({
+      fetcher,
+      method: "DELETE",
+      path: "/crm/v3/objects/contacts/" + contact,
+      token: key
+    });
+  },
+  // Connect an account to its contact by email, creating it if absent, and
+  // return the contact id. Unlike SendGrid, HubSpot renames a contact's
+  // email in place, so an email change is a plain PATCH on the cached id —
+  // no delete-old-then-create-new.
+  //
+  // Prefer the cached hubspotId; fall back to a search; create last.
+  sync: async ({ doc, fetcher, token }) => {
+    var _a, _b;
+    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
+    if (!key) return;
+    if (doc == null ? void 0 : doc.hubspotId) {
+      try {
+        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+      } catch (error) {
+        if ((error == null ? void 0 : error.status) !== 404) throw error;
+      }
+    }
+    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+    return (_b = await send({
+      doc,
+      fetcher,
+      method: existing ? "PATCH" : "POST",
+      path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
+      token: key
+    })) == null ? void 0 : _b.id;
+  }
+};
+
+// lib/connections/icons/drawbridge.js
+var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#BAEC5F"/>
+<g clip-path="url(#clip0_2115_2832)">
+<path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
+<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
+</g>
+<defs>
+<clipPath id="clip0_2115_2832">
+<rect width="220" height="284" fill="white" transform="translate(140 108)"/>
+</clipPath>
+</defs>
+</svg>`;
+
+// lib/features.js
+var page = {
+  qrcode: {
+    key: "page:qrcode",
+    error: "Plan does not include qrcodes",
+    feature: "Page qrcode management"
+  },
+  shortcode: {
+    key: "page:shortcode",
+    error: "Plan does not include shortcodes",
+    feature: "Page shortcode management"
+  },
+  slug: {
+    key: "page:slug",
+    error: "Plan does not include url customization",
+    feature: "Page slug customization"
+  }
+};
+var fields = {
+  additional: {
+    key: "campaign:fields:additional",
+    error: "Plan does not include additional fields",
+    feature: "Campaign additional fields"
+  },
+  lead: {
+    key: "campaign:fields:lead",
+    error: "Plan does not include lead fields",
+    feature: "Campaign lead fields"
+  }
+};
+var field = {
+  email: {
+    key: "campaign:field:email",
+    error: "Plan does not include email field",
+    feature: "Campaign email field"
+  },
+  name: {
+    key: "campaign:field:name",
+    error: "Plan does not include name field",
+    feature: "Campaign name field"
+  },
+  number: {
+    key: "campaign:field:number",
+    error: "Plan does not include number field",
+    feature: "Campaign number field"
+  },
+  phone: {
+    key: "campaign:field:phone",
+    error: "Plan does not include phone field",
+    feature: "Campaign phone field"
+  },
+  select: {
+    key: "campaign:field:select",
+    error: "Plan does not include dropdown field",
+    feature: "Campaign dropdown field"
+  },
+  text: {
+    key: "campaign:field:text",
+    error: "Plan does not include short text field",
+    feature: "Campaign short text field"
+  },
+  textarea: {
+    key: "campaign:field:textarea",
+    error: "Plan does not include long text field",
+    feature: "Campaign long text field"
+  }
+};
+var connection = {
+  attentive: {
+    key: "organization:connection:attentive",
+    error: "Plan does not include Attentive connection",
+    feature: "Attentive connection"
+  },
+  // Klaviyo shipped without an entry here, which meant no plan GRANTED its
+  // key and the feature gate denied every non-admin request — a latent 403
+  // found while adding Attentive. getPlanFeature answers granted:false for a
+  // key absent from the plan's map, so a manifest feature key that appears in
+  // no plan list is a connection only admins can manage.
+  klaviyo: {
+    key: "organization:connection:klaviyo",
+    error: "Plan does not include Klaviyo connection",
+    feature: "Klaviyo connection"
+  },
+  mailchimp: {
+    key: "organization:connection:mailchimp",
+    error: "Plan does not include Mailchimp connection",
+    feature: "Mailchimp connection"
+  },
+  sendgrid: {
+    key: "organization:connection:sendgrid",
+    error: "Plan does not include SendGrid connection",
+    feature: "SendGrid connection"
+  },
+  shopify: {
+    key: "organization:connection:shopify",
+    error: "Plan does not include Shopify connection",
+    feature: "Shopify connection"
+  },
+  twilio: {
+    key: "organization:connection:twilio",
+    error: "Plan does not include Twilio connection",
+    feature: "Twilio connection"
+  },
+  webhook: {
+    key: "organization:connection:webhook",
+    error: "Plan does not include Webhook connection",
+    feature: "Webhook connection"
+  }
+};
+var organization = {
+  advertisements: {
+    key: "organization:advertisements",
+    error: "Your plan does not include advertisements",
+    feature: "Organization advertisement management"
+  },
+  affiliates: {
+    key: "organization:affiliates",
+    error: "Your plan does not include affiliates",
+    feature: "Organization affiliates management"
+  },
+  analytics: {
+    key: "organization:analytics",
+    error: "Your plan does not include analytics",
+    feature: "Organization analytics management"
+  },
+  brands: {
+    key: "organization:brands",
+    error: "Your plan does not include brands",
+    feature: "Organization brands management"
+  },
+  // Gates the Networking section as a whole — a verified sending domain today,
+  // the SMS number and a custom page domain as they land. One key rather than
+  // one per type: they are the same capability to a merchant, and splitting
+  // them would mean a plan could grant half a section.
+  //
+  // It replaces `connection.sender`, which named a connection this stopped
+  // being. Free organizations cannot send lead-facing email at all, so a
+  // sending identity there is one they could never send from.
+  networking: {
+    key: "organization:networking",
+    error: "Your plan does not include a custom sending identity",
+    feature: "Organization networking"
+  },
+  members: {
+    key: "organization:members",
+    error: "Your plan does not include team members",
+    feature: "Organization members management"
+  },
+  reports: {
+    key: "organization:report",
+    error: "Plan does not include report generation",
+    feature: "Organization report generation"
+  },
+  subdomain: {
+    key: "organization:subdomain",
+    error: "Plan does not include subdomain customization",
+    feature: "Organization subdomain customization"
+  }
+};
+
+// index.js
+var import_currency_codes = require("currency-codes");
+var import_nanoid = require("nanoid");
+
+// lib/color.js
+var import_tinycolor2 = __toESM(require("tinycolor2"), 1);
+var colorFormatted = (value) => {
+  const color = (0, import_tinycolor2.default)(value);
+  const attributes = {
+    brightness: color.getBrightness(),
+    dark: color.isDark(),
+    light: color.isLight(),
+    luminance: color.getLuminance()
+  };
+  return {
+    attributes,
+    hex: color.toHexString(),
+    hsl: color.toHsl(),
+    hsv: color.toHsv(),
+    rgb: color.toRgbString()
+  };
+};
+var colorAccessible = (background2) => {
+  const white = "#ffffff";
+  const black = "#000000";
+  return import_tinycolor2.default.isReadable(
+    background2,
+    white,
+    {
+      level: "AA",
+      size: "normal"
+    }
+  ) ? white : black;
+};
+
+// lib/constants.js
+var font = {
+  family: "Roboto Flex",
+  transform: "none",
+  weight: "regular"
+};
+var background = "#ffffff";
+var style = {
+  background: {
+    color: colorFormatted(background)
+  },
+  body: font,
+  button: {
+    background: {
+      color: colorFormatted(background)
+    },
+    radius: 0,
+    text: {
+      color: colorFormatted(colorAccessible(background))
+    }
+  },
+  heading: font,
+  input: {
+    radius: 0
+  },
+  text: {
+    color: colorFormatted(colorAccessible(background))
+  }
+};
+
+// index.js
+var nanoid = (0, import_nanoid.customAlphabet)("0123456789abcdefghijklmnopqrstuvwxyz", 8);
+var infinite = 1e300;
+var megabyte = 1024 * 1024;
+var gigabyte = megabyte * 1024;
+var currencies = import_currency_codes.data.map((item) => ({
+  ...item,
+  key: item.currency,
+  value: item.code
+}));
+
+// lib/plans.js
+var featuresFor = (array = []) => Object.values({
+  ...connection,
+  ...organization,
+  ...fields,
+  ...field,
+  ...page
+}).reduce(
+  (accumulator, { key, error, feature }) => {
+    if (array.includes(key)) {
+      accumulator.granted[key] = feature;
+    } else {
+      accumulator.denied[key] = error;
+    }
+    return accumulator;
+  },
+  { denied: {}, granted: {} }
+);
+var overage = (actionCents) => ({
+  actionCents,
+  overages: { actions: String(actionCents) }
+});
+var all = {
+  features: (array = []) => featuresFor([
+    connection.attentive.key,
+    connection.klaviyo.key,
+    connection.mailchimp.key,
+    connection.sendgrid.key,
+    connection.shopify.key,
+    connection.twilio.key,
+    connection.webhook.key,
+    organization.affiliates.key,
+    organization.brands.key,
+    fields.additional.key,
+    fields.lead.key,
+    field.email.key,
+    field.name.key,
+    field.number.key,
+    field.phone.key,
+    field.select.key,
+    field.text.key,
+    field.textarea.key,
+    page.qrcode.key,
+    page.shortcode.key,
+    ...array
+  ]),
+  // `members` and `storage` default to infinite so an unnamed term on a custom
+  // plan reads as UNLIMITED rather than absent. Storage used to have no
+  // default, so a deal that did not name it resolved to undefined and the
+  // organization's usage card simply omitted the row — the same blank field
+  // that showed "Unlimited" for members showed nothing at all for storage.
+  // Every catalog plan names both, so the defaults only ever apply to a
+  // custom plan. `actions` has no default on purpose: an unnamed allowance
+  // bills nothing, which is why the availability switch refuses to flip
+  // without one.
+  limits: ({ actions, members = infinite, storage = infinite }) => ({
+    campaign: {
+      advertisements: infinite,
+      links: infinite,
+      fields: infinite,
+      pages: infinite
+    },
+    organization: {
+      actions,
+      affiliates: infinite,
+      brands: infinite,
+      campaigns: infinite,
+      members,
+      storage
+    }
+  })
+};
+var free = {
+  conversion: 3,
+  features: all.features(),
+  limits: all.limits({
+    actions: 200,
+    members: 0,
+    storage: gigabyte * 5
+  }),
+  title: "Free"
+};
+var plans = {
+  DB00002: {
+    // A verified sending domain is a PAID capability: free plans cannot send
+    // lead-facing email at all (the send path gates on an active
+    // subscription), so granting it there would offer a domain that can
+    // never send from.
+    features: all.features([organization.networking.key, organization.members.key]),
+    limits: all.limits({ actions: 5e3, members: 3, storage: gigabyte * 10 }),
+    marketing: {
+      description: "Tools to fine-tune campaigns and improve lead quality.",
+      features: [],
+      limits: [
+        ["Actions per month", "5,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "3"],
+        ["Storage", "10GB"]
+      ]
+    },
+    ...overage(2.5),
+    title: "Starter",
+    conversion: 2
+  },
+  DB00003: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 15e3, members: 5, storage: gigabyte * 20 }),
+    marketing: {
+      description: "Expand your reach and grow your lead pipeline.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "15,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "5"],
+        ["Storage", "20GB"]
+      ]
+    },
+    ...overage(2),
+    title: "Pro",
+    conversion: 1.5
+  },
+  DB00004: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 4e4, members: 10, storage: gigabyte * 50 }),
+    marketing: {
+      description: "Accelerate acquisition with more power and flexibility.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "40,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "10"],
+        ["Storage", "50GB"]
+      ]
+    },
+    ...overage(1.85),
+    title: "Premium",
+    conversion: 1
+  },
+  DB00005: {
+    features: all.features([
+      organization.networking.key,
+      organization.advertisements.key,
+      organization.analytics.key,
+      organization.members.key,
+      organization.subdomain.key,
+      page.slug.key
+    ]),
+    limits: all.limits({ actions: 1e5, members: infinite, storage: gigabyte * 100 }),
+    marketing: {
+      description: "Built for brands focused on results.",
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
+      limits: [
+        ["Actions per month", "100,000"],
+        ["Affiliates", "Unlimited"],
+        ["Brands", "Unlimited"],
+        ["Campaigns", "Unlimited"],
+        ["Pages", "Unlimited"],
+        ["Members", "Unlimited"],
+        ["Storage", "100GB"]
+      ]
+    },
+    ...overage(1.5),
+    title: "Elite",
+    conversion: 0.5
+  }
+};
+
+// lib/transactions.js
+var import_drawbridge_telemetry = require("@drawbridge/drawbridge-telemetry");
+
+// lib/billing.js
+var import_drawbridge_telemetry2 = require("@drawbridge/drawbridge-telemetry");
+var logger = (0, import_drawbridge_telemetry2.createLogger)();
+var MARKUP = 1.3;
+var cost = {
+  // gemini-3.5-flash — verified against Google's pricing page 2026-07-09:
+  // $0.15 cached / $1.50 input / $9.00 output per 1M tokens (thinking billed at
+  // output). ~3.6x the retired 2.5-flash output rate.
+  "gemini-3.5-flash": {
+    cached: 15,
+    input: 150,
+    output: 900
+  },
+  // gemini-3.5-flash-lite — verified against Google's pricing page 2026-08-20:
+  // $0.03 cached / $0.30 input / $2.50 output per 1M tokens (thinking billed at
+  // output). A fifth of flash on input, ~a quarter on output. Growth's assistant
+  // ranks the feed on this tier — one call per page — so its rows were the
+  // unpriced ones until now.
+  "gemini-3.5-flash-lite": {
+    cached: 3,
+    input: 30,
+    output: 250
+  },
+  "gemini-2.5-flash": {
+    cached: 3,
+    input: 30,
+    output: 250
+  },
+  "gemini-2.5-flash-image": {
+    cached: 3,
+    input: 30,
+    output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
+  }
+};
+var toolCost = {
+  search: 3.5
+};
+var toolPricing = Object.fromEntries(
+  Object.entries(toolCost).map(([tool, value]) => [
+    tool,
+    Math.ceil(value * MARKUP)
+  ])
+);
+var pricing = Object.fromEntries(
+  Object.entries(cost).map(([model, rates]) => [
+    model,
+    {
+      cached: Math.round(rates.cached * MARKUP),
+      input: Math.round(rates.input * MARKUP),
+      output: Math.round(rates.output * MARKUP)
+    }
+  ])
+);
+
+// lib/pricing.js
+var emailPlans = {
+  essentials50k: {
+    included: 5e4,
+    // The plan's own price is not shown in the console once you are on it —
+    // it reads "Your Current Plan" where the price would be. Left null rather
+    // than guessed; fill from an invoice. Nothing derives from it yet, and an
+    // invented figure would quietly become the basis of an upgrade decision.
+    monthly: null,
+    overageCents: 0.133,
+    title: "Essentials 50K"
+  },
+  essentials100k: {
+    included: 1e5,
+    monthly: 3495,
+    overageCents: 0.09,
+    title: "Essentials 100K"
+  },
+  pro100k: {
+    included: 1e5,
+    monthly: 8995,
+    overageCents: 0.11,
+    title: "Pro 100K"
+  },
+  pro300k: {
+    included: 3e5,
+    monthly: 24900,
+    overageCents: 0.091,
+    title: "Pro 300K"
+  },
+  pro700k: {
+    included: 7e5,
+    monthly: 49900,
+    overageCents: 0.078,
+    title: "Pro 700K"
+  },
+  pro1500k: {
+    included: 15e5,
+    monthly: 79900,
+    overageCents: 0.059,
+    title: "Pro 1.5 Million"
+  },
+  pro2500k: {
+    included: 25e5,
+    monthly: 109900,
+    overageCents: 0.047,
+    title: "Pro 2.5 Million"
+  }
+};
+var emailPlan = "essentials50k";
+var sending = {
+  email: {
+    // Fraction of the included volume that raises the alarm. Far enough ahead
+    // to act on, high enough not to fire on ordinary growth.
+    //
+    // Crossing it is NOT an outage. The provider bills overage rather than
+    // stopping sends, so the alarm is a COST signal: past the included volume
+    // every email is charged at overageCents, and at some run rate the next
+    // plan up is cheaper than the overage. That is the decision it exists to
+    // prompt, and it is why nobody should be woken by it.
+    alertThreshold: 0.8,
+    // Emails per calendar month included, PLATFORM-WIDE and across every send
+    // path: lead-facing mail, workflow steps, and the sign-in codes and
+    // account mail that no plan allowance meters.
+    monthlyCeiling: emailPlans[emailPlan].included,
+    overageCents: emailPlans[emailPlan].overageCents,
+    plan: emailPlan,
+    plans: emailPlans,
+    title: emailPlans[emailPlan].title
+  }
+};
+var channels = {
+  email: {
+    actionsPerSend: 1,
+    includedInAllowance: true
+  },
+  sms: {
+    // Two actions PER SEGMENT (a long message is several segments), billed from
+    // the FIRST segment and never drawn from the plan's included allowance —
+    // carrier cost is real from message one, so there is no free tier of it.
+    actionsPerSegment: 2,
+    includedInAllowance: false
+  }
+};
+
+// lib/connections/drawbridge.js
+var drawbridge_default2 = {
+  auth: {
+    type: "none"
+  },
+  content: {
+    confirm: "This connection is part of Drawbridge and cannot be disconnected.",
+    description: [
+      "Drawbridge sends your notification email and SMS, keeps your segments in sync, and posts to your own endpoints. These are built in rather than connected, so there is nothing here to set up."
+    ],
+    excerpt: "The steps Drawbridge runs itself.",
+    guide: [
+      "Nothing to do. These steps are available in every workflow builder."
+    ]
+  },
+  exclusive: false,
+  fields: [],
+  group: "developer",
+  // EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
+  // suppression collection and the queues; segment sync needs the streams. A
+  // published package carrying those makes every consumer carry them, which is
+  // the reason `{}` exists as an answer.
+  hooks: {
+    auth: {
+      // Nothing to connect, revoke, probe or re-scope.
+      connect: false,
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      token: false
+    },
+    commerce: false,
+    // DRAWBRIDGE'S OWN CRM. Not a merchant's — this keeps our HubSpot portal in
+    // step with account signups, and drawbridge-sync's user stream calls it.
+    //
+    // A real implementation here rather than `{}` because the bodies are pure
+    // HTTP against a token: no controller, no queue, nothing that would have to
+    // live in the service. lib/hubspot.js holds them, beside lib/sendgrid.js
+    // and lib/twilio.js, which are the same kind of thing — vendor clients for
+    // accounts DRAWBRIDGE holds rather than ones a merchant connects.
+    contacts,
+    email: {
+      digest: {},
+      // To organization members. NEVER suppressed and never billed: an
+      // entrant's opt-out must not silence an alert to staff, and staff mail is
+      // not a metered send.
+      notify: {},
+      // To a lead. Suppression applies and the send is billed.
+      send: {}
+    },
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      audiences: false,
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    segment: { sync: {} },
+    sms: { send: {} },
+    webhook: false
+  },
+  icon: drawbridge_default,
+  // PRIVATE: never in the catalog, always available to the builder.
+  private: true,
+  // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
+  //
+  // `requires` gates AVAILABILITY: a name in it that is unset removes the whole
+  // connection. This one is private and contributes every base workflow step —
+  // email.send, sms.send, segment.sync — so gating it on a CRM token would take
+  // all of them away from any deployment without a HubSpot portal, to protect a
+  // sync that is best-effort and already no-ops without a token.
+  //
+  // The test 'a vendor is only available when its environment is configured'
+  // caught exactly that: availableConnections({}) went from [ 'drawbridge' ] to
+  // empty the moment this was added.
+  requires: [],
+  slug: "drawbridge",
+  // Always on. There is no credential that could go bad and no configuration a
+  // merchant could leave half-finished.
+  status: () => "active",
+  // DERIVED FROM drawbridge-api/lib/workflows.js, not invented. Every value
+  // below — trigger, billable, settings — is what that catalog and the workflow
+  // route already enforce today, because this replaces them rather than
+  // competing with them.
+  //
+  // NOT HERE, deliberately:
+  //
+  //   step.segment.sync  a SYSTEM step, dispatched by drawbridge-sync rather
+  //                      than offered in the builder. It fans out, so the shell
+  //                      opens its step document and the chunks close it.
+  steps: {
+    email: {
+      // SCHEDULE-TRIGGERED, not lead-triggered: it is offered under Daily,
+      // Weekly and Monthly. Those triggers had offered no steps at all, so a
+      // scheduled workflow was selectable and inert until this landed.
+      digest: () => ({
+        hook: "email.digest",
+        key: "Email \u2014 Digest",
+        queue: "notification",
+        settings: {
+          // The organization OWNER is always a recipient, resolved in sync,
+          // so this is additional recipients rather than the list. It cannot
+          // be required: the members endpoint is owner-gated and the owner is
+          // not a member document, so a solo merchant has nothing to pick and
+          // could never save the step.
+          members: { of: "string", type: "array" },
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["schedule.day", "schedule.week", "schedule.month"],
+        usage: { actions: 0 }
+      }),
+      // To organization MEMBERS. Never suppressed — an entrant's opt-out must
+      // not silence an alert to staff — and not billed.
+      notify: () => ({
+        hook: "email.notify",
+        key: "Email \u2014 Notification",
+        queue: "notification",
+        settings: {
+          members: { of: "string", type: "array" },
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["lead.insert"],
+        // Zero is a PRICE, and a deliberate one. Declared rather than omitted
+        // so "this is free" and "nobody decided" stay different statements;
+        // completeStep bills only when actions > 0.
+        usage: { actions: 0 }
+      }),
+      // To a LEAD. Suppression applies and the send is billed.
+      send: () => ({
+        hook: "email.send",
+        key: "Email \u2014 Send email",
+        queue: "notification",
+        settings: {
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        triggers: ["lead.insert"],
+        // ONE SOURCE FOR THE PRICE. lib/pricing.js is the index of every
+        // customer-facing number; the handler read it too, so the same fact
+        // was stated in two places and only one of them was reviewed.
+        usage: { actions: channels.email.actionsPerSend }
+      })
+    },
+    // WITHDRAWN, which is a third thing from builder and system: declared,
+    // routed and runnable, but never offered.
+    //
+    // It went when the twilio connection did — a connection-gated step with no
+    // connection to gate on could only ever render permanently disabled. Stored
+    // workflows still carry it, so it must keep running, and enums.step.type
+    // keeps it for the same reason.
+    //
+    // NO TRIGGERS is what keeps it out of the builder: the catalog derives from
+    // triggers, so a step with none is unreachable by a merchant without a
+    // second list saying so.
+    //
+    // Platform SMS returns as a base step the way email did. That is this entry
+    // gaining triggers, not a new one.
+    sms: {
+      send: () => ({
+        hook: "sms.send",
+        key: "Send an SMS",
+        queue: "notification",
+        settings: {
+          message: { required: true, type: "string" },
+          subject: { required: true, type: "string" }
+        },
+        // Priced per SEGMENT and billed from the first, which the send
+        // resolves from the message length. This is the floor.
+        usage: { actions: channels.sms.actionsPerSegment },
+        withdrawn: true
+      })
+    },
+    segment: {
+      // FANS OUT. It evaluates every contact in the organization against every
+      // segment, which is too much for one job — so the hook returns chunks and
+      // the shell defers completion: openStep writes the document with a slot
+      // per chunk, and whichever chunk lands last closes it and resumes the
+      // chain.
+      //
+      // It carries a hook like every other step. An earlier version declared
+      // none, on the theory that fan-out was a second protocol the shell could
+      // not run; it is the same protocol with the ending deferred, and a step
+      // declaring no hook is silently SKIPPED by the runner.
+      sync: () => ({
+        description: "Recalculates segment membership on a daily schedule.",
+        hook: "segment.sync",
+        key: "Segment Sync",
+        queue: "segment",
+        system: true
+      })
+    }
+  },
+  tasks: () => [],
+  title: "Drawbridge"
+};
+
+// lib/connections/icons/klaviyo.js
+var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="white"/>
+<path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
+</svg>`;
+
+// lib/connections/klaviyo.js
+var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
+  const response = await fetcher("https://a.klaviyo.com/api" + path, {
+    ...payload && { body: JSON.stringify(payload) },
+    headers: {
+      // Bearer, not Klaviyo-API-Key — that header is for private keys, and
+      // sending it with an OAuth token fails in a way that reads like a bad
+      // token rather than a bad scheme.
+      authorization: "Bearer " + token,
+      ...payload && { "content-type": "application/json" },
+      // Klaviyo pins its API by DATE. A request without this header is
+      // refused, and one with an old date keeps the response shape that date
+      // shipped with — which is the point: bumping it is a deliberate act
+      // with a changelog to read, not something that drifts under us.
+      revision: "2026-07-15"
+    },
+    method,
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) {
+    throw Object.assign(
+      new Error("Klaviyo refused the request (" + response.status + ")"),
+      { status: response.status }
+    );
+  }
+  return response.status === 204 ? null : response.json();
+};
+var klaviyo_default2 = {
+  // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
+  // exchange without a code_verifier matching the challenge the consent
+  // carried. Most vendors treat it as optional hardening; this one does not,
+  // which is why it is a descriptor flag and not a global.
+  //
+  // HTTP Basic on the token endpoint is the other thing Klaviyo does
+  // differently, and it says so in hooks.auth.token rather than as a flag here.
+  auth: {
+    oauth: {
+      // NAMES the env vars holding OUR application's client. One identity,
+      // every merchant — the token is the merchant's and arrives from their
+      // own consent, which is what stops one organization reading another's
+      // data.
+      //
+      client: {
+        id: "KLAVIYO_OAUTH_CLIENT_ID",
+        secret: "KLAVIYO_OAUTH_CLIENT_SECRET"
+      },
+      // Klaviyo drops a refresh token after 90 days of NON-USE. The vendor
+      // never mentions this at runtime — you discover it when a refresh fails
+      // on a connection nobody touched — so it is declared, and it is why
+      // auth.probe has to run on a schedule rather than only before a call.
+      //
+      // Token lifetime is NOT declared: the vendor states it on every
+      // exchange, and a copy here would be a second answer that goes stale.
+      expiry: 90 * 24 * 60 * 60,
+      pkce: true,
+      // Space separated. accounts:read is required by Klaviyo on every app
+      // and must stay in the list; the rest are what a contact sync needs.
+      scopes: "accounts:read lists:read lists:write profiles:read profiles:write",
+      // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
+      // the disconnect hook — three vendor addresses, two of them declared,
+      // which is exactly the kind of split that goes unnoticed.
+      urls: {
+        // TWO DIFFERENT HOSTS, and swapping them fails in opposite ways.
+        //
+        // authorize is a page a HUMAN loads, and it lives on www. Pointing it
+        // at a.klaviyo.com — their API host — sends the merchant somewhere
+        // that never renders a consent screen, so the journey stalls with no
+        // error anybody can see.
+        //
+        // token and revoke are server calls and must stay on a.klaviyo.com:
+        // Klaviyo began blocking OAuth token traffic through www on
+        // 2025-03-31, so the mirror image of this mistake breaks the exchange
+        // instead of the consent.
+        authorize: "https://www.klaviyo.com/oauth/authorize",
+        // WHERE THE MERCHANT LANDS — the dashboard, not drawbridge-api. The
+        // `/api/` segment is Next's route-handler convention, which reads as
+        // the api service to everyone who sees it; it is not, and the route
+        // has never moved. build() pins it against the one callback route
+        // that exists, because declared-but-wrong fails AFTER consent — a
+        // 404 for someone who has already granted access.
+        //
+        // Registered in Klaviyo's own app settings, and they refuse anything
+        // that does not byte-match, so it is a fact about someone else's
+        // records rather than a string this code computes.
+        redirect: "/api/connection/klaviyo/callback",
+        revoke: "https://a.klaviyo.com/oauth/revoke",
+        token: "https://a.klaviyo.com/oauth/token"
+      }
+    },
+    type: "oauth"
+  },
+  // EVERYTHING A MERCHANT READS. Grouped by who it is for rather than by what
+  // kind of sentence it is, so the question on the next vendor is "does a person
+  // read this", which nobody gets wrong, instead of "is this marketing", which
+  // someone will.
+  //
+  // `errors` is in here rather than at the top level, and that is not a
+  // preference. The connection DOCUMENT carries its own `errors` array of
+  // scope-drift entries, and the document is spread OVER the resolved manifest
+  // downstream — so a top-level `errors` here would be silently replaced by that
+  // array and this copy would never render. `fields`/`settings` already carry a
+  // comment about the same collision.
+  content: {
+    // Shown at disconnect, so it says what is lost and what is not.
+    confirm: "Disconnecting revokes Drawbridge's access to your Klaviyo account. Your profiles and lists stay in both Klaviyo and Drawbridge \u2014 neither is deleted.",
+    description: [
+      "Connecting Klaviyo lets Drawbridge sync the contacts your campaigns collect into a Klaviyo list, so the people who enter a giveaway can be marketed to alongside the rest of your audience.",
+      "You authorize Drawbridge from inside Klaviyo and can revoke that access there at any time. Drawbridge never sees or stores your Klaviyo password, and only asks for the permissions listed on the consent screen.",
+      "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing."
+    ],
+    // KEYED BY WHAT FAILED, not nested inside it. Errors are the thing most
+    // likely to grow — resources.* has already earned somewhere to put "we
+    // could not load your lists" — so a new area adds a key here rather than a
+    // second errors object somewhere else.
+    //
+    // `connect` no longer exists as a container above: its only other member
+    // was `redirect`, which moved to auth.oauth.urls with the rest of the
+    // vendor's addresses.
+    errors: {
+      connect: {
+        denied: "The Klaviyo authorization was declined, so nothing was connected.",
+        invalid: "We couldn't complete the Klaviyo connection. Try connecting again."
+      }
+    },
+    excerpt: "Sync the contacts your campaigns collect into a Klaviyo list.",
+    // HOW TO CONNECT, in the merchant's words. Was `setup`, which nothing
+    // rendered — four useful instructions no component displayed.
+    guide: [
+      "Press Connect. Drawbridge sends you to Klaviyo to approve access.",
+      "Sign in to Klaviyo if you are not already, and choose the account to connect.",
+      "Approve the permissions Klaviyo lists. You are returned here and the connection shows Active.",
+      "You can revoke access at any time from Klaviyo, under Integrations."
+    ]
+  },
+  // CAN A MERCHANT KEEP TWO OF THESE AT ONCE?
+  //
+  // Required, and false is a decision rather than a default. Shopify is
+  // exclusive because a store maps to exactly one organization. Contact syncs
+  // are destinations — someone can reasonably keep Klaviyo and Mailchimp both
+  // current — so the exclusivity that once applied when these were SENDERS is
+  // deliberately gone. That was removed once already; declaring it out loud is
+  // what stops it coming back by inference.
+  exclusive: false,
+  feature: "organization:connection:klaviyo",
+  fields: [
+    {
+      key: "account",
+      label: "Klaviyo account"
+    },
+    {
+      // The choices come from the merchant's own account, so the field names
+      // the capability and the client composes the url.
+      hook: "resources.audiences",
+      input: "select",
+      key: "list",
+      label: "Klaviyo list",
+      message: "Contacts your campaigns collect are synced into this list.",
+      required: true,
+      // Klaviyo's list endpoint carries no name filter, so the hook can only
+      // match what it already fetched. A search box that searches one page is
+      // worse than none, so the picker does not offer one.
+      search: false
+    }
+  ],
+  // WHAT KIND OF THING THIS IS. One field, not two — `category` said the same
+  // thing and was read by nothing, while `group` was quietly doing double duty
+  // as the mutual-exclusion key. The exclusion moved to `exclusive` above, so
+  // this is purely how a connection is grouped and labelled.
+  group: "contacts",
+  // Nothing typed at connect. The consent returns the grant, and the account it
+  // belongs to is read back from Klaviyo rather than asked for.
+  hooks: {
+    auth: {
+      // Turn a fresh grant into settings worth showing. Without this the card
+      // renders an empty "Klaviyo account" field, because the merchant is
+      // never asked which account they connected — the consent already
+      // decided it, and asking again would be a question we can answer.
+      connect: async ({ fetcher, tokens }) => {
+        var _a, _b, _c;
+        const body = await api("/accounts", { fetcher, token: tokens.accessToken });
+        const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
+        return {
+          account: ((_c = (_b = account == null ? void 0 : account.attributes) == null ? void 0 : _b.contact_information) == null ? void 0 : _c.organization_name) || (account == null ? void 0 : account.id) || null,
+          accountId: (account == null ? void 0 : account.id) || null
+        };
+      },
+      // Revoke at KLAVIYO, not just locally. Forgetting our copy leaves the
+      // grant live in the merchant's account, so a disconnect that looks
+      // complete here still shows Drawbridge with access over there.
+      //
+      // Basic auth with our client, exactly like the token exchange — the
+      // token being revoked is the subject, not the credential.
+      disconnect: async ({ clientId, clientSecret, fetcher = fetch, manifest, settings }) => {
+        const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
+        if (!token) return { revoked: false };
+        const response = await fetcher(manifest.auth.oauth.urls.revoke, {
+          body: new URLSearchParams({
+            token,
+            token_type_hint: (settings == null ? void 0 : settings.refreshToken) ? "refresh_token" : "access_token"
+          }),
+          headers: {
+            authorization: "Basic " + Buffer.from(clientId + ":" + clientSecret).toString("base64"),
+            "content-type": "application/x-www-form-urlencoded"
+          },
+          method: "POST",
+          signal: AbortSignal.timeout(15e3)
+        });
+        return { revoked: response.ok };
+      },
+      // THE MINT IS THE PROBE. Asking "is this token still good" by
+      // inspecting what we stored answers the wrong question — a grant
+      // revoked inside Klaviyo still looks perfect in our database. Spending
+      // the refresh token is the only thing that asks Klaviyo.
+      //
+      // It also keeps the grant warm against the 90-day idle window above.
+      probe: async ({ clientId, clientSecret, fetcher, manifest, settings }) => {
+        const token = await accessToken({
+          clientId,
+          clientSecret,
+          fetcher,
+          // Mint even if the stored token still looks good — a probe that
+          // short-circuits never reaches Klaviyo and reports healthy on a
+          // grant revoked an hour ago.
+          force: true,
+          manifest,
+          settings
+        });
+        return { ok: Boolean(token) };
+      },
+      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
+      scopes: false,
+      // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
+      // client_id/client_secret pair as body fields. Everything else about the
+      // request is standard, so this is the shared implementation told the one
+      // thing that differs — in Klaviyo's own file, beside the rest of what
+      // makes Klaviyo unusual, rather than as a flag a caller has to know to
+      // read.
+      token: (args) => authToken({ ...args, basic: true })
+    },
+    // No commerce here. Klaviyo tracks orders, but Drawbridge's order data comes
+    // from the store that took the money — a second source for the same event
+    // is two answers to "did this person buy", and the one we can bill from is
+    // the store's.
+    commerce: false,
+    // The verb the contacts.sync step points at. It does the work — including
+    // writing the profile id back onto the lead — and returns what happened.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from deleting the profile.
+      remove: false,
+      sync: async ({ contact, fetcher, lead, settings, suppressed, token }) => {
+        var _a, _b, _c;
+        const list = settings == null ? void 0 : settings.list;
+        if (!list) return { message: "No Klaviyo list is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        if (!email) return { message: "That lead has no email address to sync.", skipped: true };
+        const totals = (contact == null ? void 0 : contact.totals) || {};
+        const profile = await api("/profiles/", {
+          fetcher,
+          method: "POST",
+          payload: {
+            data: {
+              attributes: {
+                email,
+                ...(lead == null ? void 0 : lead.name) && { first_name: String(lead.name).trim().split(/\s+/)[0] },
+                properties: {
+                  drawbridge_campaigns: ((contact == null ? void 0 : contact.campaigns) || []).length,
+                  drawbridge_draws: totals.draws || 0,
+                  drawbridge_entries: totals.entries || 0,
+                  drawbridge_orders: totals.orders || 0,
+                  // Campaign-attributed, NOT lifetime. A merchant running
+                  // Shopify already has lifetime revenue in Klaviyo through
+                  // Klaviyo's own integration; what only we can say is how
+                  // much a campaign drove. Named so the two cannot be
+                  // mistaken for one another in a segment builder.
+                  drawbridge_revenue: totals.gross || 0
+                }
+              },
+              type: "profile"
+            }
+          },
+          token
+        });
+        const profileId = (_c = profile == null ? void 0 : profile.data) == null ? void 0 : _c.id;
+        if (!profileId) return { message: "Klaviyo returned no profile id.", skipped: true };
+        await api("/profile-subscription-bulk-create-jobs/", {
+          fetcher,
+          method: "POST",
+          payload: {
+            data: {
+              attributes: {
+                profiles: {
+                  data: [{
+                    attributes: {
+                      email,
+                      subscriptions: {
+                        email: { marketing: { consent: suppressed ? "UNSUBSCRIBED" : "SUBSCRIBED" } }
+                      }
+                    },
+                    type: "profile"
+                  }]
+                }
+              },
+              relationships: { list: { data: { id: list, type: "list" } } },
+              type: "profile-subscription-bulk-create-job"
+            }
+          },
+          token
+        });
+        return {
+          // Merged into `context` for later steps in this run.
+          context: { klaviyoProfileId: profileId },
+          message: suppressed ? "Synced to Klaviyo as unsubscribed \u2014 this contact has opted out." : "Synced to the Klaviyo list.",
+          // Recorded on the run for support to read back, not a write
+          // instruction — the hook has already written what it needed to.
+          response: { klaviyoProfileId: profileId }
+        };
+      }
+    },
+    // A WHOLE DOMAIN CAN DECLINE AT ONCE. Klaviyo sends us nothing and we
+    // register nothing with it, so listing four falses would be noise around a
+    // single decision. Still explicit — absence would not say whether anybody
+    // considered it.
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    // Nothing to set up or tear down at the vendor: the grant is the whole
+    // integration, and revoking it is auth.disconnect's job.
+    lifecycle: false,
+    resources: {
+      // The lists a merchant can sync into, for the picker on their
+      // connection.
+      //
+      // PAGINATED DELIBERATELY. Klaviyo caps page[size] at 10 and defaults to
+      // it, so one call quietly returns the first ten lists and an account
+      // with more shows a picker missing the one they wanted, with nothing to
+      // indicate anything was cut.
+      audiences: async ({ cursor, fetcher, limit = 100, search, token }) => {
+        var _a, _b;
+        const audiences = [];
+        let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
+        let pages = 0;
+        while (next && audiences.length < limit && pages < 20) {
+          const body = await api(next, { fetcher, token });
+          for (const list of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          }
+          const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
+          next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
+          pages = pages + 1;
+        }
+        const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
+        return {
+          items: term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences,
+          pageInfo: {
+            endCursor: next,
+            hasNextPage: Boolean(next)
+          }
+        };
+      },
+      // Klaviyo sells no products and mints no discount codes.
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
+  },
+  icon: klaviyo_default,
+  requires: [
+    "KLAVIYO_OAUTH_CLIENT_ID",
+    "KLAVIYO_OAUTH_CLIENT_SECRET"
+  ],
+  slug: "klaviyo",
+  // ONE OF THE FOUR STATES AND NOTHING ELSE — the reason sits in `tasks`, which
+  // is already the merchant-facing copy channel and is already rendered.
+  //
+  // A grant with no list chosen is authenticated and useless. The list cannot be
+  // part of the consent flow — enumerating lists needs the token the consent
+  // returns — so it is always a second step, and the card must say Pending
+  // rather than Active over nothing.
+  //
+  // Otherwise the credential's own verdict stands. A manifest can only ever
+  // DOWNGRADE: it can see the settings, and it cannot see whether the grant was
+  // revoked at Klaviyo an hour ago.
+  //
+  // Computed at read time rather than written, for the same reason
+  // shopifyMissingScopes is: it becomes true the moment a merchant clears the
+  // list, without waiting for something to notice and write it down.
+  status: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? data2.status : "pending";
+  },
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. It names the hook that does the work, and
+      // says where that hook's values belong. Nested like the hooks, and the
+      // nesting IS the name: this is `step.contacts.sync`, which is what a
+      // workflow document stores.
+      //
+      // A function, so it can depend on what this deployment or this
+      // merchant's connection knows — a static object would have to be true
+      // for every deployment at publish time.
+      sync: ({ data: data2 }) => {
+        var _a;
+        return {
+          hook: "contacts.sync",
+          // The account the merchant actually connected, read back by
+          // auth.connect. The builder reads "Sync contact to Acme Co" rather
+          // than a label that could be any of their Klaviyo accounts.
+          key: "Sync contact to " + (((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.account) || "Klaviyo"),
+          queue: "connection",
+          // Nothing for a merchant to configure on the step itself — the list
+          // is chosen once on the connection. Declared empty rather than
+          // omitted, so "this step takes no settings" and "nobody thought about
+          // settings" are different statements.
+          settings: {},
+          // BOTH triggers. lead.insert alone only ever fires for someone with
+          // no history yet — a brand-new entrant has no orders and no revenue,
+          // so a profile written then carries an email and nothing else.
+          // Crossing into a segment is the moment the ranking data exists.
+          triggers: ["lead.insert", "segment.contact.add"],
+          // One source for cost: what the builder discloses before a merchant
+          // adds this step, and what is charged when it runs.
+          usage: { actions: 1 }
+        };
+      }
+    }
+  },
+  // WHY, in the merchant's words, and what to do about it.
+  tasks: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [
+      {
+        message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose a list"
+      }
+    ];
+  },
+  title: "Klaviyo"
+};
+
+// lib/connections/icons/mailchimp.js
+var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#FFE01B"/>
+<path d="M310.633 243.561C312.49 243.336 314.249 243.308 315.882 243.561C316.81 241.394 316.979 237.665 316.149 233.598C314.882 227.561 313.18 223.917 309.662 224.508C306.13 225.071 305.989 229.433 307.269 235.47C307.973 238.847 309.24 241.746 310.633 243.561ZM280.392 248.332C282.925 249.429 284.473 250.147 285.05 249.542C285.458 249.148 285.345 248.36 284.74 247.375C283.112 245.042 280.844 243.229 278.211 242.154C275.397 240.982 272.328 240.556 269.301 240.916C266.274 241.275 263.391 242.41 260.93 244.209C259.256 245.447 257.666 247.15 257.863 248.191C257.961 248.515 258.186 248.782 258.777 248.895C260.17 249.049 265.025 246.587 270.64 246.249C274.608 245.968 277.859 247.206 280.392 248.332ZM275.312 251.216C272.047 251.737 270.232 252.807 269.078 253.848C268.079 254.72 267.488 255.649 267.488 256.339L267.741 256.93L268.262 257.127C269.008 257.127 270.668 256.479 270.668 256.479C275.228 254.861 278.253 255.044 281.25 255.382C282.897 255.579 283.671 255.663 284.037 255.1C284.135 254.931 284.29 254.608 283.938 254.059C283.15 252.778 279.843 250.682 275.312 251.216ZM300.416 261.855C302.654 262.953 305.102 262.502 305.904 260.884C306.735 259.266 305.567 257.056 303.329 255.973C301.106 254.861 298.643 255.283 297.841 256.902C297.039 258.52 298.207 260.757 300.416 261.855ZM314.742 249.317C312.94 249.289 311.449 251.259 311.393 253.764C311.35 256.254 312.8 258.281 314.615 258.295C316.43 258.323 317.922 256.339 317.964 253.862C318.006 251.385 316.571 249.359 314.742 249.317ZM193.103 294.108C192.653 293.545 191.907 293.7 191.189 293.897C190.683 293.995 190.12 294.136 189.515 294.122C188.909 294.134 188.308 293.998 187.767 293.726C187.225 293.454 186.757 293.054 186.405 292.56C185.575 291.294 185.617 289.394 186.546 287.241L186.968 286.27C188.431 283.019 190.838 277.559 188.122 272.367C187.234 270.534 185.908 268.948 184.261 267.75C182.614 266.553 180.697 265.78 178.679 265.5C176.772 265.256 174.835 265.469 173.026 266.123C171.218 266.776 169.591 267.85 168.28 269.257C164.284 273.661 163.679 279.684 164.439 281.823C164.734 282.611 165.184 282.822 165.494 282.864C166.169 282.963 167.169 282.456 167.802 280.754L167.999 280.219C168.28 279.318 168.801 277.63 169.659 276.307C170.717 274.689 172.375 273.558 174.267 273.162C176.159 272.766 178.131 273.138 179.749 274.196C182.563 276.039 183.619 279.473 182.423 282.752C181.803 284.455 180.804 287.691 181.015 290.351C181.466 295.74 184.815 297.907 187.77 298.175C190.669 298.273 192.695 296.655 193.216 295.459C193.511 294.713 193.258 294.277 193.103 294.108Z" fill="#231E15"/>
+<path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
+</svg>`;
+
+// lib/connections/mailchimp.js
+var base = (dc) => {
+  if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
+  return "https://" + dc + ".api.mailchimp.com/3.0";
+};
+var mailchimp_default2 = {
+  // OAUTH 2, authorization code. Every url below is quoted from
+  // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
+  // than remembered.
+  //
+  // THE METADATA CALL IS MAILCHIMP'S QUIRK and cannot be skipped: an access
+  // token alone cannot call the Marketing API, because every account lives
+  // behind a data-centre prefix (us1, us19...) that only GET
+  // login.mailchimp.com/oauth2/metadata returns — and every subsequent request
+  // needs it in the HOST. That is why auth.connect below is a real function:
+  // the standard exchange does not know where to send anything afterwards.
+  //
+  // No PKCE. No scopes — the docs describe none. And no refresh token: "Mailchimp
+  // Marketing access tokens do not expire, so you don't need to use a
+  // refresh_token", so tokenSettings stores no expiry and isStale reads that as
+  // nothing to refresh toward.
+  //
+  // auth.token stays false: the exchange is POST form-encoded with grant_type,
+  // client_id, client_secret, redirect_uri and code, which is exactly the
+  // runner's default — nothing to wrap.
+  auth: {
+    oauth: {
+      client: {
+        id: "MAILCHIMP_OAUTH_CLIENT_ID",
+        secret: "MAILCHIMP_OAUTH_CLIENT_SECRET"
+      },
+      urls: {
+        authorize: "https://login.mailchimp.com/oauth2/authorize",
+        redirect: "/api/connection/mailchimp/callback",
+        token: "https://login.mailchimp.com/oauth2/token"
+      }
+    },
+    type: "oauth"
+  },
+  // EVERYTHING A MERCHANT READS. `errors` belongs in here rather than at the
+  // top level because the connection DOCUMENT carries its own `errors` array
+  // and the document is spread OVER the resolved manifest downstream — a
+  // top-level one would be replaced by that array and never render.
+  content: {
+    confirm: "Disconnecting removes Drawbridge's stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
+    description: [
+      "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
+      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships."
+    ],
+    excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
+    guide: [
+      "Press Connect. Drawbridge sends you to Mailchimp to approve access.",
+      "Sign in to Mailchimp if you are not already, and choose the account to connect.",
+      "You come back here to pick the audience your contacts should sync into."
+    ]
+  },
+  // Mailchimp and SendGrid shared a group while they were SENDERS, where an org
+  // picking two providers to send the same mail was meaningless. As contact
+  // syncs they are destinations, and a merchant could reasonably keep several
+  // up to date, so the exclusivity is gone.
+  exclusive: false,
+  feature: "organization:connection:mailchimp",
+  fields: [
+    {
+      input: "select",
+      key: "audience",
+      label: "Mailchimp audience",
+      message: "Contacts your campaigns collect are synced into this audience.",
+      hook: "resources.audiences",
+      required: true,
+      // Mailchimp's /lists takes no name filter either — same reason.
+      search: false
+    }
+  ],
+  group: "contacts",
+  // A HOOK'S VALUE IS ITS ANSWER. A key is stored and can be removed; nothing
+  // else is built yet, because audience sync has not shipped. Every false here
+  // is "not yet" rather than "never" — when the sync lands, probe and
+  // contacts.sync are the first to flip.
+  hooks: {
+    auth: {
+      // WHERE THE ACCOUNT LIVES. Not enrichment — without this the connection
+      // is unusable, because the Marketing API host is per-account and only
+      // this call knows it. The callback merges what this returns into the
+      // stored settings, which is how `dc` reaches every later request.
+      //
+      // The header here is `OAuth <token>`, not Bearer — that is specific to
+      // the metadata endpoint. Marketing API calls take Bearer; see the
+      // audiences hook.
+      connect: async ({ fetcher = fetch, tokens }) => {
+        const response = await fetcher("https://login.mailchimp.com/oauth2/metadata", {
+          headers: {
+            authorization: "OAuth " + (tokens == null ? void 0 : tokens.accessToken)
+          },
+          signal: AbortSignal.timeout(15e3)
+        });
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp would not say which data centre this account is on (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        if (!(body == null ? void 0 : body.dc)) throw new Error("Mailchimp returned no data centre for this account");
+        return { dc: body.dc };
+      },
+      // Nothing to call. A merchant revokes Drawbridge from Mailchimp's own
+      // Authorized Apps page; the docs describe no revocation endpoint for us
+      // to call on their behalf.
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      // The plain exchange. Mailchimp takes the client as FORM FIELDS
+      // (grant_type, client_id, client_secret, redirect_uri, code), which is
+      // the runner's default — so no `basic : true` as Klaviyo needs.
+      //
+      // build() requires an oauth manifest to name this explicitly rather than
+      // letting it default, which caught this file declaring `false` on the
+      // first import after the conversion.
+      token: authToken
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      // The audiences a merchant can sync into, for the picker on their
+      // connection.
+      //
+      // count DEFAULTS TO 10 and maxes at 1000 (Mailchimp's own OpenAPI spec),
+      // so leaving it unset returns the first ten audiences and looks entirely
+      // successful — the same silent truncation Klaviyo has, at a different
+      // number. Paged against total_items so an account past a thousand still
+      // resolves.
+      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
+        const dc = settings == null ? void 0 : settings.dc;
+        const count = Math.min(limit, 1e3);
+        const offset = Number(cursor || 0);
+        const response = await fetcher(
+          base(dc) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          {
+            headers: { authorization: "Bearer " + token },
+            signal: AbortSignal.timeout(15e3)
+          }
+        );
+        if (!response.ok) {
+          throw Object.assign(
+            new Error("Mailchimp refused the request (" + response.status + ")"),
+            { status: response.status }
+          );
+        }
+        const body = await response.json();
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
+        const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
+        const nextOffset = offset + count;
+        const more = nextOffset < Number((body == null ? void 0 : body.total_items) || 0);
+        return {
+          items,
+          pageInfo: {
+            endCursor: more ? String(nextOffset) : null,
+            hasNextPage: more
+          }
+        };
+      },
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
+  },
+  icon: mailchimp_default,
+  // The OAuth client this deployment registered. Without both, the vendor drops
+  // out of availableConnections rather than offering a Connect button that
+  // cannot complete.
+  requires: [
+    "MAILCHIMP_OAUTH_CLIENT_ID",
+    "MAILCHIMP_OAUTH_CLIENT_SECRET"
+  ],
+  slug: "mailchimp",
+  // A key with no audience chosen is authenticated and inert. Mailchimp also
+  // needs its merge fields created on that audience before any Drawbridge total
+  // can be written to a member — unlike Klaviyo, its custom fields are not
+  // schemaless — so the audience must be picked before lifecycle.register has
+  // anything to register against.
+  status: (data2) => {
+    var _a;
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? data2.status : "pending";
+  },
+  // No steps: audience sync has not shipped, so this vendor contributes nothing
+  // to a workflow yet. An empty steps object is the honest declaration — the
+  // catalog renders the connection, and no builder offers a step it cannot run.
+  steps: {},
+  tasks: (data2) => {
+    var _a;
+    return [
+      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
+        {
+          message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
+          title: "Choose an audience"
+        }
+      ],
+      {
+        message: "Contact syncing to Mailchimp audiences has not shipped yet, and this connection no longer sends your email. Nothing is being sent to Mailchimp right now.",
+        title: "Audience sync not available yet",
+        type: "warning"
+      }
+    ];
+  },
+  title: "Mailchimp"
+};
+
+// lib/connections/icons/shopify.js
+var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M309.524 407.192L308.799 128.423C306.921 126.545 303.258 127.112 301.827 127.531L292.29 130.487C291.113 126.613 289.585 122.854 287.726 119.258C280.959 106.337 271.069 99.5052 259.096 99.4866H259.059C258.259 99.4866 257.469 99.5609 256.67 99.626L256.577 99.6353C256.231 99.2089 255.871 98.7935 255.499 98.3897C250.293 92.8125 243.601 90.0889 235.588 90.3213C220.139 90.7675 204.755 101.941 192.271 121.786C183.487 135.757 176.823 153.298 174.917 166.878L144.493 176.313C135.542 179.129 135.263 179.408 134.082 187.858C133.199 194.253 109.766 375.69 109.766 375.69L306.159 409.692L309.524 407.192ZM245.181 103.065C242.569 101.346 239.511 100.546 235.885 100.621C212.033 101.308 191.23 138.611 185.923 163.467L208.771 156.384L212.851 155.119C215.845 139.336 223.355 122.957 233.181 112.416C236.616 108.639 240.671 105.477 245.172 103.065H245.181ZM224.145 151.615L256.94 141.446C257.042 132.894 256.112 120.252 251.836 111.329C247.282 113.207 243.452 116.497 240.7 119.444C233.329 127.373 227.315 139.466 224.155 151.615H224.145ZM267.211 138.267L282.455 133.536C280.02 125.616 274.238 112.342 262.517 110.111C266.161 119.527 267.099 130.431 267.211 138.267Z" fill="#95BF47"/>
+<path d="M353.528 149.156C352.356 149.063 329.657 148.709 329.657 148.709C329.657 148.709 310.666 130.249 308.789 128.362C308.062 127.691 307.141 127.268 306.158 127.153V409.64L391.257 388.456C391.257 388.456 356.53 153.366 356.307 151.758C356.199 151.075 355.866 150.448 355.361 149.976C354.856 149.505 354.216 149.216 353.528 149.156Z" fill="#5E8E3E"/>
+<path d="M258.993 193.019L249.103 230.052C249.103 230.052 238.079 225.023 225 225.85C205.833 227.059 205.628 239.171 205.824 242.21C206.865 258.756 250.376 262.381 252.821 301.171C254.745 331.688 236.656 352.574 210.592 354.21C179.313 356.19 162.089 337.711 162.089 337.711L168.716 309.472C168.716 309.472 186.052 322.569 199.921 321.686C208.993 321.119 212.228 313.738 211.903 308.514C210.536 286.921 175.102 288.185 172.862 252.695C170.985 222.811 190.57 192.554 233.803 189.821C250.46 188.762 258.993 193.028 258.993 193.028" fill="white"/>
+</svg>`;
+
+// lib/connections/inbound.js
+var import_node_crypto2 = require("crypto");
+var verifySignature = ({ body, descriptor, headers }) => {
+  const provided = headers[descriptor.headers.signature];
+  if (!provided) {
+    throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
+  }
+  const digest = (0, import_node_crypto2.createHmac)(descriptor.signature.algorithm, process.env[descriptor.signature.secret]).update(body).digest(descriptor.signature.encoding);
+  const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
+  const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
+  if (digestBuffer.length !== providedBuffer.length || !(0, import_node_crypto2.timingSafeEqual)(digestBuffer, providedBuffer)) {
+    throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
+  }
+  return JSON.parse(body.toString());
+};
+var readEventHeader = ({ descriptor, headers }) => headers[descriptor.headers.event];
+
+// lib/connections/shopify.js
+var inbound = {
+  headers: {
+    event: "x-shopify-topic",
+    id: "x-shopify-webhook-id",
+    shop: "x-shopify-shop-domain",
+    signature: "x-shopify-hmac-sha256"
+  },
+  signature: {
+    algorithm: "sha256",
+    encoding: "base64",
+    secret: "SHOPIFY_API_SECRET"
+  }
+};
+var COMPLIANCE_TOPICS = /* @__PURE__ */ new Set([
+  "customers/data_request",
+  "customers/redact",
+  "shop/redact"
+]);
+var shopify_default2 = {
+  // INSTALL, not oauth. The grant is an OAuth grant, but the merchant never
+  // sees a consent screen we sent them to -- they start at the App Store, and
+  // the install completes inside Shopify admin without redirecting back. A
+  // Connect button here would be lying about where connecting happens.
+  auth: {
+    type: "install"
+  },
+  // EVERYTHING A MERCHANT READS.
+  //
+  // `errors` is in here rather than at the top level, and that is not a
+  // preference: the connection DOCUMENT carries its own `errors` array of
+  // scope-drift entries, and the document is spread OVER the resolved manifest
+  // downstream — a top-level one would be replaced by that array and never
+  // render.
+  //
+  // `connect` no longer exists as a container. Its other member was `redirect`,
+  // which is a URL and now sits with the vendor's other addresses.
+  content: {
+    confirm: "Disconnecting deactivates all products from this store, drafts any advertisements that use them, disables Shopify steps in your workflows until you reconnect, and stops revenue tracking for this organization.",
+    description: [
+      "Installing the Drawbridge app from the Shopify App Store links your store to a single Drawbridge organization and makes your product catalog available inside Drawbridge, so you can feature products in your campaigns and advertisements.",
+      "Drawbridge attributes orders that originate from your campaigns \u2014 matched through cart parameters and lead-mapped discount codes \u2014 so you can see the revenue each campaign drives.",
+      "On connect, Drawbridge registers webhooks for product and order updates to keep your catalog and revenue in sync. Disconnecting removes those webhooks and unlinks the resources."
+    ],
+    errors: {
+      connect: {
+        conflict: "This store is already connected to another Drawbridge organization.",
+        currency: "This store settles in a currency we can't bill yet. Connect a store with a supported settlement currency.",
+        invalid: "We couldn't verify the install. Please try connecting again from the Shopify App Store."
+      }
+    },
+    excerpt: "Connect your Shopify store to feature products in your campaigns and track conversions.",
+    guide: [
+      "Open the Drawbridge listing on the Shopify App Store.",
+      "Install the app on the store you want to connect. It opens in Shopify admin and stays there.",
+      "Choose a plan when Shopify asks. The connection shows Pending until you do, then Active.",
+      "Come back here \u2014 the connections list updates on its own once the install lands."
+    ],
+    // Names where the link GOES rather than what it does: installing happens on
+    // the App Store listing, and the dashboard must never imply a store can be
+    // linked from inside it.
+    redirect: {
+      env: "SHOPIFY_APP_LISTING_URL",
+      title: "View on the Shopify App Store"
+    }
+  },
+  // ONE STORE PER ORGANIZATION. Two Shopify stores on one org would give every
+  // attributed order two possible sources.
+  exclusive: true,
+  feature: "organization:connection:shopify",
+  fields: [
+    {
+      // `shop` on the connection record wins when present — it is written by
+      // the install, while settings.domain is the stored copy.
+      from: "shop",
+      key: "domain",
+      label: "Store domain"
+    }
+  ],
+  // Was `category : 'commerce'` AND `group : 'ecommerce'` — two words for one
+  // fact, which left nobody able to say which one a page read.
+  group: "commerce",
+  // verify and event lean entirely on the shared HMAC helper — Shopify's scheme
+  // is exactly the shape it covers, so there is nothing vendor-specific to
+  // write for either. receive is the one hook that genuinely differs by
+  // channel: /events buffers whatever arrives with the shop domain stamped on;
+  // /compliance enforces the topic allowlist above, because answering one late
+  // is a legal deadline rather than a retry.
+  hooks: {
+    auth: {
+      // The install completes inside Shopify admin; the api's callback stores
+      // what it hands back. auth.probe is false deliberately: the health check
+      // re-registers rather than answering "is this token still good", and
+      // scope drift is its own hook because a token can be perfectly valid
+      // while the grant is too narrow.
+      //
+      // connect and disconnect are FALSE rather than `{}`: there is nothing to
+      // call on either side. The install already hands the callback everything
+      // it stores, and a Shopify grant is withdrawn by UNINSTALLING the app in
+      // Shopify admin — which Drawbridge learns about from the app_uninstalled
+      // webhook rather than by asking. `{}` claimed a body implemented
+      // elsewhere; none exists, and none could.
+      connect: false,
+      disconnect: false,
+      probe: false,
+      // WHETHER THE GRANT IS STILL WIDE ENOUGH. A token can be perfectly valid
+      // and still too narrow — a deploy that adds a scope leaves every existing
+      // install short of it, and no webhook fires to say so.
+      //
+      // The comparison is the vendor's, so it belongs here. Reading WHICH
+      // scopes a store granted is not: that lives in the `shop` collection and
+      // needs a controller, which is precisely what a hook in a published
+      // package must not be handed. The caller reads the grant and passes the
+      // string; this answers what is missing from it.
+      //
+      // `shopify` is injected for the same reason it is everywhere else — this
+      // package cannot import @drawbridge/shopify, which depends on it.
+      scopes: ({ scope, shopify }) => scope ? shopify.oauth.missingScopes(scope) : null,
+      // Shopify's install grant is exchanged inside its own app flow, not
+      // through the shared OAuth runner.
+      token: false
+    },
+    // Implemented in drawbridge-sync, which owns the attribution and the
+    // controllers it needs. Declared here so the steps below can point at them:
+    // a step naming a hook the vendor does not implement is a workflow that
+    // accepts the step and then silently does nothing.
+    commerce: {
+      code: {},
+      customer: {},
+      order: {},
+      product: {}
+    },
+    contacts: { remove: false, sync: false },
+    // verify and event lean entirely on the shared HMAC helper — Shopify's
+    // scheme is exactly the shape it covers, so there is nothing vendor-specific
+    // to write for either. receive is the one hook that genuinely differs by
+    // channel: /events buffers whatever arrives with the shop domain stamped on;
+    // /compliance enforces the topic allowlist above, because answering one late
+    // is a legal deadline rather than a retry.
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: {
+      event: (args) => readEventHeader({ ...args, descriptor: inbound }),
+      process: {},
+      receive: ({ channel, event, headers, payload }) => {
+        if (channel === "compliance" && !COMPLIANCE_TOPICS.has(event)) {
+          throw Object.assign(new Error("Unrecognized compliance topic: " + event), { status: 401 });
+        }
+        return {
+          // Compliance payloads already carry shop_domain in the body — Shopify's
+          // own GDPR shape. The app-level event stream does not; that domain
+          // lives only in the header, so it is stamped on here rather than left
+          // for drawbridge-sync to reach into headers nobody hands it.
+          data: channel === "compliance" ? payload : { ...payload, shop_domain: headers[inbound.headers.shop] || null },
+          provider: { id: headers[inbound.headers.id] || null }
+        };
+      },
+      verify: (args) => verifySignature({ ...args, descriptor: inbound })
+    },
+    lifecycle: { cleanup: {}, health: {}, register: {}, rehydrate: {} },
+    resources: {
+      audiences: false,
+      // Shopify has no separate price resource — a price belongs to a product
+      // variant and arrives with it, so there is nothing for prices to answer
+      // that products does not already.
+      prices: false,
+      // WHAT THE VENDOR ANSWERS, shaped for a picker. Both of these were api
+      // ROUTES — /organization/:organization/shopify/products and
+      // .../connection/:id/shopify/discounts — vendor-named urls in a service
+      // that is supposed to have none, reachable only by knowing the path.
+      // They are the same two questions every other vendor answers through
+      // resources.*, so they answer them the same way now.
+      //
+      // `shopify` is INJECTED: this package cannot import @drawbridge/shopify,
+      // which depends on it. What arrives is the SDK's pure HTTP namespaces
+      // and nothing else — no controller, no collection access. Resolving the
+      // credential is the caller's job because it is Drawbridge's job: the
+      // admin token refreshes and writes itself back, which is service work,
+      // not vendor work.
+      products: async ({ cursor, limit = 100, search, settings, shopify, sort }) => {
+        var _a, _b, _c, _d;
+        const products = await shopify.storefront.getProducts({
+          cursor,
+          domain: settings == null ? void 0 : settings.domain,
+          limit: Number(limit),
+          search: (search == null ? void 0 : search.value) || null,
+          sort,
+          storefrontAccessToken: settings == null ? void 0 : settings.storefrontAccessToken
+        });
+        return {
+          items: ((products == null ? void 0 : products.edges) || []).map((edge) => edge.node),
+          pageInfo: {
+            endCursor: ((_a = products == null ? void 0 : products.pageInfo) == null ? void 0 : _a.endCursor) || null,
+            hasNextPage: Boolean((_b = products == null ? void 0 : products.pageInfo) == null ? void 0 : _b.hasNextPage),
+            hasPreviousPage: Boolean((_c = products == null ? void 0 : products.pageInfo) == null ? void 0 : _c.hasPreviousPage),
+            startCursor: ((_d = products == null ? void 0 : products.pageInfo) == null ? void 0 : _d.startCursor) || null
+          }
+        };
+      },
+      promotions: async ({ cursor, limit = 100, search, settings, shopify }) => {
+        var _a, _b;
+        const discounts = await shopify.admin.getDiscounts({
+          adminAccessToken: settings == null ? void 0 : settings.adminAccessToken,
+          cursor,
+          domain: settings == null ? void 0 : settings.domain,
+          limit: Number(limit),
+          search: (search == null ? void 0 : search.value) || null
+        });
+        return {
+          // The GLOBAL id is what Shopify returns and the bare id is what a
+          // picker stores, which is why the tail is taken here rather than by
+          // each caller that happened to remember.
+          items: ((discounts == null ? void 0 : discounts.edges) || []).map((edge) => {
+            var _a2, _b2, _c;
+            return {
+              id: String(((_a2 = edge == null ? void 0 : edge.node) == null ? void 0 : _a2.id) || "").split("/").pop(),
+              title: (_c = (_b2 = edge == null ? void 0 : edge.node) == null ? void 0 : _b2.codeDiscount) == null ? void 0 : _c.title
+            };
+          }),
+          pageInfo: {
+            endCursor: ((_a = discounts == null ? void 0 : discounts.pageInfo) == null ? void 0 : _a.endCursor) || null,
+            hasNextPage: Boolean((_b = discounts == null ? void 0 : discounts.pageInfo) == null ? void 0 : _b.hasNextPage)
+          }
+        };
+      }
+    },
+    // Drawbridge posts to a merchant's own endpoint, never through a vendor.
+    webhook: false
+  },
+  icon: shopify_default,
+  inbound,
+  // THE DEEP LINK into this store's Drawbridge app inside Shopify admin.
+  //
+  // Here rather than in drawbridge-api, which had `slug === 'shopify' && {...}`
+  // in the shared resolver — a hardcoded vendor branch in code every vendor runs
+  // through, which is the arrangement these manifests exist to remove.
+  //
+  // Undefined until a shop is linked, so the Manage button only appears on a
+  // connected connection. The app handle is NAMED by `requires` and read from
+  // the env the resolver passes, never from process.env here.
+  manage: (data2, env) => {
+    var _a;
+    const shop = (data2 == null ? void 0 : data2.shop) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.domain);
+    return shop ? "https://admin.shopify.com/store/" + String(shop).replace(".myshopify.com", "") + "/apps/" + (env == null ? void 0 : env.SHOPIFY_APP_HANDLE) : void 0;
+  },
+  // A pre-launch integration: it only surfaces once the App Store listing
+  // exists and the app is fully configured. Requiring all four means it can
+  // never render half-configured — and absence of any one excludes the
+  // connection AND every step below it.
+  requires: [
+    "SHOPIFY_API_KEY",
+    "SHOPIFY_API_SECRET",
+    "SHOPIFY_APP_LISTING_URL",
+    "SHOPIFY_APP_HANDLE"
+  ],
+  slug: "shopify",
+  // The install is the whole configuration — Shopify hands back the shop and
+  // there is nothing further to choose. `shop` absent means the install did not
+  // finish, which is a credential problem rather than a setup one, so the
+  // stored status already says so.
+  // Nothing to add — no setting can make this connection unusable, so the
+  // credential's own verdict stands.
+  status: (data2) => data2 == null ? void 0 : data2.status,
+  // Step types name the CAPABILITY, not this vendor. A second store platform
+  // implements the same four commerce steps, and the connection on the step
+  // says which store it runs against — so a merchant sees one "Create
+  // customer", not one per platform. The three connection.* steps are not
+  // commerce at all: any vendor holding a rotating credential needs them.
+  // Step types name the CAPABILITY, not this vendor. A second store platform
+  // implements the same commerce steps, and the connection on the step says
+  // which store it runs against — so a merchant sees one "Create customer", not
+  // one per platform.
+  //
+  // Nested for readability and flattened to the stored name, at whatever depth:
+  // steps.commerce.customer.insert is `step.commerce.customer.insert` on a
+  // workflow document, and those strings cannot be renamed without a backfill.
+  //
+  // EVERY LEAF IS A FUNCTION so a step can read the merchant's own connection.
+  // The bodies these point at still live in drawbridge-sync; moving them is the
+  // next unit, and commerce.order.record is the one that decides whether the
+  // shape holds — 569 lines and 15 controller calls.
+  steps: {
+    commerce: {
+      code: {
+        issue: () => ({
+          hook: "commerce.code",
+          key: "Issue a discount code",
+          queue: "connection",
+          settings: {
+            discount: {
+              required: true,
+              shape: {
+                id: { required: true, type: "string" }
+              },
+              type: "object"
+            }
+          },
+          triggers: ["lead.insert"],
+          usage: { actions: 1 }
+        })
+      },
+      customer: {
+        insert: () => ({
+          hook: "commerce.customer",
+          key: "Create customer",
+          queue: "connection",
+          settings: {},
+          triggers: ["lead.insert"],
+          usage: { actions: 1 }
+        })
+      },
+      // SYSTEM STEPS: dispatched by drawbridge-sync itself rather than offered
+      // in the builder, so they carry no trigger and no usage. Declared because
+      // the routing table and the system-workflow descriptions both read here.
+      order: {
+        record: () => ({
+          description: "Records an order and billing charge when a purchase is made via a Drawbridge campaign link.",
+          hook: "commerce.order",
+          key: "Shopify Order Tracking",
+          queue: "connection",
+          system: true
+        })
+      },
+      product: {
+        sync: () => ({
+          description: "Syncs Shopify product data on webhook updates.",
+          hook: "commerce.product",
+          key: "Shopify Product Sync",
+          queue: "connection",
+          system: true
+        })
+      }
+    },
+    connection: {
+      // Not a webhook monitor, despite the name it once carried. Webhooks are
+      // declarative — declared in the app's toml, applied by Shopify to every
+      // install — so nothing registers or checks them here. This rotates the
+      // access token before Shopify's idle window closes, and reconciles the
+      // scopes the store granted against the ones the app now needs.
+      health: {
+        check: () => ({
+          description: "Keeps store access working \u2014 refreshes the access token before it goes stale and reports when the store's approved permissions fall behind.",
+          hook: "lifecycle.health",
+          key: "Shopify Connection Health",
+          queue: "connection",
+          system: true
+        })
+      },
+      // Audit-only. The "Shopify Token Activity" system workflow lists these
+      // for descriptive grouping, but its audit step docs are written manually
+      // at OAuth time — the workflow is never dispatched. Routing is declared
+      // defensively so that if it ever IS dispatched, the job lands on a real
+      // queue and the handler lookup misses cleanly instead of throwing
+      // "Unknown step type".
+      token: {
+        exchange: () => ({
+          description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
+          key: "Shopify Token Exchange",
+          queue: "connection",
+          system: true
+        }),
+        refresh: () => ({
+          description: "Records a token rotation. Audit only \u2014 never dispatched.",
+          key: "Shopify Token Refresh",
+          queue: "connection",
+          system: true
+        })
+      }
+    }
+  },
+  // Shopify sits pending between the install landing and the merchant choosing a
+  // plan, and nothing on our side can move it — so the card says what they need
+  // to go and do rather than showing Pending with no next step.
+  //
+  // Scope drift is NOT here: drawbridge-sync writes it onto the connection
+  // document, and the document's own warnings render beside these.
+  tasks: (data2) => (data2 == null ? void 0 : data2.status) === "pending" ? [
+    {
+      message: "Open the Drawbridge app in your Shopify admin and choose a plan. The connection activates once Shopify confirms it.",
+      title: "Choose a plan in Shopify"
+    }
+  ] : [],
+  title: "Shopify"
+};
+
+// lib/connections/webhook.js
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+
+// lib/safe-http.js
+var import_dns2 = __toESM(require("dns"), 1);
+var http2 = __toESM(require("http"), 1);
+var https2 = __toESM(require("https"), 1);
+
+// lib/axios.js
+var import_axios = __toESM(require("axios"), 1);
+var import_dns = __toESM(require("dns"), 1);
+var http = __toESM(require("http"), 1);
+var https = __toESM(require("https"), 1);
+var import_net = __toESM(require("net"), 1);
+var dnsLookup = import_dns.default.promises.lookup;
+var isBlockedIPv4 = (ip) => {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51) return true;
+  if (a === 203 && b === 0) return true;
+  if (a >= 224) return true;
+  return false;
+};
+var isBlockedIPv6 = (ip) => {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (/^fe[89ab]/.test(lower)) return true;
+  if (lower.startsWith("ff")) return true;
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice(7);
+    return isBlockedIPv4(v4);
+  }
+  ;
+  return false;
+};
+var isBlockedIP = (ip) => {
+  const version = import_net.default.isIP(ip);
+  if (version === 4) return isBlockedIPv4(ip);
+  if (version === 6) return isBlockedIPv6(ip);
+  return true;
+};
+var axios = import_axios.default.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
+
+// lib/safe-http.js
+var DEFAULT_TIMEOUT_MS2 = 15e3;
+var resolveSafeHost = async (url) => {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("Only http(s) URLs are allowed");
+  }
+  const records = await import_dns2.default.promises.lookup(parsed.hostname, { all: true });
+  if (!(records == null ? void 0 : records.length)) {
+    throw new Error("Host could not be resolved");
+  }
+  for (const record of records) {
+    if (isBlockedIP(record.address)) {
+      throw new Error("Host resolves to a blocked IP range");
+    }
+  }
+  return { parsed, records };
+};
+var pinnedAgent = async (url) => {
+  const { parsed, records } = await resolveSafeHost(url);
+  const pinned = records[0];
+  const lookup2 = (hostname, options, callback) => {
+    if (options == null ? void 0 : options.all) {
+      callback(null, [{ address: pinned.address, family: pinned.family }]);
+    } else {
+      callback(null, pinned.address, pinned.family);
+    }
+  };
+  return {
+    protocol: parsed.protocol,
+    agent: parsed.protocol === "https:" ? new https2.Agent({ lookup: lookup2 }) : new http2.Agent({ lookup: lookup2 })
+  };
+};
+var safeRequest = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS2,
+  type = "json",
+  url
+}) => {
+  const full = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
+  }
+  const { protocol, agent } = await pinnedAgent(full.toString());
+  const isForm = type === "form";
+  try {
+    const response = await axios({
+      method,
+      url: full.toString(),
+      headers: {
+        "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+        ...headers
+      },
+      ...body !== void 0 && {
+        data: isForm ? new URLSearchParams(body).toString() : body
+      },
+      timeout,
+      maxRedirects: 0,
+      httpAgent: protocol === "http:" ? agent : void 0,
+      httpsAgent: protocol === "https:" ? agent : void 0,
+      responseType: "json",
+      validateStatus: (status) => status >= 200 && status < 300
+    });
+    return response.data || null;
+  } catch (error) {
+    if (error == null ? void 0 : error.response) {
+      const normalized = new Error(
+        typeof error.response.data === "string" ? error.response.data : error.message || "Request failed"
+      );
+      normalized.status = error.response.status;
+      normalized.response = error.response.data;
+      throw normalized;
+    }
+    throw error;
+  }
+};
+
+// lib/connections/webhook.js
+var webhook_default = {
+  // Connecting GENERATES the secret rather than storing one the merchant typed,
+  // so the buttons say what actually happens.
+  actions: {
+    create: "Connect",
+    update: "Regenerate secret"
+  },
+  // GENERATED. There is no third party and nothing to authenticate against --
+  // connecting mints a secret rather than proving a credential.
+  auth: {
+    type: "generated"
+  },
+  // EVERYTHING A MERCHANT READS. `errors` would belong here too — the
+  // connection DOCUMENT carries its own `errors` array and is spread OVER the
+  // resolved manifest downstream, so a top-level one is replaced by that array.
+  content: {
+    confirm: "Disconnecting stops Drawbridge from sending signed webhook payloads to your endpoint.",
+    description: [
+      "Drawbridge can POST event payloads to your endpoint as activity happens in your account, so your own systems can react in real time.",
+      "Generate a signing secret and Drawbridge signs every request with it. Your endpoint recomputes the signature to confirm each payload genuinely came from Drawbridge before acting on it."
+    ],
+    excerpt: "Sign outgoing webhook payloads with an HMAC secret to verify authenticity.",
+    guide: [
+      "Press Connect. Drawbridge generates a signing secret and shows it here.",
+      "Copy the secret into your own endpoint.",
+      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+    ]
+  },
+  // Nothing to be exclusive with — there is no second webhook vendor, and a
+  // merchant with two endpoints is a step-level choice rather than a second
+  // connection.
+  exclusive: false,
+  feature: "organization:connection:webhook",
+  fields: [
+    {
+      // No `input`: Drawbridge generates this, the merchant never types it.
+      // No `redact` either — it is shared with the merchant's own endpoint
+      // rather than being a third-party credential, so it round-trips for
+      // them to copy and configure.
+      copy: true,
+      key: "secret",
+      label: "Signing secret"
+    }
+  ],
+  group: "developer",
+  // OUTBOUND ONLY. inbound.* is false because the direction is the point: we
+  // sign and POST to the merchant's endpoint, they never call us. Every other
+  // false follows from there being no third party to authenticate against —
+  // connect generates a secret rather than proving a credential.
+  hooks: {
+    auth: {
+      // FALSE, NOT {}. There is no vendor here at all — connecting mints a
+      // secret and disconnecting clears it, both done by the api's own
+      // handler. `{}` would promise a body implemented elsewhere, and none
+      // exists or could.
+      connect: false,
+      disconnect: false,
+      probe: false,
+      scopes: false,
+      // Nothing to mint. Connecting generates a secret; there is no vendor.
+      token: false
+    },
+    commerce: false,
+    contacts: { remove: false, sync: false },
+    // Drawbridge sends its own notification email and SMS, and owns its own
+    // segments — see the private `drawbridge` manifest. A vendor answering
+    // these would be a second sender, which is the arrangement the platform
+    // sender replaced.
+    email: false,
+    segment: false,
+    sms: false,
+    inbound: false,
+    lifecycle: false,
+    resources: {
+      audiences: false,
+      prices: false,
+      products: false,
+      promotions: false
+    },
+    // THE BODY IS HERE, not in drawbridge-sync. It needs `crypto` and an HTTP
+    // client and nothing else — no controller, no queue, no database — so
+    // there was never a reason for it to live in another repo.
+    //
+    // That is the rule the whole split runs on: a hook lives in sync only if it
+    // needs Drawbridge's own database, sockets or queues. This one does not.
+    webhook: {
+      send: async ({ context, controller, request: send2 = safeRequest, settings, step }) => {
+        const { headers = {}, method = "POST", url } = step.settings || {};
+        const request2 = { method, url: url || null };
+        if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        const lead = (context == null ? void 0 : context.lead) ? await controller.get({ collection: "lead", query: { id: context.lead } }) : null;
+        const body = lead || context;
+        request2.body = body;
+        const outgoing = { ...headers };
+        if (settings == null ? void 0 : settings.secret) {
+          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto3.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+        }
+        const response = await send2({ body, headers: outgoing, method, url });
+        return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
+      }
+    }
+  },
+  // Borrowed: this is the Drawbridge mark, because Webhooks has none of its own.
+  // It is the one card that reads wrong — our logo among vendor logos — and it
+  // wants a mark of its own when there is one.
+  icon: drawbridge_default,
+  // Gated on the encryption secret: without it the signing secret could not be
+  // stored safely, so the connection must not be offered at all.
+  requires: ["ENCRYPT_CONNECTION_SECRET"],
+  // Outbound only. inbound.* is false because the direction is the point: we
+  // sign and POST to the merchant's endpoint, they never call us. Every other
+  // false follows from there being no third party to authenticate against —
+  // connect generates a secret rather than proving a credential.
+  slug: "webhook",
+  // The destination url is supplied per step, not per connection, so there is
+  // nothing to finish here — generating the secret IS connecting, and no
+  // setting can make this connection unusable. The credential's own verdict
+  // stands.
+  status: (data2) => data2 == null ? void 0 : data2.status,
+  steps: {
+    webhook: {
+      send: () => ({
+        hook: "webhook.send",
+        key: "Send webhook",
+        queue: "webhook",
+        settings: {
+          url: { format: "url", required: true, type: "string" }
+        },
+        triggers: ["lead.insert", "lead.delete"],
+        // Replaces `billable : true`, which fed BILLABLE_STEP_TYPES, which set
+        // workflow.billable at save, which sync then checked against a usage
+        // the handler returned — three hops for one fact, two of which could
+        // disagree silently.
+        usage: { actions: 1 }
+      })
+    }
+  },
+  // The card the connection page raises. Before connecting it explains what
+  // pressing Connect will do; afterwards it states the verification the
+  // merchant's own endpoint has to perform, because a signed payload nobody
+  // checks is an unsigned payload.
+  tasks: ({ settings }) => (settings == null ? void 0 : settings.secret) ? [
+    {
+      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      title: "Requests must be verified",
+      type: "warning"
+    }
+  ] : [
+    {
+      message: "Connect to generate a signing secret. Drawbridge signs every webhook it sends with it.",
+      title: "Webhook signing"
+    }
+  ],
+  title: "Webhooks"
+};
+
+// lib/connections/index.js
+var QUEUES = ["connection", "notification", "segment", "webhook"];
+var implemented = (hooks, path) => {
+  const hook = path.split(".").reduce((node, key) => node == null ? void 0 : node[key], hooks);
+  return typeof hook === "function" || !!hook && typeof hook === "object";
+};
+var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
+  ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
+);
+var build = (manifest) => {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+  if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
+  if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
+  if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
+  if (!((_a = manifest == null ? void 0 : manifest.content) == null ? void 0 : _a.excerpt)) throw new Error(manifest.slug + " needs content.excerpt for its card");
+  if (!Array.isArray((_b = manifest == null ? void 0 : manifest.content) == null ? void 0 : _b.description) || !manifest.content.description.length) {
+    throw new Error(manifest.slug + " needs content.description \u2014 an array of paragraphs for its page");
+  }
+  for (const field2 of manifest.fields || []) {
+    if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
+      throw new Error(manifest.slug + " declares a field with no key or label");
+    }
+    if (field2.input && !INPUTS.includes(field2.input)) {
+      throw new Error(manifest.slug + "." + field2.key + " declares an unknown input: " + field2.input + " \u2014 one of " + INPUTS.join(", "));
+    }
+    if (field2.input === "select" && !(field2.options || []).length && !field2.hook) {
+      throw new Error(manifest.slug + "." + field2.key + " is a select and must declare options or a hook");
+    }
+    if (field2.hook) {
+      if (!HOOK_NAMES.includes(field2.hook)) {
+        throw new Error(manifest.slug + "." + field2.key + " names an unknown hook: " + field2.hook);
+      }
+      if (!field2.hook.startsWith("resources.")) {
+        throw new Error(manifest.slug + "." + field2.key + " reads from " + field2.hook + " \u2014 a picker may only read resources.*");
+      }
+      if (!implemented(manifest.hooks, field2.hook)) {
+        throw new Error(manifest.slug + "." + field2.key + " reads " + field2.hook + ", which this vendor does not implement");
+      }
+    }
+  }
+  if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
+    throw new Error(manifest.slug + " needs an icon \u2014 the svg markup itself, not a path to one");
+  }
+  if (!manifest.icon.includes("viewBox")) {
+    throw new Error(manifest.slug + " icon has no viewBox, so it cannot scale");
+  }
+  if (manifest.icon.includes("<image")) {
+    throw new Error(manifest.slug + " icon wraps a raster \u2014 re-export it as vector shapes");
+  }
+  if (!GROUPS.includes(manifest == null ? void 0 : manifest.group)) {
+    throw new Error(manifest.slug + " needs a group \u2014 one of " + GROUPS.join(", "));
+  }
+  if ((_c = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _c.type) {
+    throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
+  }
+  if (!AUTH_TYPES.includes((_d = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _d.type)) {
+    throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
+  }
+  if (manifest.auth.type === "oauth") {
+    for (const field2 of OAUTH_FIELDS) {
+      if (!((_e = manifest.auth.oauth) == null ? void 0 : _e[field2])) {
+        throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field2);
+      }
+    }
+    if (typeof ((_g = (_f = manifest.hooks) == null ? void 0 : _f.auth) == null ? void 0 : _g.token) !== "function") {
+      throw new Error(manifest.slug + " is oauth and must implement hooks.auth.token \u2014 point it at authToken() or wrap it");
+    }
+    for (const url of OAUTH_URLS) {
+      if (!((_i = (_h = manifest.auth.oauth) == null ? void 0 : _h.urls) == null ? void 0 : _i[url])) {
+        throw new Error(manifest.slug + " is oauth and must declare auth.oauth.urls." + url);
+      }
+    }
+    if (manifest.auth.oauth.urls.redirect !== "/api/connection/" + manifest.slug + "/callback") {
+      throw new Error(
+        manifest.slug + " declares auth.oauth.urls.redirect " + manifest.auth.oauth.urls.redirect + " but the only callback route is /api/connection/" + manifest.slug + "/callback"
+      );
+    }
+  }
+  if (implemented(manifest.hooks, "inbound.event") && !((_k = (_j = manifest.inbound) == null ? void 0 : _j.headers) == null ? void 0 : _k.event)) {
+    throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
+  }
+  if (implemented(manifest.hooks, "inbound.verify") && !((_m = (_l = manifest.inbound) == null ? void 0 : _l.headers) == null ? void 0 : _m.signature)) {
+    throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
+  }
+  if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
+    throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
+  }
+  if (!Array.isArray((_n = manifest == null ? void 0 : manifest.content) == null ? void 0 : _n.guide) || !manifest.content.guide.length) {
+    throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
+  }
+  if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
+    throw new Error(manifest.slug + " must declare status( data ) \u2014 one of " + STATUSES.join(", "));
+  }
+  const status = manifest.status({});
+  if (status != null && !STATUSES.includes(status)) {
+    throw new Error(manifest.slug + " status() returned " + status + " \u2014 must be one of " + STATUSES.join(", "));
+  }
+  for (const [domain, verbs] of Object.entries(HOOKS)) {
+    for (const verb of verbs) {
+      const hook = (_p = (_o = manifest.hooks) == null ? void 0 : _o[domain]) == null ? void 0 : _p[verb];
+      if (((_q = manifest.hooks) == null ? void 0 : _q[domain]) === false) continue;
+      if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
+        throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
+      }
+    }
+  }
+  for (const [domain, verbs] of Object.entries(manifest.hooks || {})) {
+    if (!HOOKS[domain]) throw new Error(manifest.slug + " implements an unknown hook domain: " + domain);
+    for (const verb of Object.keys(verbs === false ? {} : verbs)) {
+      if (!HOOKS[domain].includes(verb)) {
+        throw new Error(manifest.slug + " implements an unknown hook: " + domain + "." + verb);
+      }
+    }
+  }
+  for (const [name, step] of leaves(manifest.steps)) {
+    const type = "step." + name;
+    if (!STEPS[name]) {
+      throw new Error(manifest.slug + " declares an unknown step: " + type + " \u2014 add it to STEPS in contract.js");
+    }
+    const declared = step({});
+    if (!(declared == null ? void 0 : declared.key)) throw new Error(manifest.slug + " step " + type + " needs a key \u2014 the label the builder shows");
+    if (!QUEUES.includes(declared == null ? void 0 : declared.queue)) {
+      throw new Error(manifest.slug + " step " + type + " needs a queue \u2014 one of " + QUEUES.join(", "));
+    }
+    if (declared.hook && !implemented(manifest.hooks, declared.hook)) {
+      throw new Error(manifest.slug + " step " + type + " points at hook " + declared.hook + ", which this vendor does not implement");
+    }
+  }
+  return Object.freeze({
+    ...manifest,
+    fields: Object.freeze(manifest.fields || []),
+    hooks: Object.freeze(manifest.hooks || {}),
+    inbound: Object.freeze(manifest.inbound || {}),
+    requires: Object.freeze(manifest.requires || []),
+    steps: Object.freeze(manifest.steps || {})
+  });
+};
+var connections = Object.freeze({
+  attentive: build(attentive_default2),
+  drawbridge: build(drawbridge_default2),
+  klaviyo: build(klaviyo_default2),
+  mailchimp: build(mailchimp_default2),
+  shopify: build(shopify_default2),
+  webhook: build(webhook_default)
+});
+(() => {
+  const owners = {};
+  for (const [slug, manifest] of Object.entries(connections)) {
+    for (const [name] of leaves(manifest.steps)) {
+      const type = "step." + name;
+      if (owners[type]) {
+        throw new Error("Step " + type + " is declared by both " + owners[type] + " and " + slug);
+      }
+      owners[type] = slug;
+    }
+  }
+})();
+var publicSettingsBySlug = Object.fromEntries(
+  Object.entries(connections).map(([slug, manifest]) => [
+    slug,
+    manifest.fields.filter((field2) => !field2.redact).map((field2) => field2.key)
+  ])
+);
+var mergeSettings = ({ existing, incoming }) => {
+  if (!existing || typeof existing !== "object") return incoming;
+  const merged = { ...existing };
+  for (const [key, value] of Object.entries(incoming || {})) {
+    if (value !== void 0 && value !== null && value !== "") {
+      merged[key] = value;
+    }
+    ;
+  }
+  ;
+  return merged;
+};
+var publicConnectionKeys = Object.freeze([
+  "actions",
+  // API-COMPOSED, not manifest-declared: the api's resolve() builds it from
+  // auth.type, content.redirect and the manifest's manage() — the client reads
+  // connect.type to choose entered-vs-installed, connect.redirect for the App
+  // Store link, connect.manage for the admin deep link. It was dropped from
+  // this list when the manifests stopped declaring it, which stripped the
+  // composed object from every response and broke all three.
+  "connect",
+  // EVERYTHING A MERCHANT READS, in one key: confirm, description, errors,
+  // excerpt, guide, and any vendor redirect copy.
+  "content",
+  "createdAt",
+  // The connection DOCUMENT's own errors array — scope-drift entries written by
+  // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
+  // the document is spread OVER the resolved manifest downstream, so the two
+  // sharing this key means the array silently wins.
+  "errors",
+  "fields",
+  "group",
+  "id",
+  "image",
+  "settings",
+  "shop",
+  "slug",
+  "status",
+  "tasks",
+  "title",
+  "updatedAt",
+  "warnings"
+]);
+
+// lib/encrypt.js
+var import_crypto2 = __toESM(require("crypto"), 1);
+
+// lib/token.js
+var import_crypto = __toESM(require("crypto"), 1);
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = import_crypto.default.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+
+// lib/encrypt.js
+var ALGORITHM = "aes-256-gcm";
+var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
+var encrypt = (value) => {
+  const iv = generate(12, null);
+  const cipher = import_crypto2.default.createCipheriv(ALGORITHM, getKey(), iv);
+  const data2 = Buffer.concat([
+    cipher.update(JSON.stringify(value), "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return [iv, tag, data2].map((b) => b.toString("hex")).join(":");
+};
+var decrypt = (value) => {
+  if (typeof value !== "string") return value;
+  const [ivHex, tagHex, dataHex] = value.split(":");
+  const decipher = import_crypto2.default.createDecipheriv(
+    ALGORITHM,
+    getKey(),
+    Buffer.from(ivHex, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  const result = Buffer.concat([
+    decipher.update(Buffer.from(dataHex, "hex")),
+    decipher.final()
+  ]);
+  return JSON.parse(result.toString("utf8"));
+};
+
+// lib/providers.js
+var FIELDS = {
+  attentive: [
+    { input: "text", key: "clientId", env: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+    { input: "password", key: "clientSecret", env: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+  ],
+  drawbridge: [
+    { input: "email", key: "accountSender", env: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
+    { input: "password", key: "apiKey", env: "SENDGRID_API_KEY", label: "SendGrid API key", redact: true, required: true },
+    // NOT required. The CRM sync is best-effort internal tooling and no-ops
+    // without a token — requiring it would make the whole drawbridge provider
+    // read not-live over something no merchant ever sees.
+    { input: "password", key: "hubspotToken", env: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
+    // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
+    // either. Unset, it degrades to the account sender rather than
+    // refusing to start.
+    { input: "email", key: "leadSender", env: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
+    { input: "text", key: "smsFrom", env: "TWILIO_ACCOUNT_FROM", label: "SMS number", required: true },
+    { input: "password", key: "smsSid", env: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", redact: true, required: true },
+    { input: "password", key: "smsToken", env: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", redact: true, required: true }
+  ],
+  klaviyo: [
+    { input: "text", key: "clientId", env: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+    { input: "password", key: "clientSecret", env: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+  ],
+  mailchimp: [
+    { input: "text", key: "clientId", env: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+    { input: "password", key: "clientSecret", env: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+  ],
+  shopify: [
+    { input: "text", key: "apiKey", env: "SHOPIFY_API_KEY", label: "API key", required: true },
+    { input: "password", key: "apiSecret", env: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
+    { input: "text", key: "appHandle", env: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
+    { input: "text", key: "listingUrl", env: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
+  ]
+};
+var providerFields = (slug) => Object.hasOwn(FIELDS, slug) ? FIELDS[slug] : [];
+var providerSlugs = () => Object.keys(FIELDS).sort();
+var isLive = (slug, settings) => {
+  const fields2 = providerFields(slug);
+  if (!fields2.length) return false;
+  return fields2.filter((field2) => field2.required).every((field2) => Boolean(settings == null ? void 0 : settings[field2.key]));
+};
+var mask = (value) => {
+  if (!value) return null;
+  if (String(value).length < 12) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+  return String(value).slice(0, 3) + "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" + String(value).slice(-4);
+};
+var cacheKey = (slug) => ["provider", slug];
+var providerSettings = async ({ cache, controller, slug }) => {
+  const read = async () => controller.get({
+    collection: "provider",
+    query: { slug }
+  });
+  const row = cache ? await cache.use(cacheKey(slug), read, 30) : await read();
+  return (row == null ? void 0 : row.settings) ? decrypt(row.settings) : {};
+};
+var saveProviderSettings = async ({ authenticated, cache, clear, controller, settings, slug }) => {
+  const fields2 = providerFields(slug);
+  if (!fields2.length) return null;
+  const existing = await controller.get({
+    collection: "provider",
+    query: { slug }
+  });
+  const stored = (existing == null ? void 0 : existing.settings) ? decrypt(existing.settings) : {};
+  const merged = mergeSettings({
+    existing: stored,
+    incoming: Object.fromEntries(fields2.map((field2) => [field2.key, settings == null ? void 0 : settings[field2.key]]))
+  });
+  for (const key of Array.isArray(clear) ? clear : []) {
+    if (fields2.some((field2) => field2.key === key)) delete merged[key];
+  }
+  const result = await controller.update({
+    authenticated,
+    collection: "provider",
+    data: {
+      $set: {
+        settings: encrypt(merged)
+      }
+    },
+    options: {
+      upsert: true
+    },
+    query: { slug }
+  });
+  await cache.delete(cacheKey(slug));
+  return result;
+};
+var providerEnvNames = () => new Set(
+  providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.env).filter(Boolean)
+);
+var providerCredentials = async ({ cache, controller }) => {
+  const credentials2 = {};
+  for (const slug of providerSlugs()) {
+    const settings = await providerSettings({ cache, controller, slug });
+    for (const field2 of providerFields(slug)) {
+      const value = settings == null ? void 0 : settings[field2.key];
+      if (field2.env && value) credentials2[field2.env] = value;
+    }
+  }
+  return credentials2;
+};
+var hydrateEnvironment = async ({ cache, controller, env = process.env }) => {
+  const credentials2 = await providerCredentials({ cache, controller });
+  for (const name of providerEnvNames()) delete env[name];
+  Object.assign(env, credentials2);
+  return Object.keys(credentials2).sort();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cacheKey,
+  hydrateEnvironment,
+  isLive,
+  mask,
+  providerCredentials,
+  providerEnvNames,
+  providerFields,
+  providerSettings,
+  providerSlugs,
+  saveProviderSettings
+});