@drawbridge/drawbridge-utils 0.0.118 → 0.0.124

package/dist/providers.js

@@ -176,6 +176,53 @@ var HOOKS = Object.freeze({
     "promotions"
   ])
 });
+var HOOK_EFFECTS = Object.freeze(["enqueues", "events", "writes"]);
+var WRITE_OPERATIONS = Object.freeze(["create", "update"]);
+var HOOK_PROPS = Object.freeze([
+  "channel",
+  "clientId",
+  "clientSecret",
+  "connection",
+  "contact",
+  "context",
+  "cursor",
+  "declaration",
+  "doc",
+  "email",
+  "event",
+  "headers",
+  "id",
+  "lead",
+  "limit",
+  "manifest",
+  "payload",
+  "scope",
+  "search",
+  "secret",
+  "settings",
+  "sort",
+  "step",
+  "suppressed",
+  "token",
+  "tokens",
+  "workflow"
+]);
+var HOOK_OPTIONS = Object.freeze([
+  "adminToken",
+  "canSend",
+  "chunkSize",
+  "dispatch",
+  "fetcher",
+  "logger",
+  "mintId",
+  "read",
+  "reconcileScopes",
+  "request",
+  "resolveContact",
+  "resolveSettings",
+  "rotateToken",
+  "shopify"
+]);
 var STEPS = Object.freeze({
   "commerce.code.issue": "Issue discount code",
   "commerce.customer.insert": "Create customer",
@@ -357,13 +404,56 @@ var attentive_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 <path d="M166.04 261.805C180.228 259.107 195.528 261.893 207.581 269.971C218.512 277.079 226.908 288.136 230.604 300.657C234.835 314.103 233.614 329.124 227.485 341.788C220.097 356.875 205.782 368.543 189.317 372.089C173.957 375.652 157.089 372.386 144.304 363.103C132.971 355.295 124.912 342.989 121.891 329.581C118.943 316.636 120.725 302.656 127.002 290.938C134.699 275.951 149.503 264.933 166.046 261.811" fill="#1E1C1C"/>
 </svg>`;
 
-// lib/connections/attentive.js
+// lib/phone.js
+import { AsYouType, parsePhoneNumberFromString, isValidPhoneNumber } from "libphonenumber-js";
+var toE164 = (value, country) => {
+  if (!value) return null;
+  try {
+    const parsed = parsePhoneNumberFromString(String(value), country);
+    return parsed ? parsed.number : null;
+  } catch {
+    return null;
+  }
+};
+var detectCountry = (value) => {
+  if (!value) return null;
+  try {
+    const parser = new AsYouType();
+    parser.input(String(value));
+    return parser.getCountry() || null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/connections/providers/attentive.js
+var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
+  const response = await fetcher("https://api.attentivemobile.com" + path, {
+    ...payload && { body: JSON.stringify(payload) },
+    headers: {
+      authorization: "Bearer " + token,
+      ...payload && { "content-type": "application/json" }
+    },
+    method,
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) {
+    throw Object.assign(
+      new Error("Attentive refused the request (" + response.status + ")"),
+      { status: response.status }
+    );
+  }
+  return response.json().catch(() => null);
+};
 var attentive_default2 = {
   auth: {
     oauth: {
-      // NAMES of the env vars holding OUR app's client — set at registration,
-      // never before. No `headers` on the client: Attentive takes credentials
-      // as form fields, which is the runner's default.
+      // NAMES of the credentials holding OUR app's client — keys into the map
+      // the provider collection answers, entered on the admin screen at
+      // registration, never before. (The names are the env vars they once
+      // were; the vocabulary stayed when the storage moved.) No `headers` on
+      // the client: Attentive takes credentials as form fields, which is the
+      // runner's default.
       client: {
         id: "ATTENTIVE_OAUTH_CLIENT_ID",
         secret: "ATTENTIVE_OAUTH_CLIENT_SECRET"
@@ -388,9 +478,10 @@ var attentive_default2 = {
     // has to say so rather than let them believe otherwise.
     confirm: "Disconnecting removes Drawbridge's stored Attentive token. Attentive does not offer a way for us to revoke it, so remove the Drawbridge integration in Attentive as well if you want its access fully withdrawn. Your subscribers stay in both Attentive and Drawbridge \u2014 neither list is deleted.",
     description: [
-      "Attentive is where your SMS marketing lives, and this connection is becoming the way your Drawbridge contacts sync into an Attentive segment.",
+      "Attentive is where your SMS marketing lives, and this connection syncs the contacts your campaigns collect into an Attentive segment \u2014 subscribed for marketing and added to the segment you choose.",
       "You authorize Drawbridge from inside Attentive and can revoke that access there at any time. Drawbridge never sees or stores your Attentive password.",
-      "Subscriber syncing is not live yet, so connecting today does nothing except choose the segment it will use when it ships."
+      "Anyone who has opted out in Drawbridge is sent to Attentive as an unsubscribe rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
+      "Attentive accepts these updates and applies them in the background, so a contact appears in your segment shortly after the sync rather than the instant it runs."
     ],
     excerpt: "Sync your Drawbridge contacts into an Attentive segment.",
     guide: [
@@ -411,6 +502,10 @@ var attentive_default2 = {
       message: "Contacts your campaigns collect are synced into this segment.",
       hook: "resources.audiences",
       required: true
+      // CONSUMED BY THE MEMBERSHIP CALL, not by the subscribe. Attentive's
+      // /v1/subscriptions takes no segment id — subscription and segment
+      // membership are two operations here — so contacts.sync makes both calls
+      // and this value is the externalId the second one carries.
       // No `search : false` here, and that is a first: /v2/segments takes a
       // `name` filter (partial match, cited above), so this picker searches
       // the ACCOUNT — Klaviyo and Mailchimp can only match the fetched page.
@@ -423,17 +518,25 @@ var attentive_default2 = {
   // and contacts.sync are the first to flip.
   hooks: {
     auth: {
-      // The exchange already yields the tokens, and Attentive documents no
-      // account-identity endpoint to enrich them with — Klaviyo's connect
-      // reads the account name back; this has nothing cited to read. The
-      // callback stores the tokens and skips enrichment on `unimplemented`.
       // FALSE, NOT {}. `{}` means "supported, implemented in the repo with the
-      // dependencies", and nothing anywhere implements either of these —
-      // there is nothing for them to do. The exchange already yields the
-      // tokens and Attentive documents no account-identity endpoint to
-      // enrich them with, so connect has nothing to add; and they document
-      // no revocation endpoint at all, so disconnect has nothing to call.
-      // Recorded as a decision rather than left as an unkept promise.
+      // dependencies", and nothing anywhere implements either of these — there
+      // is nothing for them to do. They document no revocation endpoint at all,
+      // so disconnect has nothing to call. Recorded as a decision rather than
+      // left as an unkept promise.
+      //
+      // STILL FALSE AFTER LOOKING AGAIN, and this is the reason written down so
+      // nobody re-derives it. Klaviyo's connect reads the account name back so
+      // the card is not blank; Attentive's card stays blank. There IS an
+      // endpoint — GET https://api.attentivemobile.com/v1/me, Bearer, described
+      // on docs.attentive.com/pages/authentication/ as returning "information
+      // specific to your company" — but its RESPONSE SCHEMA is published
+      // nowhere we can read: the docs show the curl and no body. Reading
+      // `body.name` would be a guess, and a guess here fails at the worst
+      // moment, in the callback, after the merchant has already consented.
+      //
+      // A live token settles it in one call, alongside the three registration
+      // checks in the header. Until then the honest state is a blank field, not
+      // a hopeful one.
       connect: false,
       disconnect: false,
       probe: false,
@@ -455,7 +558,112 @@ var attentive_default2 = {
       }
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // The verb the contacts.sync step points at.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from erasing the subscriber — Attentive's deletion sits
+      // behind their privacy-request API, which is a different grant.
+      remove: false,
+      // TWO CALLS, BECAUSE ATTENTIVE HAS TWO IDEAS.
+      //
+      // Subscribing and being in a segment are NOT the same operation here —
+      // unlike Klaviyo, where a subscription is created against the list itself.
+      // /v1/subscriptions takes no segment id at all, so the segment a merchant
+      // picked on this connection can only be honoured by the bulk segment
+      // membership API:
+      //
+      //   subscribe   POST /v1/subscriptions
+      //               { user : { email, phone }, locale, subscriptionType } — the
+      //               docs require EITHER signUpSourceId OR (locale +
+      //               subscriptionType), and we hold no sign-up source. 202.
+      //
+      //   membership  POST /v2/bulk/segments/members
+      //               { externalId, members : [ { email, phone } ] }, 1-10,000
+      //               members, 202 with a batchJobId
+      //               (docs.attentive.com/reference/postbulksegmentmembers).
+      //
+      //   unsubscribe POST /v1/subscriptions/unsubscribe
+      //               { user, subscriptions : [ { type, channel } ] }. 202.
+      //
+      // EVERY ONE OF THEM ANSWERS 202 ACCEPTED, which means Attentive took the
+      // job, not that it ran — the same distinction the Shopify usage charge
+      // makes between a 202 and a charge. The message below says accepted, and
+      // must keep saying accepted.
+      sync: async ({ lead, settings, suppressed, token }, { fetcher } = {}) => {
+        var _a, _b, _c, _d;
+        const segment = settings == null ? void 0 : settings.segment;
+        if (!segment) return { message: "No Attentive segment is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        const phone = toE164(((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.phone) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.phone));
+        if (!email && !phone) return { message: "That lead has no email address or phone number to sync.", skipped: true };
+        const user = {
+          ...email && { email },
+          ...phone && { phone }
+        };
+        if (suppressed) {
+          await api("/v1/subscriptions/unsubscribe", {
+            fetcher,
+            method: "POST",
+            payload: {
+              // One entry per channel we can actually name them by. MARKETING
+              // is the only type Drawbridge ever subscribed them to.
+              subscriptions: [
+                ...phone ? [{ channel: "TEXT", type: "MARKETING" }] : [],
+                ...email ? [{ channel: "EMAIL", type: "MARKETING" }] : []
+              ],
+              user
+            },
+            token
+          });
+          return {
+            message: "Attentive accepted an unsubscribe for this contact \u2014 they have opted out.",
+            response: { accepted: true, unsubscribed: true }
+          };
+        }
+        await api("/v1/subscriptions", {
+          fetcher,
+          method: "POST",
+          payload: {
+            // LOCALE, because we hold no signUpSourceId and the docs require
+            // one or the other. The country is READ OFF the number when there
+            // is one — libphonenumber knows it from the calling code — rather
+            // than assumed; only the fallback pair below is a default, and it
+            // is the one value here that no vendor document dictates.
+            //
+            // ponytail: en/US default. A `signUpSourceId` field on the
+            // connection is the upgrade — Attentive's sign-up sources carry
+            // the consent language, which is a better answer than any locale
+            // we can infer — and it replaces this branch entirely.
+            locale: {
+              country: phone && detectCountry(phone) || "US",
+              language: "en"
+            },
+            subscriptionType: "MARKETING",
+            user
+          },
+          token
+        });
+        const membership = await api("/v2/bulk/segments/members", {
+          fetcher,
+          method: "POST",
+          payload: {
+            externalId: segment,
+            members: [user]
+          },
+          token
+        });
+        return {
+          // ACCEPTED, NOT LIVE. Both writes answered 202, which means Attentive
+          // queued them — a merchant who reads "synced" and looks for the person
+          // in Attentive a second later has been told the wrong thing.
+          message: "Attentive accepted this contact for the segment. Attentive processes these asynchronously, so it appears there shortly.",
+          response: {
+            accepted: true,
+            ...(membership == null ? void 0 : membership.batchJobId) && { batchJobId: membership.batchJobId }
+          }
+        };
+      }
+    },
     email: false,
     inbound: false,
     lifecycle: false,
@@ -468,26 +676,13 @@ var attentive_default2 = {
       // show a picker quietly missing most of a real account. The response's
       // only identifier is `externalId`, so an entry without one cannot be
       // stored and is dropped.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, token }) => {
+      audiences: async ({ cursor, limit = 100, search, token }, { fetcher } = {}) => {
         const query = new URLSearchParams({
           limit: String(Math.min(limit, 1e3)),
           ...cursor && { cursor },
           ...(search == null ? void 0 : search.value) && { name: String(search.value).trim() }
         });
-        const response = await fetcher(
-          "https://api.attentivemobile.com/v2/segments?" + query,
-          {
-            headers: { authorization: "Bearer " + token },
-            signal: AbortSignal.timeout(15e3)
-          }
-        );
-        if (!response.ok) {
-          throw Object.assign(
-            new Error("Attentive refused the request (" + response.status + ")"),
-            { status: response.status }
-          );
-        }
-        const body = await response.json();
+        const body = await api("/v2/segments?" + query, { fetcher, token });
         return {
           items: ((body == null ? void 0 : body.segments) || []).filter((segment) => segment == null ? void 0 : segment.externalId).map((segment) => ({ id: segment.externalId, title: (segment == null ? void 0 : segment.name) || segment.externalId })),
           pageInfo: {
@@ -505,33 +700,67 @@ var attentive_default2 = {
     webhook: false
   },
   icon: attentive_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen, and the only declaration of it.
+  // It lives beside `requires`, which names the same variables: the manifest
+  // says what it needs and this says how someone supplies it, so a credential
+  // cannot be required by a vendor that offers nowhere to enter it.
+  //
+  // `redact` marks a secret — never returned by the api, and blank on save means
+  // keep the stored value. `required` drives the live check.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   requires: [
     "ATTENTIVE_OAUTH_CLIENT_ID",
     "ATTENTIVE_OAUTH_CLIENT_SECRET"
   ],
   slug: "attentive",
-  // A consent with no segment chosen is authenticated and inert — the sync,
-  // when it ships, needs somewhere to put people.
+  // A consent with no segment chosen is authenticated and inert — the sync needs
+  // somewhere to put people — so the card says Pending rather than Active over
+  // nothing.
   status: (data2) => {
     var _a;
     return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? data2.status : "pending";
   },
-  // No steps: subscriber sync has not shipped, so this vendor contributes
-  // nothing to a workflow yet. An empty steps object is the honest declaration.
-  steps: {},
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. The nesting IS the name: this is
+      // `step.contacts.sync`, the string a workflow document stores. Klaviyo and
+      // Mailchimp declare the same type — a step belongs to the capability, not
+      // to whoever implements it — and the connection on the step document is
+      // what says which vendor runs.
+      sync: ({ data: data2 }) => ({
+        hook: "contacts.sync",
+        // NO ACCOUNT NAME TO INTERPOLATE, unlike Klaviyo: auth.connect is false
+        // because Attentive publishes no account-identity response we can read
+        // (see its comment), and settings.segment is an opaque externalId no
+        // merchant would recognise in a builder label.
+        key: "Sync contact to Attentive",
+        queue: "connection",
+        // Nothing for a merchant to configure on the step itself — the segment
+        // is chosen once on the connection. Declared empty rather than omitted,
+        // so "this step takes no settings" and "nobody thought about settings"
+        // stay different statements.
+        settings: {},
+        // BOTH triggers, for the same reason as Klaviyo: lead.insert alone only
+        // ever fires for someone with no history yet, and crossing into a
+        // segment is the other moment a contact is worth pushing.
+        triggers: ["lead.insert", "segment.contact.add"],
+        usage: { actions: 1 }
+      })
+    }
+  },
+  // WHY, in the merchant's words, and what to do about it.
   tasks: (data2) => {
     var _a;
-    return [
-      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? [] : [
-        {
-          message: "Choose which Attentive segment your contacts should sync into. Until you do, nothing is being synced.",
-          title: "Choose a segment"
-        }
-      ],
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? [] : [
       {
-        message: "Contact syncing to Attentive segments has not shipped yet. Nothing is being sent to Attentive right now.",
-        title: "Subscriber sync not available yet",
-        type: "warning"
+        message: "Choose which Attentive segment your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose a segment"
       }
     ];
   },
@@ -584,10 +813,11 @@ var request = async ({
 // lib/hubspot.js
 var HUBSPOT_BASE = "https://api.hubapi.com";
 var hubspotRequest = ({ body, fetcher, method, path, query, token }) => {
+  if (!token) throw new Error("HubSpot access token missing \u2014 pass token (the drawbridge provider's hubspotToken)");
   return (fetcher || request)({
     body,
     headers: {
-      "Authorization": "Bearer " + (token || process.env.HUBSPOT_ACCESS_TOKEN)
+      "Authorization": "Bearer " + token
     },
     method,
     query,
@@ -689,16 +919,15 @@ var contacts = {
   // FORGET A CONTACT, by id or by email. Account deletion — the caller had
   // to search then remove, which is one round trip it should not have to
   // know about.
-  remove: async ({ email, fetcher, id, token }) => {
-    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-    if (!key) return;
-    const contact = id || await lookup({ email, fetcher, token: key });
+  remove: async ({ email, id, token }, { fetcher } = {}) => {
+    if (!token) return;
+    const contact = id || await lookup({ email, fetcher, token });
     if (!contact) return;
     return hubspotRequest({
       fetcher,
       method: "DELETE",
       path: "/crm/v3/objects/contacts/" + contact,
-      token: key
+      token
     });
   },
   // Connect an account to its contact by email, creating it if absent, and
@@ -707,24 +936,23 @@ var contacts = {
   // no delete-old-then-create-new.
   //
   // Prefer the cached hubspotId; fall back to a search; create last.
-  sync: async ({ doc, fetcher, token }) => {
+  sync: async ({ doc, token }, { fetcher } = {}) => {
     var _a, _b;
-    const key = token || process.env.HUBSPOT_ACCESS_TOKEN;
-    if (!key) return;
+    if (!token) return;
     if (doc == null ? void 0 : doc.hubspotId) {
       try {
-        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token: key })) == null ? void 0 : _a.id;
+        return (_a = await send({ doc, fetcher, method: "PATCH", path: "/crm/v3/objects/contacts/" + doc.hubspotId, token })) == null ? void 0 : _a.id;
       } catch (error) {
         if ((error == null ? void 0 : error.status) !== 404) throw error;
       }
     }
-    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token: key });
+    const existing = await lookup({ email: doc == null ? void 0 : doc.email, fetcher, token });
     return (_b = await send({
       doc,
       fetcher,
       method: existing ? "PATCH" : "POST",
       path: existing ? "/crm/v3/objects/contacts/" + existing : "/crm/v3/objects/contacts",
-      token: key
+      token
     })) == null ? void 0 : _b.id;
   }
 };
@@ -734,7 +962,7 @@ var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fi
 <rect width="500" height="500" fill="#BAEC5F"/>
 <g clip-path="url(#clip0_2115_2832)">
 <path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
+<path d="M360.002 127.523L323.694 108.282L284.949 178.498V321.596L322.924 391.749L359.394 372.79L326.225 311.52V188.73L360.002 127.523Z" fill="#0D1314"/>
 </g>
 <defs>
 <clipPath id="clip0_2115_2832">
@@ -1180,6 +1408,36 @@ var plans = {
     conversion: 0.5
   }
 };
+var resolvePlan = (subscription) => {
+  var _a, _b;
+  const custom = subscription == null ? void 0 : subscription.custom;
+  if (!custom) return plans[subscription == null ? void 0 : subscription.plan] ?? free;
+  return {
+    // Reusing all.features / all.limits is what keeps a custom plan the same
+    // SHAPE as a catalog one: the base feature grants every plan carries, the
+    // campaign limits that are always infinite, and members defaulting to
+    // infinite when a deal does not name it.
+    conversion: custom.conversion ?? free.conversion,
+    custom: true,
+    // A custom plan is a negotiated PAID deal, so it carries the paid-tier
+    // baseline whether or not the deal thought to name it. Today that is the
+    // sending domain: every catalog paid tier grants it, and a custom plan
+    // silently lacking it would be a support ticket, not a pricing decision.
+    features: all.features([organization.networking.key, ...((_a = custom.features) == null ? void 0 : _a.granted) || []]),
+    limits: all.limits(((_b = custom.limits) == null ? void 0 : _b.organization) || {}),
+    // A custom plan stores its overage BARE on `custom.overages` — a different
+    // shape from the catalog's nested one. Number() so a deal stored as a string
+    // still resolves to cents-per-action; an unnamed overage stays undefined
+    // (it bills nothing) rather than becoming NaN.
+    actionCents: custom.overages == null ? void 0 : Number(custom.overages),
+    overages: { actions: custom.overages },
+    title: custom.title || "Custom"
+  };
+};
+var conversionRate = (subscription) => {
+  var _a;
+  return ((_a = resolvePlan(subscription)) == null ? void 0 : _a.conversion) ?? free.conversion;
+};
 
 // lib/transactions.js
 import { currentTraceId } from "@drawbridge/drawbridge-telemetry";
@@ -1334,7 +1592,36 @@ var channels = {
   }
 };
 
-// lib/connections/drawbridge.js
+// lib/connections/providers/drawbridge.js
+var interpolate = (template, data2) => {
+  if (!template) return template;
+  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => (data2 == null ? void 0 : data2[key]) != null ? String(data2[key]) : "{{" + key + "}}");
+};
+var teamRecipients = async ({ memberIds = [], organization: organization2, read }) => {
+  const org = await read.get({ collection: "organization", query: { id: organization2 } });
+  const owner = (org == null ? void 0 : org.owner) ? await read.get({ collection: "user", query: { id: org.owner } }) : null;
+  const members = memberIds.length ? await read.aggregate({
+    collection: "member",
+    pipeline: [
+      {
+        $match: {
+          id: { $in: memberIds },
+          organization: organization2,
+          status: "accepted"
+        }
+      }
+    ]
+  }) : [];
+  const seen = /* @__PURE__ */ new Set();
+  return [owner, ...members].filter((member) => {
+    if (!(member == null ? void 0 : member.id) || !(member == null ? void 0 : member.email)) return false;
+    const address = member.email.toLowerCase();
+    if (seen.has(address)) return false;
+    seen.add(address);
+    return true;
+  });
+};
+var queueNotification = (data2) => ({ collection: "notification", data: data2, operation: "create" });
 var drawbridge_default2 = {
   auth: {
     type: "none"
@@ -1352,10 +1639,15 @@ var drawbridge_default2 = {
   exclusive: false,
   fields: [],
   group: "developer",
-  // EVERY BODY LIVES IN drawbridge-sync. Sending needs the provider clients, the
-  // suppression collection and the queues; segment sync needs the streams. A
-  // published package carrying those makes every consumer carry them, which is
-  // the reason `{}` exists as an answer.
+  // THE BODIES LIVE HERE, beside the declarations that name them. They used to
+  // live in drawbridge-sync because they touch the database, the queues and the
+  // sockets — and a published package cannot carry a controller.
+  //
+  // It does not have to. A hook is a function, so everything it needs is PASSED
+  // IN: `read` for the reads, `canSend` for the opt-out floor, `resolveContact`
+  // for the one write whose RESULT the hook has to count. Everything else a hook
+  // wants done it DESCRIBES — `writes`, `enqueues`, `events` — and the shell
+  // performs it. See lib/connections/contract.js for that shape.
   hooks: {
     auth: {
       // Nothing to connect, revoke, probe or re-scope.
@@ -1376,13 +1668,157 @@ var drawbridge_default2 = {
     // accounts DRAWBRIDGE holds rather than ones a merchant connects.
     contacts,
     email: {
-      digest: {},
-      // To organization members. NEVER suppressed and never billed: an
-      // entrant's opt-out must not silence an alert to staff, and staff mail is
-      // not a metered send.
-      notify: {},
-      // To a lead. Suppression applies and the send is billed.
-      send: {}
+      // A PERIODIC SUMMARY to the team, on a schedule trigger rather than per
+      // lead.
+      //
+      // The count is the point: `email.notify` tells the owner one lead arrived
+      // and dampens a spike to one message per bucket, which is deliberately not
+      // a count. This is where "you got 43 entries this week" comes from.
+      digest: async ({ context, step, workflow }, { read } = {}) => {
+        var _a, _b, _c, _d;
+        const days = { day: 1, month: 30, week: 7 }[(_a = workflow == null ? void 0 : workflow.trigger) == null ? void 0 : _a.event] || 7;
+        const since = new Date(Date.now() - days * 24 * 60 * 60 * 1e3);
+        const campaign = ((_c = (_b = workflow == null ? void 0 : workflow.trigger) == null ? void 0 : _b.filters) == null ? void 0 : _c.campaign) || null;
+        const [counted] = await read.aggregate({
+          collection: "lead",
+          pipeline: [
+            {
+              $match: {
+                createdAt: { $gte: since },
+                organization: workflow.organization,
+                ...campaign && { campaigns: { $in: [campaign] } }
+              }
+            },
+            { $count: "count" }
+          ]
+        });
+        const count = Number((counted == null ? void 0 : counted.count) || 0);
+        const request2 = { campaign, count, days };
+        if (!count) return { message: "No new leads in the period \u2014 digest skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const recipients = await teamRecipients({
+          memberIds: ((_d = step.settings) == null ? void 0 : _d.members) || [],
+          organization: workflow.organization,
+          read
+        });
+        const values = { ...context, count };
+        return {
+          message: "Digest of " + count + " new lead(s) queued for " + recipients.length + " recipient(s).",
+          request: request2,
+          response: { count, notified: recipients.length },
+          writes: recipients.map((member) => {
+            var _a2, _b2;
+            return queueNotification({
+              audience: "member",
+              message: interpolate((_a2 = step.settings) == null ? void 0 : _a2.message, values),
+              organization: workflow.organization,
+              send: { type: "email", email: member.email },
+              title: interpolate((_b2 = step.settings) == null ? void 0 : _b2.subject, values),
+              workflow: workflow.id
+            });
+          })
+        };
+      },
+      // To the organization's OWN PEOPLE. Never suppressed, never
+      // subscription-gated, no unsubscribe footer — telling an org's staff about
+      // their own leads is not commercial mail to a stranger.
+      //
+      // FREE, permanently. The lead that triggered this run already consumed the
+      // billable action, and `members` is a list — billing here would turn one
+      // lead into five more charges and the org would be paying to read its own
+      // mail. The declaration prices it at zero; the shell bills nothing for
+      // zero.
+      notify: async ({ context, step, workflow }, { read } = {}) => {
+        var _a;
+        const memberIds = ((_a = step.settings) == null ? void 0 : _a.members) || [];
+        const request2 = { members: memberIds.length };
+        const recipients = await teamRecipients({ memberIds, organization: workflow.organization, read });
+        if (!recipients.length) {
+          return {
+            message: "No owner or accepted member with an email address \u2014 team notification skipped.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const bucket = Math.floor(Date.now() / (15 * 60 * 1e3));
+        return {
+          message: "Team notification queued for " + recipients.length + " recipient(s).",
+          request: request2,
+          response: { notified: recipients.length },
+          writes: recipients.map((member) => {
+            var _a2, _b;
+            return {
+              ...queueNotification({
+                audience: "member",
+                // Per workflow, recipient AND bucket, so one recipient's damper
+                // can never swallow another's mail and a later bucket is never
+                // mistaken for a duplicate of an earlier one.
+                key: "team.notify." + workflow.id + "." + member.id + "." + bucket,
+                message: interpolate((_a2 = step.settings) == null ? void 0 : _a2.message, context),
+                organization: workflow.organization,
+                send: { type: "email", email: member.email },
+                title: interpolate((_b = step.settings) == null ? void 0 : _b.subject, context),
+                workflow: workflow.id
+              }),
+              // E11000 IS THE DAMPER WORKING: this recipient has already been
+              // told within the bucket. Declared per write rather than assumed by
+              // the shell, because on every other write here a duplicate key is a
+              // real failure.
+              ignoreDuplicate: true
+            };
+          })
+        };
+      },
+      // Drawbridge sends lead-facing email itself — no merchant provider gates
+      // it.
+      //
+      // This QUEUES rather than sends: queue/notification.js owns delivery, the
+      // unsubscribe token and the CAN-SPAM footer. The step's job is to say who
+      // and what, correctly, and to refuse early when it must not send at all.
+      send: async ({ context, step, workflow }, { canSend, read } = {}) => {
+        var _a, _b;
+        const to = context == null ? void 0 : context.email;
+        if (!to) throw new Error("No email address on context (context.email is required)");
+        const request2 = { to };
+        const { ok: sendable } = await canSend({ channel: "email", to });
+        if (!sendable) return { message: "Recipient has opted out \u2014 skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const organization2 = await read.get({ collection: "organization", query: { id: workflow.organization } });
+        const subscription = (organization2 == null ? void 0 : organization2.subscription) ? await read.get({ collection: "subscription", query: { id: organization2.subscription } }) : null;
+        if ((subscription == null ? void 0 : subscription.status) !== "active") {
+          return {
+            message: "Organization has no active subscription \u2014 workflow-step email skipped.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        return {
+          message: "Email queued for delivery to " + to + ".",
+          request: request2,
+          response: { queued: true },
+          // NO `connection` FIELD, deliberately: the platform sends this.
+          // `audience : 'lead'` states what the queue would otherwise infer from
+          // shape.
+          //
+          // `campaign` is not decoration. queue/notification.js mints the
+          // unsubscribe token with it, so it decides whether opting out is
+          // scoped to this campaign or the whole organization, and it names the
+          // campaign in the footer. Sending without it silently broadens every
+          // opt-out to the entire organization.
+          writes: [
+            queueNotification({
+              audience: "lead",
+              campaign: (context == null ? void 0 : context.campaign) || null,
+              lead: (context == null ? void 0 : context.lead) || null,
+              message: interpolate((_a = step.settings) == null ? void 0 : _a.message, context),
+              organization: workflow.organization,
+              send: { type: "email", email: to },
+              title: interpolate((_b = step.settings) == null ? void 0 : _b.subject, context),
+              workflow: workflow.id
+            })
+          ]
+        };
+      }
     },
     inbound: false,
     lifecycle: false,
@@ -1392,13 +1828,207 @@ var drawbridge_default2 = {
       products: false,
       promotions: false
     },
-    segment: { sync: {} },
-    sms: { send: {} },
+    segment: {
+      // RECALCULATE SEGMENT MEMBERSHIP. The one FAN-OUT hook: it evaluates every
+      // contact in an organization against every segment, which is too much for
+      // one job, so it returns chunks and the shell defers completion.
+      //
+      // Returning `chunks` is the only thing that makes it different. The
+      // declaration, the guards, the step document and the price are the shell's,
+      // exactly as they are for a step that finishes in one go.
+      sync: async ({ context, step }, { chunkSize, logger: logger2, read, resolveContact } = {}) => {
+        var _a, _b, _c;
+        if (!chunkSize) throw new Error("segment.sync needs chunkSize from the shell");
+        const organization2 = context == null ? void 0 : context.organization;
+        const configured = (_a = step == null ? void 0 : step.settings) == null ? void 0 : _a.segment;
+        const request2 = { organization: organization2 || null, segmentId: configured || null };
+        const release = (ids, status = "active") => {
+          const released = (ids || []).filter(Boolean);
+          return {
+            events: organization2 ? released.map((id) => ({
+              event: "organization.segments",
+              payload: { id, status },
+              room: "organization." + organization2
+            })) : [],
+            writes: released.map((id) => ({
+              collection: "segment",
+              data: { $set: { status } },
+              operation: "update",
+              query: { id }
+            }))
+          };
+        };
+        if (!organization2) {
+          return {
+            ...release([configured]),
+            message: "Trigger data missing organization id \u2014 cannot sync segments.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const segments = await read.aggregate({
+          collection: "segment",
+          pipeline: [{ $match: configured ? { id: configured, organization: organization2 } : { organization: organization2 } }]
+        });
+        if (!segments.length) {
+          return {
+            ...release([configured]),
+            message: "No segments matched the request \u2014 nothing to sync.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        const segmentIds = segments.map((entry) => entry.id);
+        try {
+          let backfilled = 0;
+          if (segments.some((entry) => entry.system)) {
+            const contacted = await read.aggregate({
+              collection: "contact",
+              pipeline: [
+                { $match: { organization: organization2 } },
+                { $project: { _id: 0, leads: 1 } },
+                { $unwind: "$leads" },
+                { $group: { _id: null, ids: { $addToSet: "$leads" } } }
+              ]
+            });
+            const uncontacted = await read.aggregate({
+              collection: "lead",
+              pipeline: [
+                { $match: { id: { $nin: ((_b = contacted[0]) == null ? void 0 : _b.ids) || [] }, organization: organization2 } },
+                { $project: { _id: 0, id: 1 } }
+              ]
+            });
+            for (const lead of uncontacted) {
+              try {
+                await resolveContact({ leadId: lead.id });
+                backfilled += 1;
+              } catch (error) {
+                if (error.code !== 11e3) throw error;
+              }
+            }
+            (_c = logger2 == null ? void 0 : logger2.info) == null ? void 0 : _c.call(logger2, "segment.sync.backfill", { backfilled, organization: organization2, uncontacted: uncontacted.length });
+          }
+          const contacts2 = await read.aggregate({
+            collection: "contact",
+            pipeline: [
+              { $match: { organization: organization2 } },
+              { $project: { _id: 0, id: 1 } },
+              { $sort: { id: 1 } }
+            ]
+          });
+          if (!contacts2.length) {
+            return {
+              ...release(segmentIds),
+              message: "Organization has no contacts to evaluate against segments.",
+              request: request2,
+              response: { skipped: true },
+              skipped: true
+            };
+          }
+          const contactIds = contacts2.map((contact) => contact.id);
+          const org = await read.get({ collection: "organization", query: { id: organization2 } });
+          const chunks = [];
+          for (let index = 0; index < contactIds.length; index += chunkSize) {
+            chunks.push({
+              contactIds: contactIds.slice(index, index + chunkSize),
+              organization: organization2,
+              segments: segmentIds,
+              // A BACKFILL IS NOT BILLABLE. It creates the contacts this run
+              // then evaluates, so charging for it would bill an organization
+              // for work its own history made necessary.
+              usage: (context == null ? void 0 : context.billable) === true && backfilled === 0 ? (org == null ? void 0 : org.usage) || null : null
+            });
+          }
+          return {
+            chunks,
+            ...configured && { extra: { segment: configured } },
+            message: "Queued " + contactIds.length + " contacts across " + chunks.length + " chunks for segment evaluation.",
+            queue: "segment",
+            request: { ...request2, segments: segmentIds },
+            response: { chunks: chunks.length, contacts: contactIds.length, segments: segments.length }
+          };
+        } catch (error) {
+          throw Object.assign(error, release(segmentIds, "error"));
+        }
+      }
+    },
+    sms: {
+      // SMS TO A LEAD, through the merchant's own Twilio connection.
+      //
+      // WITHDRAWN from the builder — twilio went, and a connection-gated step
+      // with no connection to gate on could only ever render permanently
+      // disabled. Stored workflows still carry it, so it still runs.
+      //
+      // It looks its own connection up rather than relying on the shell, because
+      // the step is declared by the PRIVATE drawbridge connection (which has
+      // none) while the credential belongs to twilio (which has no manifest).
+      // Platform SMS will remove that split the way it did for email.
+      send: async ({ context, step, workflow }, { canSend, read } = {}) => {
+        var _a, _b, _c;
+        const to = (_a = context == null ? void 0 : context.phone) == null ? void 0 : _a.number;
+        if (!to) throw new Error("No phone number on context (context.phone.number is required)");
+        const request2 = { to };
+        const connection2 = await read.get({
+          collection: "connection",
+          query: { organization: workflow.organization, slug: "twilio", status: "active" }
+        });
+        if (!connection2) return { message: "No active Twilio SMS connection \u2014 workflow-step SMS skipped.", request: request2, response: { skipped: true }, skipped: true };
+        const { ok: sendable } = await canSend({ channel: "sms", to: context.phone });
+        if (!sendable) return { message: "Recipient has opted out \u2014 skipped.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          message: "SMS queued for delivery to " + to + " via twilio.",
+          request: request2,
+          response: { provider: "twilio", queued: true },
+          // QUEUES rather than sends: queue/notification.js owns delivery, the
+          // carrier opt-out line and the segment count this is billed on.
+          writes: [
+            queueNotification({
+              connection: connection2.id,
+              message: interpolate((_b = step.settings) == null ? void 0 : _b.message, context),
+              organization: workflow.organization,
+              send: { phone: { number: to }, type: "phone" },
+              title: interpolate((_c = step.settings) == null ? void 0 : _c.subject, context),
+              workflow: workflow.id
+            })
+          ]
+        };
+      }
+    },
     webhook: false
   },
   icon: drawbridge_default,
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
+  // THE PLATFORM'S OWN SENDING CREDENTIALS — SendGrid, Twilio, and the internal
+  // HubSpot portal. No merchant ever sees these; they are what an admin types on
+  // the provider screen so that Drawbridge itself can send.
+  //
+  // They belong on THIS manifest because this is the connection that sends: the
+  // email, sms and segment hooks below are the only things that spend them, and
+  // a private connection is still where a vendor fact lives.
+  //
+  // UNLIKE every public vendor, none of these appear in `requires` — see the
+  // comment there. Availability and configuration are different questions, and a
+  // missing CRM token must not take every base workflow step away.
+  provider: {
+    fields: [
+      { input: "email", key: "accountSender", credential: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
+      { input: "password", key: "apiKey", credential: "SENDGRID_API_KEY", label: "SendGrid API key", redact: true, required: true },
+      // NOT required. The CRM sync is best-effort internal tooling and no-ops
+      // without a token — requiring it would make the whole drawbridge provider
+      // read not-live over something no merchant ever sees.
+      { input: "password", key: "hubspotToken", credential: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
+      // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
+      // either. Unset, it degrades to the account sender rather than
+      // refusing to start.
+      { input: "email", key: "leadSender", credential: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
+      { input: "text", key: "smsFrom", credential: "TWILIO_ACCOUNT_FROM", label: "SMS number", required: true },
+      { input: "password", key: "smsSid", credential: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", redact: true, required: true },
+      { input: "password", key: "smsToken", credential: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", redact: true, required: true }
+    ]
+  },
   // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
   //
   // `requires` gates AVAILABILITY: a name in it that is unset removes the whole
@@ -1435,11 +2065,11 @@ var drawbridge_default2 = {
         key: "Email \u2014 Digest",
         queue: "notification",
         settings: {
-          // The organization OWNER is always a recipient, resolved in sync,
-          // so this is additional recipients rather than the list. It cannot
-          // be required: the members endpoint is owner-gated and the owner is
-          // not a member document, so a solo merchant has nothing to pick and
-          // could never save the step.
+          // The organization OWNER is always a recipient, resolved by the
+          // hook, so this is additional recipients rather than the list. It
+          // cannot be required: the members endpoint is owner-gated and the
+          // owner is not a member document, so a solo merchant has nothing to
+          // pick and could never save the step.
           members: { of: "string", type: "array" },
           message: { required: true, type: "string" },
           subject: { required: true, type: "string" }
@@ -1535,12 +2165,12 @@ var drawbridge_default2 = {
 
 // lib/connections/icons/klaviyo.js
 var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="white"/>
+<rect width="500" height="500" fill="#FF4B32"/>
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
-// lib/connections/klaviyo.js
-var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
+// lib/connections/providers/klaviyo.js
+var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
     ...payload && { body: JSON.stringify(payload) },
     headers: {
@@ -1576,7 +2206,8 @@ var klaviyo_default2 = {
   // differently, and it says so in hooks.auth.token rather than as a flag here.
   auth: {
     oauth: {
-      // NAMES the env vars holding OUR application's client. One identity,
+      // NAMES the credentials holding OUR application's client — keys into
+      // the stored provider credentials, not env vars. One identity,
       // every merchant — the token is the merchant's and arrives from their
       // own consent, which is what stops one organization reading another's
       // data.
@@ -1716,9 +2347,9 @@ var klaviyo_default2 = {
       // renders an empty "Klaviyo account" field, because the merchant is
       // never asked which account they connected — the consent already
       // decided it, and asking again would be a question we can answer.
-      connect: async ({ fetcher, tokens }) => {
+      connect: async ({ tokens }, { fetcher } = {}) => {
         var _a, _b, _c;
-        const body = await api("/accounts", { fetcher, token: tokens.accessToken });
+        const body = await api2("/accounts", { fetcher, token: tokens.accessToken });
         const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
         return {
           account: ((_c = (_b = account == null ? void 0 : account.attributes) == null ? void 0 : _b.contact_information) == null ? void 0 : _c.organization_name) || (account == null ? void 0 : account.id) || null,
@@ -1731,7 +2362,7 @@ var klaviyo_default2 = {
       //
       // Basic auth with our client, exactly like the token exchange — the
       // token being revoked is the subject, not the credential.
-      disconnect: async ({ clientId, clientSecret, fetcher = fetch, manifest, settings }) => {
+      disconnect: async ({ clientId, clientSecret, manifest, settings }, { fetcher = fetch } = {}) => {
         const token = (settings == null ? void 0 : settings.refreshToken) || (settings == null ? void 0 : settings.accessToken);
         if (!token) return { revoked: false };
         const response = await fetcher(manifest.auth.oauth.urls.revoke, {
@@ -1754,7 +2385,7 @@ var klaviyo_default2 = {
       // the refresh token is the only thing that asks Klaviyo.
       //
       // It also keeps the grant warm against the 90-day idle window above.
-      probe: async ({ clientId, clientSecret, fetcher, manifest, settings }) => {
+      probe: async ({ clientId, clientSecret, manifest, settings }, { fetcher } = {}) => {
         const token = await accessToken({
           clientId,
           clientSecret,
@@ -1784,19 +2415,18 @@ var klaviyo_default2 = {
     // the store's.
     commerce: false,
     // The verb the contacts.sync step points at. It does the work — including
-    // writing the profile id back onto the lead — and returns what happened.
     contacts: {
       // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
       // different thing from deleting the profile.
       remove: false,
-      sync: async ({ contact, fetcher, lead, settings, suppressed, token }) => {
+      sync: async ({ contact, lead, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c;
         const list = settings == null ? void 0 : settings.list;
         if (!list) return { message: "No Klaviyo list is chosen for this connection.", skipped: true };
         const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", skipped: true };
         const totals = (contact == null ? void 0 : contact.totals) || {};
-        const profile = await api("/profiles/", {
+        const profile = await api2("/profiles/", {
           fetcher,
           method: "POST",
           payload: {
@@ -1824,7 +2454,7 @@ var klaviyo_default2 = {
         });
         const profileId = (_c = profile == null ? void 0 : profile.data) == null ? void 0 : _c.id;
         if (!profileId) return { message: "Klaviyo returned no profile id.", skipped: true };
-        await api("/profile-subscription-bulk-create-jobs/", {
+        await api2("/profile-subscription-bulk-create-jobs/", {
           fetcher,
           method: "POST",
           payload: {
@@ -1881,13 +2511,13 @@ var klaviyo_default2 = {
       // it, so one call quietly returns the first ten lists and an account
       // with more shows a picker missing the one they wanted, with nothing to
       // indicate anything was cut.
-      audiences: async ({ cursor, fetcher, limit = 100, search, token }) => {
+      audiences: async ({ cursor, limit = 100, search, token }, { fetcher } = {}) => {
         var _a, _b;
         const audiences = [];
         let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
-          const body = await api(next, { fetcher, token });
+          const body = await api2(next, { fetcher, token });
           for (const list of (body == null ? void 0 : body.data) || []) {
             audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
           }
@@ -1913,6 +2543,16 @@ var klaviyo_default2 = {
     webhook: false
   },
   icon: klaviyo_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen. Declared here rather than in a
+  // table in lib/providers.js, so a vendor's credentials sit beside the
+  // `requires` that names the same variables.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   requires: [
     "KLAVIYO_OAUTH_CLIENT_ID",
     "KLAVIYO_OAUTH_CLIENT_SECRET"
@@ -1986,6 +2626,9 @@ var klaviyo_default2 = {
   title: "Klaviyo"
 };
 
+// lib/connections/providers/mailchimp.js
+import { createHash as createHash2 } from "crypto";
+
 // lib/connections/icons/mailchimp.js
 var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="#FFE01B"/>
@@ -1993,11 +2636,30 @@ var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 <path d="M360.476 284.243C360.35 283.835 359.618 281.204 358.647 278.052L356.621 272.648C360.575 266.696 360.645 261.405 360.124 258.393C359.531 254.519 357.693 250.944 354.89 248.205C351.766 244.94 345.363 241.563 336.385 239.044L331.671 237.736C331.643 237.524 331.418 226.619 331.235 221.933C331.08 218.555 330.798 213.264 329.152 208.058C327.182 200.993 323.791 194.858 319.527 190.876C331.277 178.717 338.594 165.307 338.58 153.81C338.538 131.703 311.379 124.976 277.902 138.851L270.824 141.863C270.795 141.835 258.004 129.283 257.821 129.128C219.63 95.8334 100.327 228.476 138.49 260.687L146.835 267.737C144.581 273.775 143.781 280.259 144.499 286.664C145.414 295.543 149.973 304.029 157.375 310.6C164.411 316.82 173.684 320.788 182.648 320.774C197.494 354.998 231.408 375.965 271.175 377.161C313.842 378.427 349.641 358.403 364.67 322.435C365.641 319.916 369.806 308.546 369.806 298.513C369.792 288.409 364.093 284.229 360.476 284.243ZM185.913 311.149C184.613 311.381 183.293 311.48 181.973 311.445C169.083 311.079 155.166 299.483 153.787 285.735C152.253 270.537 160.02 258.829 173.783 256.071C175.415 255.72 177.414 255.537 179.552 255.635C187.264 256.085 198.606 261.996 201.209 278.784C203.517 293.63 199.858 308.785 185.913 311.149ZM171.545 246.953C163.179 248.499 155.744 253.244 150.817 260.18C148.045 257.873 142.909 253.426 142.008 251.681C134.635 237.693 150.043 210.478 160.823 195.111C187.405 157.145 229.086 128.424 248.393 133.603C251.517 134.503 261.902 146.563 261.902 146.563C261.902 146.563 242.623 157.244 224.724 172.16C200.646 190.735 182.423 217.697 171.545 246.953ZM306.792 305.464C306.937 305.403 307.057 305.295 307.134 305.157C307.211 305.019 307.239 304.86 307.214 304.704C307.205 304.61 307.178 304.519 307.133 304.436C307.088 304.353 307.027 304.28 306.954 304.221C306.88 304.162 306.796 304.118 306.705 304.092C306.614 304.066 306.519 304.059 306.426 304.071C306.426 304.071 286.246 307.054 267.179 300.089C269.247 293.348 274.792 295.754 283.137 296.444C296.108 297.209 309.116 295.802 321.623 292.279C330.25 289.788 341.592 284.905 350.401 277.953C353.384 284.497 354.425 291.674 354.425 291.674C354.425 291.674 356.719 291.265 358.647 292.447C360.476 293.573 361.799 295.895 360.898 301.89C359.027 313.119 354.271 322.224 346.235 330.611C341.236 336.036 335.277 340.492 328.659 343.754C324.983 345.691 321.151 347.32 317.205 348.623C286.964 358.487 256.006 347.638 246.029 324.321C245.224 322.535 244.556 320.691 244.03 318.804C239.781 303.438 243.383 285.032 254.655 273.408C255.372 272.676 256.09 271.804 256.09 270.706C256.09 269.806 255.499 268.835 255.007 268.131C251.066 262.418 237.374 252.666 240.132 233.795C242.088 220.23 253.951 210.689 265.012 211.252L267.826 211.421C272.611 211.702 276.79 212.307 280.73 212.49C287.344 212.758 293.268 211.801 300.304 205.947C302.683 203.949 304.582 202.246 307.791 201.711C308.128 201.627 308.973 201.359 310.647 201.416C312.365 201.485 314.032 202.015 315.474 202.949C321.103 206.693 321.905 215.783 322.214 222.439C322.383 226.225 322.848 235.414 322.988 238.031C323.354 244.054 324.944 244.912 328.125 245.954C329.94 246.573 331.615 246.995 334.077 247.713C341.521 249.781 345.968 251.934 348.754 254.65C350.198 256.049 351.13 257.893 351.4 259.885C352.315 266.316 346.432 274.252 330.925 281.457C313.954 289.324 293.367 291.322 279.154 289.732L274.173 289.169C262.774 287.649 256.315 302.34 263.14 312.402C267.545 318.889 279.52 323.11 291.523 323.11C319.006 323.139 340.142 311.402 348.023 301.242L348.642 300.356C349.008 299.765 348.712 299.469 348.22 299.779C341.817 304.169 313.279 321.619 282.771 316.384C282.771 316.384 279.056 315.765 275.678 314.442C273.005 313.429 267.362 310.811 266.686 305.042C291.27 312.683 306.792 305.478 306.792 305.464ZM220.671 194.971C230.127 184.051 241.765 174.538 252.206 169.219C252.558 169.022 252.938 169.43 252.741 169.754C251.46 172 250.476 174.403 249.814 176.902C249.73 177.282 250.138 177.592 250.461 177.353C256.963 172.934 268.248 168.192 278.155 167.601C278.251 167.584 278.351 167.601 278.436 167.65C278.521 167.698 278.586 167.775 278.621 167.866C278.656 167.957 278.658 168.058 278.627 168.151C278.596 168.244 278.533 168.323 278.451 168.375C276.809 169.634 275.342 171.105 274.088 172.751C273.891 173.032 274.074 173.44 274.426 173.44C281.378 173.483 291.186 175.903 297.56 179.491C297.982 179.745 297.673 180.575 297.209 180.462C287.527 178.253 271.724 176.564 255.288 180.575C240.597 184.149 229.396 189.666 221.248 195.618C220.826 195.899 220.333 195.351 220.671 194.971Z" fill="#231E15"/>
 </svg>`;
 
-// lib/connections/mailchimp.js
+// lib/connections/providers/mailchimp.js
 var base = (dc) => {
   if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
   return "https://" + dc + ".api.mailchimp.com/3.0";
 };
+var api3 = async (path, { dc, fetcher = fetch, method = "GET", payload, token }) => {
+  const response = await fetcher(base(dc) + path, {
+    ...payload && { body: JSON.stringify(payload) },
+    headers: {
+      authorization: "Bearer " + token,
+      ...payload && { "content-type": "application/json" }
+    },
+    method,
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) {
+    throw Object.assign(
+      new Error("Mailchimp refused the request (" + response.status + ")"),
+      { status: response.status }
+    );
+  }
+  return response.json();
+};
+var subscriberHash = (email) => createHash2("md5").update(String(email).trim().toLowerCase()).digest("hex");
 var mailchimp_default2 = {
   // OAUTH 2, authorization code. Every url below is quoted from
   // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
@@ -2040,7 +2702,9 @@ var mailchimp_default2 = {
     confirm: "Disconnecting removes Drawbridge's stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
     description: [
       "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
-      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships."
+      "Connecting Mailchimp lets Drawbridge sync the contacts your campaigns collect into a Mailchimp audience, so the people who enter a giveaway can be marketed to alongside the rest of your list.",
+      "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
+      "Someone who unsubscribed inside Mailchimp keeps that choice: a resync only sets the status of a subscriber Mailchimp has never seen before."
     ],
     excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
     guide: [
@@ -2082,7 +2746,7 @@ var mailchimp_default2 = {
       // The header here is `OAuth <token>`, not Bearer — that is specific to
       // the metadata endpoint. Marketing API calls take Bearer; see the
       // audiences hook.
-      connect: async ({ fetcher = fetch, tokens }) => {
+      connect: async ({ tokens }, { fetcher = fetch } = {}) => {
         const response = await fetcher("https://login.mailchimp.com/oauth2/metadata", {
           headers: {
             authorization: "OAuth " + (tokens == null ? void 0 : tokens.accessToken)
@@ -2115,7 +2779,51 @@ var mailchimp_default2 = {
       token: authToken
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // The verb the contacts.sync step points at.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from deleting the member — and Mailchimp's own delete is
+      // permanent, so the address can never be re-added.
+      remove: false,
+      // PUT /lists/{list_id}/members/{subscriber_hash} — an UPSERT, which is
+      // why there is no create-or-update branch here. Quoted from Mailchimp's
+      // Marketing API reference for the list-members resource.
+      sync: async ({ lead, settings, suppressed, token }, { fetcher } = {}) => {
+        var _a, _b;
+        const audience = settings == null ? void 0 : settings.audience;
+        if (!audience) return { message: "No Mailchimp audience is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        if (!email) return { message: "That lead has no email address to sync.", skipped: true };
+        const hash = subscriberHash(email);
+        const member = await api3("/lists/" + audience + "/members/" + hash, {
+          dc: settings == null ? void 0 : settings.dc,
+          fetcher,
+          method: "PUT",
+          payload: {
+            email_address: email,
+            // FNAME ONLY. Unlike Klaviyo, Mailchimp's custom fields are not
+            // schemaless — a merge tag that does not exist on the audience is
+            // refused, taking the whole request with it — and FNAME is one of
+            // the two tags every audience is created with. The Drawbridge
+            // totals Klaviyo receives cannot travel until something registers
+            // merge fields on the chosen audience, which is lifecycle.register's
+            // job and is not built.
+            ...(lead == null ? void 0 : lead.name) && { merge_fields: { FNAME: String(lead.name).trim().split(/\s+/)[0] } },
+            ...suppressed && { status: "unsubscribed" },
+            status_if_new: suppressed ? "unsubscribed" : "subscribed"
+          },
+          token
+        });
+        return {
+          // Merged into `context` for later steps in this run.
+          context: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash },
+          message: suppressed ? "Synced to Mailchimp as unsubscribed \u2014 this contact has opted out." : "Synced to the Mailchimp audience.",
+          // Recorded on the run for support to read back, not a write
+          // instruction — the hook has already written what it needed to.
+          response: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash }
+        };
+      }
+    },
     // Drawbridge sends its own notification email and SMS, and owns its own
     // segments — see the private `drawbridge` manifest. A vendor answering
     // these would be a second sender, which is the arrangement the platform
@@ -2134,24 +2842,13 @@ var mailchimp_default2 = {
       // successful — the same silent truncation Klaviyo has, at a different
       // number. Paged against total_items so an account past a thousand still
       // resolves.
-      audiences: async ({ cursor, fetcher = fetch, limit = 100, search, settings, token }) => {
-        const dc = settings == null ? void 0 : settings.dc;
+      audiences: async ({ cursor, limit = 100, search, settings, token }, { fetcher } = {}) => {
         const count = Math.min(limit, 1e3);
         const offset = Number(cursor || 0);
-        const response = await fetcher(
-          base(dc) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
-          {
-            headers: { authorization: "Bearer " + token },
-            signal: AbortSignal.timeout(15e3)
-          }
+        const body = await api3(
+          "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        if (!response.ok) {
-          throw Object.assign(
-            new Error("Mailchimp refused the request (" + response.status + ")"),
-            { status: response.status }
-          );
-        }
-        const body = await response.json();
         const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
@@ -2173,6 +2870,15 @@ var mailchimp_default2 = {
     webhook: false
   },
   icon: mailchimp_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen, beside the `requires` naming the
+  // same variables.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   // The OAuth client this deployment registered. Without both, the vendor drops
   // out of availableConnections rather than offering a Connect button that
   // cannot complete.
@@ -2181,54 +2887,82 @@ var mailchimp_default2 = {
     "MAILCHIMP_OAUTH_CLIENT_SECRET"
   ],
   slug: "mailchimp",
-  // A key with no audience chosen is authenticated and inert. Mailchimp also
-  // needs its merge fields created on that audience before any Drawbridge total
-  // can be written to a member — unlike Klaviyo, its custom fields are not
-  // schemaless — so the audience must be picked before lifecycle.register has
-  // anything to register against.
+  // A grant with no audience chosen is authenticated and useless — the sync has
+  // nowhere to put anyone — so the card must say Pending rather than Active over
+  // nothing. Mailchimp also needs its merge fields created on that audience
+  // before any Drawbridge total can be written to a member — unlike Klaviyo, its
+  // custom fields are not schemaless — so the audience must be picked before
+  // lifecycle.register has anything to register against.
   status: (data2) => {
     var _a;
     return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? data2.status : "pending";
   },
-  // No steps: audience sync has not shipped, so this vendor contributes nothing
-  // to a workflow yet. An empty steps object is the honest declaration — the
-  // catalog renders the connection, and no builder offers a step it cannot run.
-  steps: {},
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. It names the hook that does the work, and
+      // the nesting IS the name: this is `step.contacts.sync`, the string a
+      // workflow document stores. Klaviyo and Attentive declare the same type —
+      // a step belongs to the capability, not to whoever implements it — and the
+      // connection on the step document is what says which vendor runs.
+      sync: ({ data: data2 }) => ({
+        hook: "contacts.sync",
+        // NO ACCOUNT NAME TO INTERPOLATE, unlike Klaviyo. Mailchimp's
+        // auth.connect deliberately stores only the data centre (a test pins
+        // that), and settings.audience is an opaque list id no merchant would
+        // recognise in a builder label — so the label names the vendor rather
+        // than showing a string like a1b2c3d4e5.
+        key: "Sync contact to Mailchimp",
+        queue: "connection",
+        // Nothing for a merchant to configure on the step itself — the audience
+        // is chosen once on the connection. Declared empty rather than omitted,
+        // so "this step takes no settings" and "nobody thought about settings"
+        // stay different statements.
+        settings: {},
+        // BOTH triggers, for the same reason as Klaviyo: lead.insert alone only
+        // ever fires for someone with no history yet, and crossing into a
+        // segment is the other moment a contact is worth pushing.
+        triggers: ["lead.insert", "segment.contact.add"],
+        // One source for cost: what the builder discloses before a merchant
+        // adds this step, and what is charged when it runs.
+        usage: { actions: 1 }
+      })
+    }
+  },
+  // WHY, in the merchant's words, and what to do about it.
   tasks: (data2) => {
     var _a;
-    return [
-      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
-        {
-          message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
-          title: "Choose an audience"
-        }
-      ],
+    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
       {
-        message: "Contact syncing to Mailchimp audiences has not shipped yet, and this connection no longer sends your email. Nothing is being sent to Mailchimp right now.",
-        title: "Audience sync not available yet",
-        type: "warning"
+        message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose an audience"
       }
     ];
   },
   title: "Mailchimp"
 };
 
+// lib/connections/providers/shopify.js
+import { randomUUID } from "crypto";
+import { customAlphabet as customAlphabet2 } from "nanoid";
+
 // lib/connections/icons/shopify.js
 var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M309.524 407.192L308.799 128.423C306.921 126.545 303.258 127.112 301.827 127.531L292.29 130.487C291.113 126.613 289.585 122.854 287.726 119.258C280.959 106.337 271.069 99.5052 259.096 99.4866H259.059C258.259 99.4866 257.469 99.5609 256.67 99.626L256.577 99.6353C256.231 99.2089 255.871 98.7935 255.499 98.3897C250.293 92.8125 243.601 90.0889 235.588 90.3213C220.139 90.7675 204.755 101.941 192.271 121.786C183.487 135.757 176.823 153.298 174.917 166.878L144.493 176.313C135.542 179.129 135.263 179.408 134.082 187.858C133.199 194.253 109.766 375.69 109.766 375.69L306.159 409.692L309.524 407.192ZM245.181 103.065C242.569 101.346 239.511 100.546 235.885 100.621C212.033 101.308 191.23 138.611 185.923 163.467L208.771 156.384L212.851 155.119C215.845 139.336 223.355 122.957 233.181 112.416C236.616 108.639 240.671 105.477 245.172 103.065H245.181ZM224.145 151.615L256.94 141.446C257.042 132.894 256.112 120.252 251.836 111.329C247.282 113.207 243.452 116.497 240.7 119.444C233.329 127.373 227.315 139.466 224.155 151.615H224.145ZM267.211 138.267L282.455 133.536C280.02 125.616 274.238 112.342 262.517 110.111C266.161 119.527 267.099 130.431 267.211 138.267Z" fill="#95BF47"/>
-<path d="M353.528 149.156C352.356 149.063 329.657 148.709 329.657 148.709C329.657 148.709 310.666 130.249 308.789 128.362C308.062 127.691 307.141 127.268 306.158 127.153V409.64L391.257 388.456C391.257 388.456 356.53 153.366 356.307 151.758C356.199 151.075 355.866 150.448 355.361 149.976C354.856 149.505 354.216 149.216 353.528 149.156Z" fill="#5E8E3E"/>
-<path d="M258.993 193.019L249.103 230.052C249.103 230.052 238.079 225.023 225 225.85C205.833 227.059 205.628 239.171 205.824 242.21C206.865 258.756 250.376 262.381 252.821 301.171C254.745 331.688 236.656 352.574 210.592 354.21C179.313 356.19 162.089 337.711 162.089 337.711L168.716 309.472C168.716 309.472 186.052 322.569 199.921 321.686C208.993 321.119 212.228 313.738 211.903 308.514C210.536 286.921 175.102 288.185 172.862 252.695C170.985 222.811 190.57 192.554 233.803 189.821C250.46 188.762 258.993 193.028 258.993 193.028" fill="white"/>
+<rect width="500" height="500" fill="#95C049"/>
+<path d="M292.997 147.633C292.997 147.633 289.98 148.495 285.023 150.004C284.161 147.202 282.868 143.969 281.144 140.521C275.54 129.744 267.134 123.925 257.22 123.925C256.574 123.925 255.927 123.925 255.065 124.141C254.849 123.71 254.418 123.494 254.203 123.063C249.892 118.322 244.289 116.166 237.607 116.382C224.676 116.813 211.744 126.081 201.399 142.676C194.071 154.314 188.468 168.97 186.959 180.393C172.088 184.919 161.743 188.152 161.527 188.367C153.984 190.738 153.768 190.954 152.906 198.066C151.613 203.454 132 355.4 132 355.4L294.937 383.633V147.202C294.075 147.418 293.429 147.418 292.997 147.633ZM255.281 159.271C246.66 161.858 237.176 164.875 227.909 167.677C230.495 157.547 235.668 147.418 241.702 140.736C244.073 138.365 247.306 135.564 250.97 133.839C254.634 141.598 255.496 152.159 255.281 159.271ZM237.823 125.003C240.84 125.003 243.427 125.649 245.582 126.943C242.133 128.667 238.685 131.469 235.452 134.702C227.262 143.538 221.012 157.332 218.426 170.479C210.667 172.85 202.908 175.22 195.796 177.376C200.322 156.901 217.779 125.649 237.823 125.003ZM212.607 243.542C213.469 257.335 249.892 260.353 252.048 292.897C253.556 318.545 238.47 336.002 216.701 337.295C190.407 339.02 175.967 323.502 175.967 323.502L181.571 299.794C181.571 299.794 196.011 310.786 207.649 309.924C215.193 309.493 217.995 303.242 217.779 298.932C216.701 280.828 186.959 281.905 185.019 252.163C183.295 227.377 199.675 202.161 235.883 199.79C249.892 198.928 257.005 202.377 257.005 202.377L248.815 233.412C248.815 233.412 239.547 229.102 228.555 229.964C212.607 231.041 212.391 241.171 212.607 243.542ZM263.902 156.685C263.902 150.219 263.039 140.952 260.022 133.193C269.936 135.133 274.678 146.124 276.833 152.806C272.954 153.883 268.643 155.176 263.902 156.685Z" fill="white"/>
+<path d="M300.325 382.771L368 365.96C368 365.96 338.904 169.185 338.689 167.892C338.473 166.599 337.396 165.737 336.318 165.737C335.24 165.737 316.274 165.306 316.274 165.306C316.274 165.306 304.636 154.099 300.325 149.788V382.771Z" fill="white"/>
 </svg>`;
 
 // lib/connections/inbound.js
 import { createHmac, timingSafeEqual } from "crypto";
-var verifySignature = ({ body, descriptor, headers }) => {
+var verifySignature = ({ body, descriptor, headers, secret }) => {
+  if (!secret) {
+    throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
+  }
   const provided = headers[descriptor.headers.signature];
   if (!provided) {
     throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
   }
-  const digest = createHmac(descriptor.signature.algorithm, process.env[descriptor.signature.secret]).update(body).digest(descriptor.signature.encoding);
+  const digest = createHmac(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
   const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
   const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
   if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual(digestBuffer, providedBuffer)) {
@@ -2238,7 +2972,60 @@ var verifySignature = ({ body, descriptor, headers }) => {
 };
 var readEventHeader = ({ descriptor, headers }) => headers[descriptor.headers.event];
 
-// lib/connections/shopify.js
+// lib/email.js
+var GMAIL_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
+var toCanonicalEmail = (value) => {
+  if (!value || typeof value !== "string") return null;
+  const email = value.trim().toLowerCase();
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return null;
+  let local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  const plus = local.indexOf("+");
+  if (plus > 0) local = local.slice(0, plus);
+  if (GMAIL_DOMAINS.has(domain)) local = local.replaceAll(".", "");
+  if (!local) return null;
+  return local + "@" + domain;
+};
+
+// lib/connections/providers/shopify.js
+var toLine = ({
+  price,
+  product_id: productId,
+  quantity,
+  title,
+  variant_id: variantId,
+  variant_title: variantTitle
+}) => ({
+  price: parseFloat(price) || 0,
+  productId: productId ? "gid://shopify/Product/" + productId : null,
+  quantity: quantity || 1,
+  title: title || null,
+  variantId: variantId ? "gid://shopify/ProductVariant/" + variantId : null,
+  variantTitle: variantTitle || null
+});
+var attributeLineItems = (lineItems = []) => lineItems.reduce(
+  (acc, item) => {
+    const attrs = (item.properties || []).reduce(
+      (map, { name, value }) => {
+        map[name] = value;
+        return map;
+      },
+      {}
+    );
+    if (!attrs["_drwbrdg_ca"]) return acc;
+    if (!Object.keys(acc.attrMap).length) acc.attrMap = attrs;
+    const line = toLine(item);
+    acc.attributedGross += line.price * line.quantity;
+    acc.attributedLines.push(line);
+    return acc;
+  },
+  { attrMap: {}, attributedGross: 0, attributedLines: [] }
+);
+var generateDiscountCode = customAlphabet2("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ", 8);
+var REFRESH_TOKEN_FRESHNESS_BUFFER_MS = 5 * 24 * 60 * 60 * 1e3;
+var OAUTH_ERROR_SOURCE = "oauth";
+var OAUTH_GRANT_REVOKED_CODES = ["application_cannot_be_found", "invalid_grant"];
 var inbound = {
   headers: {
     event: "x-shopify-topic",
@@ -2300,7 +3087,7 @@ var shopify_default2 = {
     // the App Store listing, and the dashboard must never imply a store can be
     // linked from inside it.
     redirect: {
-      env: "SHOPIFY_APP_LISTING_URL",
+      credential: "SHOPIFY_APP_LISTING_URL",
       title: "View on the Shopify App Store"
     }
   },
@@ -2355,20 +3142,476 @@ var shopify_default2 = {
       //
       // `shopify` is injected for the same reason it is everywhere else — this
       // package cannot import @drawbridge/shopify, which depends on it.
-      scopes: ({ scope, shopify }) => scope ? shopify.oauth.missingScopes(scope) : null,
+      scopes: ({ scope }, { shopify } = {}) => scope ? shopify.oauth.missingScopes(scope) : null,
       // Shopify's install grant is exchanged inside its own app flow, not
       // through the shared OAuth runner.
       token: false
     },
-    // Implemented in drawbridge-sync, which owns the attribution and the
-    // controllers it needs. Declared here so the steps below can point at them:
-    // a step naming a hook the vendor does not implement is a workflow that
-    // accepts the step and then silently does nothing.
+    // THE VENDOR'S OWN WORK, here in full. Every body describes its writes,
+    // enqueues and events for the shell to perform — see contract.js — and
+    // everything it needs arrives as an argument: `read` (the controller's
+    // read methods, nothing that writes), `shopify` (the SDK, injected because
+    // this package cannot import what depends on it), `adminToken` (minted by
+    // the shell, which persists rotations), `mintId` (so one described write
+    // can reference another), `dispatch` (the caller's own coordinator table,
+    // for the hooks that are dispatches).
     commerce: {
-      code: {},
-      customer: {},
-      order: {},
-      product: {}
+      // MINT A DISCOUNT CODE against the merchant's chosen discount, mapped to
+      // one lead — which is what lets an order that redeems it be attributed
+      // back.
+      code: async ({ connection: connection2, context, step }, { adminToken, shopify } = {}) => {
+        var _a;
+        const discount = (_a = step.settings) == null ? void 0 : _a.discount;
+        const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection2.shop };
+        if (!(context == null ? void 0 : context.email)) return { message: "Lead email is missing.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(context == null ? void 0 : context.lead)) return { message: "Lead id is missing.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(discount == null ? void 0 : discount.id)) return { message: "Discount is not configured on this step.", request: request2, response: { skipped: true }, skipped: true };
+        const adminAccessToken = await adminToken();
+        if (!context.shopifyCustomerId) {
+          const customer = await shopify.admin.getOrCreateCustomer({ adminAccessToken, domain: connection2.shop, email: context.email });
+          if (!(customer == null ? void 0 : customer.id)) return { message: "Shopify did not return a customer id \u2014 create/lookup failed.", request: request2, response: { skipped: true }, skipped: true };
+        }
+        const discountCode = await shopify.admin.createDiscountCode({
+          adminAccessToken,
+          code: "DB-" + generateDiscountCode(),
+          discountId: discount.id,
+          domain: connection2.shop
+        });
+        if (!discountCode) return { message: "Shopify did not return a discount code \u2014 create failed.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          context: {
+            shopifyDiscountCode: discountCode.code,
+            shopifyDiscountId: String(discountCode.id)
+          },
+          message: "Discount code created and linked to lead.",
+          request: request2,
+          response: { code: discountCode.code, id: String(discountCode.id) },
+          // bypassDocumentValidation because these are vendor ids on a
+          // Drawbridge document the schema does not declare — the
+          // canonical-identity work resolves it properly.
+          writes: [{
+            collection: "lead",
+            data: {
+              $set: {
+                shopifyDiscountCode: discountCode.code,
+                shopifyDiscountId: String(discountCode.id)
+              }
+            },
+            operation: "update",
+            options: { bypassDocumentValidation: true },
+            query: { id: context.lead }
+          }]
+        };
+      },
+      // CREATE THE BUYER AT THE STORE, so an order can be attributed to them.
+      //
+      // IDEMPOTENT THREE WAYS, because this runs on every entry and a duplicate
+      // customer at the store is a support ticket: the context may already
+      // carry the id from an earlier step, the lead may already be linked from
+      // an earlier run, and Shopify's own get-or-create settles the rest.
+      customer: async ({ connection: connection2, context }, { adminToken, read, shopify } = {}) => {
+        const request2 = { email: (context == null ? void 0 : context.email) || null, lead: (context == null ? void 0 : context.lead) || null, shop: connection2.shop };
+        if (!(context == null ? void 0 : context.email)) return { message: "Lead email is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
+        if (!(context == null ? void 0 : context.lead)) return { message: "Lead id is missing \u2014 cannot create Shopify customer.", request: request2, response: { skipped: true }, skipped: true };
+        if (context.shopifyCustomerId) {
+          return {
+            context: { shopifyCustomerId: context.shopifyCustomerId },
+            message: "Trigger data already includes a Shopify customer id \u2014 reusing.",
+            request: request2,
+            response: { shopifyCustomerId: context.shopifyCustomerId },
+            // Reusing an id is not a creation, so it does not bill.
+            skipped: true
+          };
+        }
+        const lead = await read.get({ collection: "lead", query: { id: context.lead } });
+        if (lead == null ? void 0 : lead.shopifyCustomerId) {
+          return {
+            context: { shopifyCustomerId: lead.shopifyCustomerId },
+            message: "Lead already has a Shopify customer id \u2014 reusing.",
+            request: request2,
+            response: { shopifyCustomerId: lead.shopifyCustomerId },
+            skipped: true
+          };
+        }
+        const adminAccessToken = await adminToken();
+        const parts = ((lead == null ? void 0 : lead.name) || "").trim().split(/\s+/).filter(Boolean);
+        const customer = await shopify.admin.getOrCreateCustomer({
+          adminAccessToken,
+          domain: connection2.shop,
+          email: context.email,
+          firstName: parts.length ? parts[0] : null,
+          lastName: parts.length > 1 ? parts.slice(1).join(" ") : null,
+          source: "drawbridge"
+        });
+        if (!(customer == null ? void 0 : customer.id)) return { message: "Shopify did not return a customer id \u2014 create/lookup failed.", request: request2, response: { skipped: true }, skipped: true };
+        return {
+          context: { shopifyCustomerId: customer.id },
+          message: "Shopify customer created/linked to lead.",
+          request: request2,
+          response: { shopifyCustomerId: customer.id },
+          // The hook's own result, described beside the call that produced it.
+          writes: [{
+            collection: "lead",
+            data: { $set: { shopifyCustomerId: customer.id } },
+            operation: "update",
+            options: { bypassDocumentValidation: true },
+            query: { id: context.lead }
+          }]
+        };
+      },
+      // AN ORDER ARRIVED AT THE STORE. The largest hook in the family, because
+      // attribution genuinely is: an order can reach Drawbridge two ways and
+      // they bill differently.
+      //
+      //   CONVERSION — a `_drwbrdg_ca` line-item property, injected at
+      //                add-to-cart. Causal: the campaign produced the sale, so
+      //                it carries a fee.
+      //   REDEMPTION — a DB- discount code matched to a lead. Associative: we
+      //                cannot claim we caused the purchase, so it is fee-free.
+      //
+      // Both can be true, and an order already recorded as a conversion can
+      // later have a redemption backfilled onto it — `backfill` below.
+      //
+      // IDEMPOTENT THROUGH THE RETRY, one layer up: two deliveries of the same
+      // order race, the loser's transaction hits a duplicate key, the step
+      // fails and BullMQ redelivers — and the re-run's read at the top finds
+      // what the winner wrote and skips instead of double-billing a merchant
+      // for one purchase. The hook used to loop for this itself; describing
+      // the writes moved the retry to the queue, with the same guarantee.
+      order: async ({ connection: connection2, context }, { logger: logger2, mintId, read } = {}) => {
+        var _a, _b, _c, _d, _e, _f;
+        const {
+          advertisement,
+          created_at: createdAt,
+          currency,
+          customer: orderCustomer,
+          email,
+          id: orderId,
+          line_items: lineItems = [],
+          organization: organization2,
+          phone
+        } = context || {};
+        const request2 = { orderId: orderId ? String(orderId) : null, organization: organization2 };
+        const [existingOrder, existingRedemption] = await Promise.all([
+          read.get({ collection: "order", query: { "provider.id": String(orderId), "provider.slug": "shopify" } }),
+          read.get({ collection: "redemption", query: { "provider.id": String(orderId), "provider.slug": "shopify" } })
+        ]);
+        if (existingRedemption) {
+          return {
+            message: "Order/redemption already recorded \u2014 skipping duplicate.",
+            request: request2,
+            response: {
+              existingOrderId: (existingOrder == null ? void 0 : existingOrder.id) || null,
+              existingRedemptionId: existingRedemption.id,
+              skipped: true
+            },
+            skipped: true
+          };
+        }
+        const backfill = !!existingOrder;
+        const { attrMap, attributedGross, attributedLines } = attributeLineItems(lineItems);
+        const campaign = attrMap["_drwbrdg_ca"] || null;
+        const discountCodes = Array.isArray(context == null ? void 0 : context.discount_codes) ? context.discount_codes : [];
+        const codes = [...new Set(discountCodes.map((dc) => dc == null ? void 0 : dc.code).filter(Boolean))];
+        const matchedLeads = codes.length ? await read.aggregate({
+          collection: "lead",
+          pipeline: [{ $match: { organization: organization2, shopifyDiscountCode: { $in: codes } } }]
+        }) : [];
+        const codeToLead = {};
+        for (const found of matchedLeads) {
+          if (found.shopifyDiscountCode) codeToLead[found.shopifyDiscountCode] = found;
+        }
+        const matchedDiscounts = discountCodes.filter((dc) => (dc == null ? void 0 : dc.code) && codeToLead[dc.code]).map((dc) => ({
+          amount: parseFloat(dc.amount) || 0,
+          code: dc.code,
+          id: codeToLead[dc.code].shopifyDiscountId || null
+        }));
+        const matchedLead = matchedDiscounts.length ? codeToLead[matchedDiscounts[0].code] : null;
+        const discount = matchedDiscounts.length ? {
+          amount: matchedDiscounts.reduce((sum, entry) => sum + entry.amount, 0),
+          codes: matchedDiscounts
+        } : null;
+        const matchedCodes = new Set(matchedDiscounts.map((entry) => entry.code));
+        const unmatched = codes.filter((code2) => code2.startsWith("DB-") && !matchedCodes.has(code2));
+        if (unmatched.length) {
+          (_a = logger2 == null ? void 0 : logger2.warn) == null ? void 0 : _a.call(logger2, "shopify.order.discount.unmatched", {
+            campaign: campaign || null,
+            codes: JSON.stringify(unmatched),
+            isConversion: !!campaign,
+            orderId: String(orderId),
+            organization: organization2
+          });
+        }
+        if (!campaign && !discount || backfill && !discount) {
+          return {
+            message: backfill ? "Order already recorded and no Drawbridge discount code matched \u2014 nothing to backfill." : "Order has no Drawbridge attribution \u2014 not recording.",
+            request: request2,
+            response: { skipped: true },
+            skipped: true
+          };
+        }
+        let advertisementId = null;
+        let affiliateId = null;
+        let campaignOrganization = organization2;
+        let gross = 0;
+        let leadId = null;
+        let lines = [];
+        let orderCampaign = null;
+        let pageId = null;
+        const isConversion = !!campaign;
+        const customerPhone = toE164((orderCustomer == null ? void 0 : orderCustomer.phone) || phone) || null;
+        const matchPhones = [...new Set([
+          customerPhone,
+          toE164((_b = context == null ? void 0 : context.billing_address) == null ? void 0 : _b.phone),
+          toE164((_c = context == null ? void 0 : context.shipping_address) == null ? void 0 : _c.phone)
+        ].filter(Boolean))];
+        if (isConversion) {
+          const campaignDoc = await read.get({ collection: "campaign", query: { id: campaign } });
+          if (!campaignDoc || campaignDoc.organization !== organization2) {
+            return {
+              message: "Order carried a campaign attribution that does not belong to this store \u2014 not recording.",
+              request: request2,
+              response: { skipped: true },
+              skipped: true
+            };
+          }
+          advertisementId = attrMap["_drwbrdg_ad"] || advertisement || null;
+          affiliateId = attrMap["_drwbrdg_af"] || null;
+          campaignOrganization = campaignDoc.organization;
+          gross = attributedGross;
+          lines = attributedLines;
+          orderCampaign = campaign;
+          pageId = attrMap["_drwbrdg_pg"] || null;
+          const identifiers = [];
+          const canonicalEmail = toCanonicalEmail(email);
+          if (email) identifiers.push({ email: email.toLowerCase() });
+          if (canonicalEmail) identifiers.push({ "canonical.email.value": canonicalEmail });
+          if (matchPhones.length) identifiers.push({ "phone.number": { $in: matchPhones } });
+          if (matchPhones.length) identifiers.push({ "canonical.phone.value": { $in: matchPhones } });
+          if (identifiers.length) {
+            const lead = await read.get({
+              collection: "lead",
+              query: {
+                campaigns: { $in: [campaign] },
+                organization: campaignOrganization,
+                $or: identifiers
+              }
+            });
+            leadId = (lead == null ? void 0 : lead.id) || null;
+            if (!leadId) {
+              const orgLead = await read.get({
+                collection: "lead",
+                query: { organization: campaignOrganization, $or: identifiers }
+              });
+              leadId = (orgLead == null ? void 0 : orgLead.id) || null;
+            }
+          }
+        } else {
+          leadId = matchedLead.id;
+          orderCampaign = (matchedLead.campaigns || []).length === 1 ? matchedLead.campaigns[0] : null;
+          gross = lineItems.reduce((sum, item) => {
+            const line = toLine(item);
+            return sum + line.price * line.quantity;
+          }, 0);
+          lines = lineItems.map(toLine);
+        }
+        const org = await read.get({ collection: "organization", query: { id: campaignOrganization } });
+        let rate = 0;
+        if (isConversion) {
+          const subscription = await read.get({ collection: "subscription", query: { id: org == null ? void 0 : org.subscription } });
+          rate = conversionRate(subscription);
+        }
+        const fee = isConversion ? Math.round(gross * rate) / 100 : 0;
+        const net2 = Math.round((gross - fee) * 100) / 100;
+        const currencyCode = (currency || "usd").toLowerCase();
+        const purchasedAt = new Date(createdAt || Date.now());
+        const customer = orderCustomer || email || phone ? {
+          acceptsMarketing: ((_d = orderCustomer == null ? void 0 : orderCustomer.email_marketing_consent) == null ? void 0 : _d.state) ? orderCustomer.email_marketing_consent.state === "subscribed" : typeof (orderCustomer == null ? void 0 : orderCustomer.accepts_marketing) === "boolean" ? orderCustomer.accepts_marketing : null,
+          email: (orderCustomer == null ? void 0 : orderCustomer.email) || email || null,
+          firstName: (orderCustomer == null ? void 0 : orderCustomer.first_name) || null,
+          id: (orderCustomer == null ? void 0 : orderCustomer.id) ? String(orderCustomer.id) : null,
+          lastName: (orderCustomer == null ? void 0 : orderCustomer.last_name) || null,
+          phone: customerPhone
+        } : null;
+        const source = (connection2 == null ? void 0 : connection2.source) ? { domain: connection2.source.domain, id: connection2.source.id } : void 0;
+        const orderDocId = (existingOrder == null ? void 0 : existingOrder.id) || (isConversion && !backfill ? mintId() : null);
+        const writes = [];
+        if (isConversion && !backfill) {
+          writes.push({
+            collection: "order",
+            data: {
+              advertisement: advertisementId,
+              affiliate: affiliateId,
+              campaign: orderCampaign,
+              currency: currencyCode,
+              customer,
+              discount,
+              fee,
+              gross,
+              id: orderDocId,
+              lead: leadId,
+              lines,
+              net: net2,
+              organization: campaignOrganization,
+              page: pageId,
+              provider: { id: String(orderId), slug: "shopify" },
+              purchasedAt,
+              rate,
+              source,
+              status: "completed"
+            },
+            operation: "create"
+          });
+          if (org == null ? void 0 : org.usage) {
+            writes.push({
+              collection: "usage",
+              data: { $inc: { "totals.revenue": gross } },
+              operation: "update",
+              query: { id: org.usage }
+            });
+          }
+          if (leadId) {
+            writes.push({
+              collection: "lead",
+              data: { $inc: { "totals.orders": 1 } },
+              operation: "update",
+              options: { bypassDocumentValidation: true },
+              query: { id: leadId }
+            });
+          }
+        }
+        if (discount) {
+          writes.push({
+            collection: "redemption",
+            data: {
+              advertisement: advertisementId,
+              affiliate: affiliateId,
+              campaign: orderCampaign,
+              code: ((_e = matchedDiscounts[0]) == null ? void 0 : _e.code) || null,
+              currency: currencyCode,
+              customer,
+              discount,
+              gross,
+              lead: leadId,
+              order: orderDocId,
+              organization: campaignOrganization,
+              page: pageId,
+              provider: { id: String(orderId), slug: "shopify" },
+              purchasedAt,
+              source,
+              status: "completed"
+            },
+            operation: "create"
+          });
+          if (org == null ? void 0 : org.usage) {
+            writes.push({
+              collection: "usage",
+              data: { $inc: { "totals.redemptions": 1 } },
+              operation: "update",
+              query: { id: org.usage }
+            });
+          }
+          if (leadId) {
+            writes.push({
+              collection: "lead",
+              data: { $inc: { "totals.redemptions": 1 } },
+              operation: "update",
+              options: { bypassDocumentValidation: true },
+              query: { id: leadId }
+            });
+          }
+        }
+        const enqueues = (org == null ? void 0 : org.billingProvider) === "shopify" && fee > 0 && ((_f = connection2 == null ? void 0 : connection2.source) == null ? void 0 : _f.id) && !backfill ? [{
+          data: {
+            idempotencyKey: String(orderId),
+            orderDocId,
+            orderId: String(orderId),
+            rate,
+            shopId: connection2.source.id,
+            // The App Events API returns no event id, so one is generated
+            // here — the event handle plus the order id — and sent as the
+            // event's `reference`. queue/usage.js stamps the same id onto
+            // the order as billed.transaction.
+            transaction: "drawbridge-orders." + orderId,
+            value: Math.round(fee * 100)
+          },
+          name: "billing",
+          options: { jobId: "shopify.usage." + orderId },
+          queue: "usage"
+        }] : [];
+        return {
+          enqueues,
+          message: backfill ? "Redemption backfilled for an already-recorded order." : isConversion ? "Order recorded." : "Discount redemption recorded (fee-free).",
+          request: request2,
+          response: {
+            campaign: orderCampaign,
+            currency: currencyCode,
+            discount,
+            fee,
+            gross,
+            lead: leadId,
+            lines: lines.length,
+            net: net2,
+            orderId: String(orderId)
+          },
+          // ONE TRANSACTION. The order, the redemption and both totals
+          // counters land together or not at all — a half-written attribution
+          // is revenue counted twice or not at all, and neither is
+          // recoverable by hand.
+          transaction: writes.length > 0,
+          writes
+        };
+      },
+      // A PRODUCT CHANGED AT THE STORE. Upserts the product row and hands it to
+      // the product pipeline; the actual field sync happens there.
+      //
+      // The shell has already refused a missing or inactive Shopify connection,
+      // so what is left is the two things only this hook can know are wrong.
+      product: async ({ connection: connection2, context, workflow }, { mintId } = {}) => {
+        const request2 = {
+          numericId: (context == null ? void 0 : context.id) || null,
+          organizationId: workflow.organization,
+          title: (context == null ? void 0 : context.title) || null
+        };
+        if (!(context == null ? void 0 : context.id)) return { message: "Skipped \u2014 product webhook payload had no id.", request: request2, response: { skipped: true }, skipped: true };
+        if (!connection2.shop) return { message: "Skipped \u2014 Shopify connection is missing shop domain.", request: request2, response: { skipped: true }, skipped: true };
+        const providerId = "gid://shopify/Product/" + context.id;
+        const productId = mintId();
+        return {
+          enqueues: [{
+            data: { product: productId, providerId, shop: connection2.shop },
+            name: "workflow",
+            options: { jobId: "product.workflow.shopify." + providerId + "." + Date.now() },
+            queue: "product.shopify"
+          }],
+          message: "Product sync queued from Shopify webhook.",
+          request: request2,
+          response: { productId, providerId, title: (context == null ? void 0 : context.title) || null },
+          // KEYED ON PROVIDER + SHOP, so the same product in two stores stays
+          // two rows. `connections` accumulates rather than replaces: one
+          // store can be linked to several organizations, and each keeps its
+          // own claim on the row.
+          writes: [{
+            collection: "product",
+            data: {
+              $addToSet: { connections: connection2.id },
+              $setOnInsert: {
+                id: productId,
+                provider: { id: providerId, slug: "shopify" },
+                "source.id": connection2.id,
+                status: "active"
+              }
+            },
+            operation: "update",
+            options: { upsert: true },
+            query: {
+              "provider.id": providerId,
+              "provider.slug": "shopify",
+              "source.domain": connection2.shop
+            }
+          }]
+        };
+      }
     },
     contacts: { remove: false, sync: false },
     // verify and event lean entirely on the shared HMAC helper — Shopify's
@@ -2386,7 +3629,16 @@ var shopify_default2 = {
     sms: false,
     inbound: {
       event: (args) => readEventHeader({ ...args, descriptor: inbound }),
-      process: {},
+      // One hook over the whole topic table, because that is what this
+      // manifest declares: Shopify processes its own buffered events. The
+      // topic rides in on the context rather than being a second hook name per
+      // topic; the caller's handler table arrives as a prop.
+      process: async ({ context }, { dispatch } = {}) => {
+        const key = "shopify." + (context == null ? void 0 : context.topic);
+        const handled = await dispatch({ data: context == null ? void 0 : context.data, handler: key });
+        if (!handled) return { message: "No handler for " + key, skipped: true };
+        return { message: "Processed " + key, request: { topic: context == null ? void 0 : context.topic } };
+      },
       receive: ({ channel, event, headers, payload }) => {
         if (channel === "compliance" && !COMPLIANCE_TOPICS.has(event)) {
           throw Object.assign(new Error("Unrecognized compliance topic: " + event), { status: 401 });
@@ -2402,7 +3654,107 @@ var shopify_default2 = {
       },
       verify: (args) => verifySignature({ ...args, descriptor: inbound })
     },
-    lifecycle: { cleanup: {}, health: {}, register: {}, rehydrate: {} },
+    lifecycle: {
+      // DISPATCHES INTO THE CALLER'S OWN COORDINATORS. These three are
+      // declarations made true: the work is queue orchestration over
+      // Drawbridge's own collections, which is coordinator work and stays in
+      // the repo that owns the queues. The hook receives the dispatch table as
+      // a prop and picks the entry, so the manifest owns the SEAM — asking
+      // Shopify whether it handles its own lifecycle now gets a real function
+      // instead of `unimplemented` while the work happened anyway.
+      cleanup: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "cleanup" });
+        return { message: "Ran shopify lifecycle.cleanup", request: context || null };
+      },
+      // KEEP STORE ACCESS WORKING. Not a webhook monitor, despite the name the
+      // step once carried — webhooks are declarative, declared in the app's
+      // toml and applied by Shopify to every install, so nothing here registers
+      // or checks them.
+      //
+      // It rotates the refresh token before its window closes, proves the
+      // access token still works, reconciles the scopes the store granted
+      // against the ones the app now needs, and queues a webhook
+      // reconciliation.
+      health: async ({ connection: connection2, workflow }, { adminToken, read, reconcileScopes, resolveSettings, rotateToken, shopify } = {}) => {
+        const request2 = {
+          connectionId: workflow.connection,
+          organizationId: workflow.organization,
+          shop: connection2.shop
+        };
+        const refreshTokenAtStart = (await resolveSettings()).refreshToken || null;
+        try {
+          const adminAccessToken = await adminToken();
+          const settings = await resolveSettings();
+          const refreshTokenExpiresAt = settings.refreshTokenExpiresAt;
+          const needsRotation = refreshTokenExpiresAt && new Date(refreshTokenExpiresAt) < new Date(Date.now() + REFRESH_TOKEN_FRESHNESS_BUFFER_MS);
+          let refreshTokenRotated = false;
+          if (needsRotation) {
+            await rotateToken();
+            refreshTokenRotated = true;
+          }
+          await shopify.oauth.ping({ adminAccessToken, domain: connection2.shop });
+          const scopesMissing = await reconcileScopes({ shop: connection2.shop });
+          return {
+            enqueues: [{
+              data: {
+                data: {
+                  connectionId: workflow.connection,
+                  organizationId: workflow.organization
+                },
+                event: "shopify.register.webhooks"
+              },
+              name: "register",
+              options: { jobId: "connection.update.register." + workflow.connection + "." + randomUUID() },
+              queue: "connection"
+            }],
+            message: (scopesMissing == null ? void 0 : scopesMissing.length) ? "Health check: ping ok, webhooks reconciled \u2014 connection errored, granted scopes are missing: " + scopesMissing.join(", ") + "." : refreshTokenRotated ? "Health check passed \u2014 refresh token rotated, ping ok, webhooks reconciled." : "Health check passed \u2014 ping ok, webhooks reconciled.",
+            request: request2,
+            response: {
+              pingedAt: /* @__PURE__ */ new Date(),
+              refreshTokenExpiresAt: refreshTokenExpiresAt || null,
+              refreshTokenRotated,
+              scopesMissing,
+              webhookReconciliationQueued: true
+            }
+          };
+        } catch (error) {
+          if (OAUTH_GRANT_REVOKED_CODES.includes(error.code)) {
+            const current = await read.get({ collection: "connection", query: { id: connection2.id } });
+            const refreshTokenStored = current ? (await resolveSettings(current)).refreshToken || null : null;
+            const rotated = error.code === "invalid_grant" && refreshTokenStored !== refreshTokenAtStart;
+            if (current && !rotated) {
+              const others = (current.errors || []).filter((entry) => entry.source !== OAUTH_ERROR_SOURCE);
+              error.writes = [{
+                collection: "connection",
+                data: {
+                  $set: {
+                    errors: [
+                      ...others,
+                      {
+                        message: "Shopify disconnected this store. Open the Drawbridge app in your Shopify admin to reconnect.",
+                        source: OAUTH_ERROR_SOURCE
+                      }
+                    ],
+                    status: "error"
+                  }
+                },
+                operation: "update",
+                query: { id: connection2.id }
+              }];
+            }
+          }
+          throw error;
+        }
+      },
+      register: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "register" });
+        return { message: "Ran shopify lifecycle.register", request: context || null };
+      },
+      rehydrate: async ({ context }, { dispatch } = {}) => {
+        await dispatch({ data: context, handler: "rehydrate" });
+        return { message: "Ran shopify lifecycle.rehydrate", request: context || null };
+      }
+    },
     resources: {
       audiences: false,
       // Shopify has no separate price resource — a price belongs to a product
@@ -2422,7 +3774,7 @@ var shopify_default2 = {
       // credential is the caller's job because it is Drawbridge's job: the
       // admin token refreshes and writes itself back, which is service work,
       // not vendor work.
-      products: async ({ cursor, limit = 100, search, settings, shopify, sort }) => {
+      products: async ({ cursor, limit = 100, search, settings, sort }, { shopify } = {}) => {
         var _a, _b, _c, _d;
         const products = await shopify.storefront.getProducts({
           cursor,
@@ -2442,7 +3794,7 @@ var shopify_default2 = {
           }
         };
       },
-      promotions: async ({ cursor, limit = 100, search, settings, shopify }) => {
+      promotions: async ({ cursor, limit = 100, search, settings }, { shopify } = {}) => {
         var _a, _b;
         const discounts = await shopify.admin.getDiscounts({
           adminAccessToken: settings == null ? void 0 : settings.adminAccessToken,
@@ -2488,6 +3840,19 @@ var shopify_default2 = {
     const shop = (data2 == null ? void 0 : data2.shop) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.domain);
     return shop ? "https://admin.shopify.com/store/" + String(shop).replace(".myshopify.com", "") + "/apps/" + (env == null ? void 0 : env.SHOPIFY_APP_HANDLE) : void 0;
   },
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen. The four names below are exactly
+  // what `requires` gates on, which is the point of declaring them together: a
+  // name required by the manifest and enterable nowhere is a vendor that can
+  // never go live from the admin screen.
+  provider: {
+    fields: [
+      { input: "text", key: "apiKey", credential: "SHOPIFY_API_KEY", label: "API key", required: true },
+      { input: "password", key: "apiSecret", credential: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
+      { input: "text", key: "appHandle", credential: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
+      { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
+    ]
+  },
   // A pre-launch integration: it only surfaces once the App Store listing
   // exists and the app is fully configured. Requiring all four means it can
   // never render half-configured — and absence of any one excludes the
@@ -2521,9 +3886,6 @@ var shopify_default2 = {
   // workflow document, and those strings cannot be renamed without a backfill.
   //
   // EVERY LEAF IS A FUNCTION so a step can read the merchant's own connection.
-  // The bodies these point at still live in drawbridge-sync; moving them is the
-  // next unit, and commerce.order.record is the one that decides whether the
-  // shape holds — 569 lines and 15 controller calls.
   steps: {
     commerce: {
       code: {
@@ -2628,7 +3990,7 @@ var shopify_default2 = {
   title: "Shopify"
 };
 
-// lib/connections/webhook.js
+// lib/connections/providers/webhook.js
 import crypto from "crypto";
 
 // lib/safe-http.js
@@ -2766,7 +4128,7 @@ var safeRequest = async ({
   }
 };
 
-// lib/connections/webhook.js
+// lib/connections/providers/webhook.js
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -2853,11 +4215,10 @@ var webhook_default = {
     // That is the rule the whole split runs on: a hook lives in sync only if it
     // needs Drawbridge's own database, sockets or queues. This one does not.
     webhook: {
-      send: async ({ context, controller, request: send2 = safeRequest, settings, step }) => {
+      send: async ({ context, lead, settings, step }, { request: send2 = safeRequest } = {}) => {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
-        const lead = (context == null ? void 0 : context.lead) ? await controller.get({ collection: "lead", query: { id: context.lead } }) : null;
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
@@ -2933,7 +4294,7 @@ var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
 );
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -2963,6 +4324,17 @@ var build = (manifest) => {
       }
     }
   }
+  for (const field2 of ((_c = manifest.provider) == null ? void 0 : _c.fields) || []) {
+    if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
+      throw new Error(manifest.slug + " declares a provider field with no key or label");
+    }
+    if (!INPUTS.includes(field2.input)) {
+      throw new Error(manifest.slug + ".provider." + field2.key + " needs an input the admin form can render \u2014 one of " + INPUTS.join(", "));
+    }
+    if (field2.input === "password" && !field2.redact) {
+      throw new Error(manifest.slug + ".provider." + field2.key + " is a password and must declare redact : true \u2014 the api would hand the value back");
+    }
+  }
   if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
     throw new Error(manifest.slug + " needs an icon \u2014 the svg markup itself, not a path to one");
   }
@@ -2975,23 +4347,23 @@ var build = (manifest) => {
   if (!GROUPS.includes(manifest == null ? void 0 : manifest.group)) {
     throw new Error(manifest.slug + " needs a group \u2014 one of " + GROUPS.join(", "));
   }
-  if ((_c = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _c.type) {
+  if ((_d = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _d.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_d = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _d.type)) {
+  if (!AUTH_TYPES.includes((_e = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _e.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
     for (const field2 of OAUTH_FIELDS) {
-      if (!((_e = manifest.auth.oauth) == null ? void 0 : _e[field2])) {
+      if (!((_f = manifest.auth.oauth) == null ? void 0 : _f[field2])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field2);
       }
     }
-    if (typeof ((_g = (_f = manifest.hooks) == null ? void 0 : _f.auth) == null ? void 0 : _g.token) !== "function") {
+    if (typeof ((_h = (_g = manifest.hooks) == null ? void 0 : _g.auth) == null ? void 0 : _h.token) !== "function") {
       throw new Error(manifest.slug + " is oauth and must implement hooks.auth.token \u2014 point it at authToken() or wrap it");
     }
     for (const url of OAUTH_URLS) {
-      if (!((_i = (_h = manifest.auth.oauth) == null ? void 0 : _h.urls) == null ? void 0 : _i[url])) {
+      if (!((_j = (_i = manifest.auth.oauth) == null ? void 0 : _i.urls) == null ? void 0 : _j[url])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth.urls." + url);
       }
     }
@@ -3001,16 +4373,16 @@ var build = (manifest) => {
       );
     }
   }
-  if (implemented(manifest.hooks, "inbound.event") && !((_k = (_j = manifest.inbound) == null ? void 0 : _j.headers) == null ? void 0 : _k.event)) {
+  if (implemented(manifest.hooks, "inbound.event") && !((_l = (_k = manifest.inbound) == null ? void 0 : _k.headers) == null ? void 0 : _l.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_m = (_l = manifest.inbound) == null ? void 0 : _l.headers) == null ? void 0 : _m.signature)) {
+  if (implemented(manifest.hooks, "inbound.verify") && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
     throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray((_n = manifest == null ? void 0 : manifest.content) == null ? void 0 : _n.guide) || !manifest.content.guide.length) {
+  if (!Array.isArray((_o = manifest == null ? void 0 : manifest.content) == null ? void 0 : _o.guide) || !manifest.content.guide.length) {
     throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
@@ -3022,8 +4394,8 @@ var build = (manifest) => {
   }
   for (const [domain, verbs] of Object.entries(HOOKS)) {
     for (const verb of verbs) {
-      const hook = (_p = (_o = manifest.hooks) == null ? void 0 : _o[domain]) == null ? void 0 : _p[verb];
-      if (((_q = manifest.hooks) == null ? void 0 : _q[domain]) === false) continue;
+      const hook = (_q = (_p = manifest.hooks) == null ? void 0 : _p[domain]) == null ? void 0 : _q[verb];
+      if (((_r = manifest.hooks) == null ? void 0 : _r[domain]) === false) continue;
       if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
         throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
       }
@@ -3069,14 +4441,18 @@ var connections = Object.freeze({
   webhook: build(webhook_default)
 });
 (() => {
-  const owners = {};
+  var _a;
+  const routes = {};
   for (const [slug, manifest] of Object.entries(connections)) {
-    for (const [name] of leaves(manifest.steps)) {
+    for (const [name, step] of leaves(manifest.steps)) {
       const type = "step." + name;
-      if (owners[type]) {
-        throw new Error("Step " + type + " is declared by both " + owners[type] + " and " + slug);
+      const queue = (_a = step({})) == null ? void 0 : _a.queue;
+      if (routes[type] && routes[type].queue !== queue) {
+        throw new Error(
+          "Step " + type + " routes to " + routes[type].queue + " for " + routes[type].slug + " and " + queue + " for " + slug + " \u2014 one of them would be enqueued nowhere"
+        );
       }
-      owners[type] = slug;
+      routes[type] = { queue, slug };
     }
   }
 })();
@@ -3170,43 +4546,11 @@ var decrypt = (value) => {
 };
 
 // lib/providers.js
-var FIELDS = {
-  attentive: [
-    { input: "text", key: "clientId", env: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  drawbridge: [
-    { input: "email", key: "accountSender", env: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
-    { input: "password", key: "apiKey", env: "SENDGRID_API_KEY", label: "SendGrid API key", redact: true, required: true },
-    // NOT required. The CRM sync is best-effort internal tooling and no-ops
-    // without a token — requiring it would make the whole drawbridge provider
-    // read not-live over something no merchant ever sees.
-    { input: "password", key: "hubspotToken", env: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
-    // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-    // either. Unset, it degrades to the account sender rather than
-    // refusing to start.
-    { input: "email", key: "leadSender", env: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
-    { input: "text", key: "smsFrom", env: "TWILIO_ACCOUNT_FROM", label: "SMS number", required: true },
-    { input: "password", key: "smsSid", env: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", redact: true, required: true },
-    { input: "password", key: "smsToken", env: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", redact: true, required: true }
-  ],
-  klaviyo: [
-    { input: "text", key: "clientId", env: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  mailchimp: [
-    { input: "text", key: "clientId", env: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  shopify: [
-    { input: "text", key: "apiKey", env: "SHOPIFY_API_KEY", label: "API key", required: true },
-    { input: "password", key: "apiSecret", env: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
-    { input: "text", key: "appHandle", env: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
-    { input: "text", key: "listingUrl", env: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
-  ]
-};
-var providerFields = (slug) => Object.hasOwn(FIELDS, slug) ? FIELDS[slug] : [];
-var providerSlugs = () => Object.keys(FIELDS).sort();
+var providerFields = (slug) => {
+  var _a;
+  return Object.hasOwn(connections, slug) ? ((_a = connections[slug].provider) == null ? void 0 : _a.fields) || [] : [];
+};
+var providerSlugs = () => Object.keys(connections).filter((slug) => connections[slug].provider).sort();
 var isLive = (slug, settings) => {
   const fields2 = providerFields(slug);
   if (!fields2.length) return false;
@@ -3214,19 +4558,24 @@ var isLive = (slug, settings) => {
 };
 var mask = (value) => {
   if (!value) return null;
-  if (String(value).length < 12) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+  if (String(value).length < 16) return "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
   return String(value).slice(0, 3) + "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" + String(value).slice(-4);
 };
-var cacheKey = (slug) => ["provider", slug];
-var providerSettings = async ({ cache, controller, slug }) => {
-  const read = async () => controller.get({
+var providerMemo = /* @__PURE__ */ new Map();
+var MEMO_TTL_MS = 60 * 1e3;
+var clearProviderMemo = () => providerMemo.clear();
+var providerSettings = async ({ controller, slug }) => {
+  const memoized = providerMemo.get(slug);
+  if (memoized && Date.now() - memoized.at < MEMO_TTL_MS) return memoized.value;
+  const row = await controller.get({
     collection: "provider",
     query: { slug }
   });
-  const row = cache ? await cache.use(cacheKey(slug), read, 30) : await read();
-  return (row == null ? void 0 : row.settings) ? decrypt(row.settings) : {};
+  const value = (row == null ? void 0 : row.settings) ? decrypt(row.settings) : {};
+  providerMemo.set(slug, { at: Date.now(), value });
+  return value;
 };
-var saveProviderSettings = async ({ authenticated, cache, clear, controller, settings, slug }) => {
+var saveProviderSettings = async ({ authenticated, clear, controller, settings, slug }) => {
   const fields2 = providerFields(slug);
   if (!fields2.length) return null;
   const existing = await controller.get({
@@ -3254,37 +4603,35 @@ var saveProviderSettings = async ({ authenticated, cache, clear, controller, set
     },
     query: { slug }
   });
-  await cache.delete(cacheKey(slug));
+  providerMemo.delete(slug);
   return result;
 };
 var providerEnvNames = () => new Set(
-  providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.env).filter(Boolean)
+  providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.credential).filter(Boolean)
 );
-var providerCredentials = async ({ cache, controller }) => {
+var providerCredentials = async ({ controller }) => {
   const credentials2 = {};
   for (const slug of providerSlugs()) {
-    const settings = await providerSettings({ cache, controller, slug });
-    for (const field2 of providerFields(slug)) {
-      const value = settings == null ? void 0 : settings[field2.key];
-      if (field2.env && value) credentials2[field2.env] = value;
+    try {
+      const settings = await providerSettings({ controller, slug });
+      for (const field2 of providerFields(slug)) {
+        const value = settings == null ? void 0 : settings[field2.key];
+        if (field2.credential && value) credentials2[field2.credential] = value;
+      }
+    } catch {
+      continue;
     }
   }
   return credentials2;
 };
-var hydrateEnvironment = async ({ cache, controller, env = process.env }) => {
-  const credentials2 = await providerCredentials({ cache, controller });
-  for (const name of providerEnvNames()) delete env[name];
-  Object.assign(env, credentials2);
-  return Object.keys(credentials2).sort();
-};
 export {
-  cacheKey,
-  hydrateEnvironment,
+  clearProviderMemo,
   isLive,
   mask,
   providerCredentials,
   providerEnvNames,
   providerFields,
+  providerMemo,
   providerSettings,
   providerSlugs,
   saveProviderSettings