@drawbridge/drawbridge-utils 0.0.121 → 0.0.125

package/dist/providers.cjs

@@ -448,7 +448,47 @@ var attentive_default = `<svg width="500" height="500" viewBox="0 0 500 500" fil
 <path d="M166.04 261.805C180.228 259.107 195.528 261.893 207.581 269.971C218.512 277.079 226.908 288.136 230.604 300.657C234.835 314.103 233.614 329.124 227.485 341.788C220.097 356.875 205.782 368.543 189.317 372.089C173.957 375.652 157.089 372.386 144.304 363.103C132.971 355.295 124.912 342.989 121.891 329.581C118.943 316.636 120.725 302.656 127.002 290.938C134.699 275.951 149.503 264.933 166.046 261.811" fill="#1E1C1C"/>
 </svg>`;
 
+// lib/phone.js
+var import_libphonenumber_js = require("libphonenumber-js");
+var toE164 = (value, country) => {
+  if (!value) return null;
+  try {
+    const parsed = (0, import_libphonenumber_js.parsePhoneNumberFromString)(String(value), country);
+    return parsed ? parsed.number : null;
+  } catch {
+    return null;
+  }
+};
+var detectCountry = (value) => {
+  if (!value) return null;
+  try {
+    const parser = new import_libphonenumber_js.AsYouType();
+    parser.input(String(value));
+    return parser.getCountry() || null;
+  } catch {
+    return null;
+  }
+};
+
 // lib/connections/providers/attentive.js
+var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
+  const response = await fetcher("https://api.attentivemobile.com" + path, {
+    ...payload && { body: JSON.stringify(payload) },
+    headers: {
+      authorization: "Bearer " + token,
+      ...payload && { "content-type": "application/json" }
+    },
+    method,
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) {
+    throw Object.assign(
+      new Error("Attentive refused the request (" + response.status + ")"),
+      { status: response.status }
+    );
+  }
+  return response.json().catch(() => null);
+};
 var attentive_default2 = {
   auth: {
     oauth: {
@@ -482,9 +522,10 @@ var attentive_default2 = {
     // has to say so rather than let them believe otherwise.
     confirm: "Disconnecting removes Drawbridge's stored Attentive token. Attentive does not offer a way for us to revoke it, so remove the Drawbridge integration in Attentive as well if you want its access fully withdrawn. Your subscribers stay in both Attentive and Drawbridge \u2014 neither list is deleted.",
     description: [
-      "Attentive is where your SMS marketing lives, and this connection is becoming the way your Drawbridge contacts sync into an Attentive segment.",
+      "Attentive is where your SMS marketing lives, and this connection syncs the contacts your campaigns collect into an Attentive segment \u2014 subscribed for marketing and added to the segment you choose.",
       "You authorize Drawbridge from inside Attentive and can revoke that access there at any time. Drawbridge never sees or stores your Attentive password.",
-      "Subscriber syncing is not live yet, so connecting today does nothing except choose the segment it will use when it ships."
+      "Anyone who has opted out in Drawbridge is sent to Attentive as an unsubscribe rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
+      "Attentive accepts these updates and applies them in the background, so a contact appears in your segment shortly after the sync rather than the instant it runs."
     ],
     excerpt: "Sync your Drawbridge contacts into an Attentive segment.",
     guide: [
@@ -505,6 +546,10 @@ var attentive_default2 = {
       message: "Contacts your campaigns collect are synced into this segment.",
       hook: "resources.audiences",
       required: true
+      // CONSUMED BY THE MEMBERSHIP CALL, not by the subscribe. Attentive's
+      // /v1/subscriptions takes no segment id — subscription and segment
+      // membership are two operations here — so contacts.sync makes both calls
+      // and this value is the externalId the second one carries.
       // No `search : false` here, and that is a first: /v2/segments takes a
       // `name` filter (partial match, cited above), so this picker searches
       // the ACCOUNT — Klaviyo and Mailchimp can only match the fetched page.
@@ -517,17 +562,25 @@ var attentive_default2 = {
   // and contacts.sync are the first to flip.
   hooks: {
     auth: {
-      // The exchange already yields the tokens, and Attentive documents no
-      // account-identity endpoint to enrich them with — Klaviyo's connect
-      // reads the account name back; this has nothing cited to read. The
-      // callback stores the tokens and skips enrichment on `unimplemented`.
       // FALSE, NOT {}. `{}` means "supported, implemented in the repo with the
-      // dependencies", and nothing anywhere implements either of these —
-      // there is nothing for them to do. The exchange already yields the
-      // tokens and Attentive documents no account-identity endpoint to
-      // enrich them with, so connect has nothing to add; and they document
-      // no revocation endpoint at all, so disconnect has nothing to call.
-      // Recorded as a decision rather than left as an unkept promise.
+      // dependencies", and nothing anywhere implements either of these — there
+      // is nothing for them to do. They document no revocation endpoint at all,
+      // so disconnect has nothing to call. Recorded as a decision rather than
+      // left as an unkept promise.
+      //
+      // STILL FALSE AFTER LOOKING AGAIN, and this is the reason written down so
+      // nobody re-derives it. Klaviyo's connect reads the account name back so
+      // the card is not blank; Attentive's card stays blank. There IS an
+      // endpoint — GET https://api.attentivemobile.com/v1/me, Bearer, described
+      // on docs.attentive.com/pages/authentication/ as returning "information
+      // specific to your company" — but its RESPONSE SCHEMA is published
+      // nowhere we can read: the docs show the curl and no body. Reading
+      // `body.name` would be a guess, and a guess here fails at the worst
+      // moment, in the callback, after the merchant has already consented.
+      //
+      // A live token settles it in one call, alongside the three registration
+      // checks in the header. Until then the honest state is a blank field, not
+      // a hopeful one.
       connect: false,
       disconnect: false,
       probe: false,
@@ -549,7 +602,112 @@ var attentive_default2 = {
       }
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // The verb the contacts.sync step points at.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from erasing the subscriber — Attentive's deletion sits
+      // behind their privacy-request API, which is a different grant.
+      remove: false,
+      // TWO CALLS, BECAUSE ATTENTIVE HAS TWO IDEAS.
+      //
+      // Subscribing and being in a segment are NOT the same operation here —
+      // unlike Klaviyo, where a subscription is created against the list itself.
+      // /v1/subscriptions takes no segment id at all, so the segment a merchant
+      // picked on this connection can only be honoured by the bulk segment
+      // membership API:
+      //
+      //   subscribe   POST /v1/subscriptions
+      //               { user : { email, phone }, locale, subscriptionType } — the
+      //               docs require EITHER signUpSourceId OR (locale +
+      //               subscriptionType), and we hold no sign-up source. 202.
+      //
+      //   membership  POST /v2/bulk/segments/members
+      //               { externalId, members : [ { email, phone } ] }, 1-10,000
+      //               members, 202 with a batchJobId
+      //               (docs.attentive.com/reference/postbulksegmentmembers).
+      //
+      //   unsubscribe POST /v1/subscriptions/unsubscribe
+      //               { user, subscriptions : [ { type, channel } ] }. 202.
+      //
+      // EVERY ONE OF THEM ANSWERS 202 ACCEPTED, which means Attentive took the
+      // job, not that it ran — the same distinction the Shopify usage charge
+      // makes between a 202 and a charge. The message below says accepted, and
+      // must keep saying accepted.
+      sync: async ({ lead, settings, suppressed, token }, { fetcher } = {}) => {
+        var _a, _b, _c, _d;
+        const segment = settings == null ? void 0 : settings.segment;
+        if (!segment) return { message: "No Attentive segment is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        const phone = toE164(((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.phone) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.phone));
+        if (!email && !phone) return { message: "That lead has no email address or phone number to sync.", skipped: true };
+        const user = {
+          ...email && { email },
+          ...phone && { phone }
+        };
+        if (suppressed) {
+          await api("/v1/subscriptions/unsubscribe", {
+            fetcher,
+            method: "POST",
+            payload: {
+              // One entry per channel we can actually name them by. MARKETING
+              // is the only type Drawbridge ever subscribed them to.
+              subscriptions: [
+                ...phone ? [{ channel: "TEXT", type: "MARKETING" }] : [],
+                ...email ? [{ channel: "EMAIL", type: "MARKETING" }] : []
+              ],
+              user
+            },
+            token
+          });
+          return {
+            message: "Attentive accepted an unsubscribe for this contact \u2014 they have opted out.",
+            response: { accepted: true, unsubscribed: true }
+          };
+        }
+        await api("/v1/subscriptions", {
+          fetcher,
+          method: "POST",
+          payload: {
+            // LOCALE, because we hold no signUpSourceId and the docs require
+            // one or the other. The country is READ OFF the number when there
+            // is one — libphonenumber knows it from the calling code — rather
+            // than assumed; only the fallback pair below is a default, and it
+            // is the one value here that no vendor document dictates.
+            //
+            // ponytail: en/US default. A `signUpSourceId` field on the
+            // connection is the upgrade — Attentive's sign-up sources carry
+            // the consent language, which is a better answer than any locale
+            // we can infer — and it replaces this branch entirely.
+            locale: {
+              country: phone && detectCountry(phone) || "US",
+              language: "en"
+            },
+            subscriptionType: "MARKETING",
+            user
+          },
+          token
+        });
+        const membership = await api("/v2/bulk/segments/members", {
+          fetcher,
+          method: "POST",
+          payload: {
+            externalId: segment,
+            members: [user]
+          },
+          token
+        });
+        return {
+          // ACCEPTED, NOT LIVE. Both writes answered 202, which means Attentive
+          // queued them — a merchant who reads "synced" and looks for the person
+          // in Attentive a second later has been told the wrong thing.
+          message: "Attentive accepted this contact for the segment. Attentive processes these asynchronously, so it appears there shortly.",
+          response: {
+            accepted: true,
+            ...(membership == null ? void 0 : membership.batchJobId) && { batchJobId: membership.batchJobId }
+          }
+        };
+      }
+    },
     email: false,
     inbound: false,
     lifecycle: false,
@@ -562,26 +720,13 @@ var attentive_default2 = {
       // show a picker quietly missing most of a real account. The response's
       // only identifier is `externalId`, so an entry without one cannot be
       // stored and is dropped.
-      audiences: async ({ cursor, limit = 100, search, token }, { fetcher = fetch } = {}) => {
+      audiences: async ({ cursor, limit = 100, search, token }, { fetcher } = {}) => {
         const query = new URLSearchParams({
           limit: String(Math.min(limit, 1e3)),
           ...cursor && { cursor },
           ...(search == null ? void 0 : search.value) && { name: String(search.value).trim() }
         });
-        const response = await fetcher(
-          "https://api.attentivemobile.com/v2/segments?" + query,
-          {
-            headers: { authorization: "Bearer " + token },
-            signal: AbortSignal.timeout(15e3)
-          }
-        );
-        if (!response.ok) {
-          throw Object.assign(
-            new Error("Attentive refused the request (" + response.status + ")"),
-            { status: response.status }
-          );
-        }
-        const body = await response.json();
+        const body = await api("/v2/segments?" + query, { fetcher, token });
         return {
           items: ((body == null ? void 0 : body.segments) || []).filter((segment) => segment == null ? void 0 : segment.externalId).map((segment) => ({ id: segment.externalId, title: (segment == null ? void 0 : segment.name) || segment.externalId })),
           pageInfo: {
@@ -599,33 +744,71 @@ var attentive_default2 = {
     webhook: false
   },
   icon: attentive_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen, and the only declaration of it.
+  // It lives beside `requires`, which names the same variables: the manifest
+  // says what it needs and this says how someone supplies it, so a credential
+  // cannot be required by a vendor that offers nowhere to enter it.
+  //
+  // `redact` marks a secret — never returned by the api, and blank on save means
+  // keep the stored value. `required` drives the live check.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   requires: [
     "ATTENTIVE_OAUTH_CLIENT_ID",
     "ATTENTIVE_OAUTH_CLIENT_SECRET"
   ],
   slug: "attentive",
-  // A consent with no segment chosen is authenticated and inert — the sync,
-  // when it ships, needs somewhere to put people.
+  // A consent with no segment chosen is authenticated and inert — the sync needs
+  // somewhere to put people — so the card says Pending rather than Active over
+  // nothing.
   status: (data2) => {
     var _a;
     return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? data2.status : "pending";
   },
-  // No steps: subscriber sync has not shipped, so this vendor contributes
-  // nothing to a workflow yet. An empty steps object is the honest declaration.
-  steps: {},
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. The nesting IS the name: this is
+      // `step.contacts.sync`, the string a workflow document stores. Klaviyo and
+      // Mailchimp declare the same type — a step belongs to the capability, not
+      // to whoever implements it — and the connection on the step document is
+      // what says which vendor runs.
+      sync: ({ data: data2 }) => ({
+        hook: "contacts.sync",
+        // NO ACCOUNT NAME TO INTERPOLATE, unlike Klaviyo: auth.connect is false
+        // because Attentive publishes no account-identity response we can read
+        // (see its comment), and settings.segment is an opaque externalId no
+        // merchant would recognise in a builder label.
+        key: "Sync contact to Attentive",
+        queue: "connection",
+        // Nothing for a merchant to configure on the step itself — the segment
+        // is chosen once on the connection. Declared empty rather than omitted,
+        // so "this step takes no settings" and "nobody thought about settings"
+        // stay different statements.
+        settings: {},
+        // BOTH triggers, for the same reason as Klaviyo: lead.insert alone only
+        // ever fires for someone with no history yet, and crossing into a
+        // segment is the other moment a contact is worth pushing.
+        triggers: ["lead.insert", "segment.contact.add"],
+        usage: { actions: 1 }
+      })
+    }
+  },
+  // WHY, in the merchant's words, and what to do about it.
+  // ONLY FOR A LIVE GRANT. A disconnected or errored connection's next step
+  // is reconnecting — prompting "choose a segment" there asks the merchant to
+  // configure a grant that no longer exists. `pending` is exactly this task's
+  // moment: the grant is good and the segment is the missing half.
   tasks: (data2) => {
     var _a;
-    return [
-      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? [] : [
-        {
-          message: "Choose which Attentive segment your contacts should sync into. Until you do, nothing is being synced.",
-          title: "Choose a segment"
-        }
-      ],
+    return !["active", "pending"].includes(data2 == null ? void 0 : data2.status) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.segment) ? [] : [
       {
-        message: "Contact syncing to Attentive segments has not shipped yet. Nothing is being sent to Attentive right now.",
-        title: "Subscriber sync not available yet",
-        type: "warning"
+        message: "Choose which Attentive segment your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose a segment"
       }
     ];
   },
@@ -827,7 +1010,7 @@ var drawbridge_default = `<svg width="500" height="500" viewBox="0 0 500 500" fi
 <rect width="500" height="500" fill="#BAEC5F"/>
 <g clip-path="url(#clip0_2115_2832)">
 <path d="M140.224 127.586L174.803 188.73V311.176L140 372.32L176.084 392.031L216.111 321.753V178.278L176.341 108L140.224 127.586Z" fill="#0D1314"/>
-<path d="M360.001 127.523L323.693 108.282L284.948 178.498V321.596L322.923 391.749L359.393 372.79L326.224 311.52V188.73L360.001 127.523Z" fill="#0D1314"/>
+<path d="M360.002 127.523L323.694 108.282L284.949 178.498V321.596L322.924 391.749L359.394 372.79L326.225 311.52V188.73L360.002 127.523Z" fill="#0D1314"/>
 </g>
 <defs>
 <clipPath id="clip0_2115_2832">
@@ -1866,6 +2049,34 @@ var drawbridge_default2 = {
   icon: drawbridge_default,
   // PRIVATE: never in the catalog, always available to the builder.
   private: true,
+  // THE PLATFORM'S OWN SENDING CREDENTIALS — SendGrid, Twilio, and the internal
+  // HubSpot portal. No merchant ever sees these; they are what an admin types on
+  // the provider screen so that Drawbridge itself can send.
+  //
+  // They belong on THIS manifest because this is the connection that sends: the
+  // email, sms and segment hooks below are the only things that spend them, and
+  // a private connection is still where a vendor fact lives.
+  //
+  // UNLIKE every public vendor, none of these appear in `requires` — see the
+  // comment there. Availability and configuration are different questions, and a
+  // missing CRM token must not take every base workflow step away.
+  provider: {
+    fields: [
+      { input: "email", key: "accountSender", credential: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
+      { input: "password", key: "apiKey", credential: "SENDGRID_API_KEY", label: "SendGrid API key", redact: true, required: true },
+      // NOT required. The CRM sync is best-effort internal tooling and no-ops
+      // without a token — requiring it would make the whole drawbridge provider
+      // read not-live over something no merchant ever sees.
+      { input: "password", key: "hubspotToken", credential: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
+      // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
+      // either. Unset, it degrades to the account sender rather than
+      // refusing to start.
+      { input: "email", key: "leadSender", credential: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
+      { input: "text", key: "smsFrom", credential: "TWILIO_ACCOUNT_FROM", label: "SMS number", required: true },
+      { input: "password", key: "smsSid", credential: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", redact: true, required: true },
+      { input: "password", key: "smsToken", credential: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", redact: true, required: true }
+    ]
+  },
   // NOTHING, and HUBSPOT_ACCESS_TOKEN in particular must not be here.
   //
   // `requires` gates AVAILABILITY: a name in it that is unset removes the whole
@@ -2002,12 +2213,12 @@ var drawbridge_default2 = {
 
 // lib/connections/icons/klaviyo.js
 var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="white"/>
+<rect width="500" height="500" fill="#FF4B32"/>
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
 // lib/connections/providers/klaviyo.js
-var api = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
+var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
     ...payload && { body: JSON.stringify(payload) },
     headers: {
@@ -2186,7 +2397,7 @@ var klaviyo_default2 = {
       // decided it, and asking again would be a question we can answer.
       connect: async ({ tokens }, { fetcher } = {}) => {
         var _a, _b, _c;
-        const body = await api("/accounts", { fetcher, token: tokens.accessToken });
+        const body = await api2("/accounts", { fetcher, token: tokens.accessToken });
         const account = (_a = body == null ? void 0 : body.data) == null ? void 0 : _a[0];
         return {
           account: ((_c = (_b = account == null ? void 0 : account.attributes) == null ? void 0 : _b.contact_information) == null ? void 0 : _c.organization_name) || (account == null ? void 0 : account.id) || null,
@@ -2263,7 +2474,7 @@ var klaviyo_default2 = {
         const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", skipped: true };
         const totals = (contact == null ? void 0 : contact.totals) || {};
-        const profile = await api("/profiles/", {
+        const profile = await api2("/profiles/", {
           fetcher,
           method: "POST",
           payload: {
@@ -2291,7 +2502,7 @@ var klaviyo_default2 = {
         });
         const profileId = (_c = profile == null ? void 0 : profile.data) == null ? void 0 : _c.id;
         if (!profileId) return { message: "Klaviyo returned no profile id.", skipped: true };
-        await api("/profile-subscription-bulk-create-jobs/", {
+        await api2("/profile-subscription-bulk-create-jobs/", {
           fetcher,
           method: "POST",
           payload: {
@@ -2354,7 +2565,7 @@ var klaviyo_default2 = {
         let next = cursor ? "/lists?page%5Bsize%5D=10&page%5Bcursor%5D=" + encodeURIComponent(cursor) : "/lists?page%5Bsize%5D=10";
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
-          const body = await api(next, { fetcher, token });
+          const body = await api2(next, { fetcher, token });
           for (const list of (body == null ? void 0 : body.data) || []) {
             audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
           }
@@ -2380,6 +2591,16 @@ var klaviyo_default2 = {
     webhook: false
   },
   icon: klaviyo_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen. Declared here rather than in a
+  // table in lib/providers.js, so a vendor's credentials sit beside the
+  // `requires` that names the same variables.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   requires: [
     "KLAVIYO_OAUTH_CLIENT_ID",
     "KLAVIYO_OAUTH_CLIENT_SECRET"
@@ -2441,9 +2662,13 @@ var klaviyo_default2 = {
     }
   },
   // WHY, in the merchant's words, and what to do about it.
+  // ONLY FOR A LIVE GRANT. A disconnected or errored connection's next step
+  // is reconnecting — prompting "choose a list" there asks the merchant to
+  // configure a grant that no longer exists. `pending` is exactly this task's
+  // moment: the grant is good and the list is the missing half.
   tasks: (data2) => {
     var _a;
-    return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [
+    return !["active", "pending"].includes(data2 == null ? void 0 : data2.status) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [
       {
         message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
         title: "Choose a list"
@@ -2453,6 +2678,9 @@ var klaviyo_default2 = {
   title: "Klaviyo"
 };
 
+// lib/connections/providers/mailchimp.js
+var import_node_crypto2 = require("crypto");
+
 // lib/connections/icons/mailchimp.js
 var mailchimp_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
 <rect width="500" height="500" fill="#FFE01B"/>
@@ -2465,6 +2693,25 @@ var base = (dc) => {
   if (!dc) throw new Error("This Mailchimp connection has no data centre stored, so there is no host to call");
   return "https://" + dc + ".api.mailchimp.com/3.0";
 };
+var api3 = async (path, { dc, fetcher = fetch, method = "GET", payload, token }) => {
+  const response = await fetcher(base(dc) + path, {
+    ...payload && { body: JSON.stringify(payload) },
+    headers: {
+      authorization: "Bearer " + token,
+      ...payload && { "content-type": "application/json" }
+    },
+    method,
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok) {
+    throw Object.assign(
+      new Error("Mailchimp refused the request (" + response.status + ")"),
+      { status: response.status }
+    );
+  }
+  return response.json();
+};
+var subscriberHash = (email) => (0, import_node_crypto2.createHash)("md5").update(String(email).trim().toLowerCase()).digest("hex");
 var mailchimp_default2 = {
   // OAUTH 2, authorization code. Every url below is quoted from
   // mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/ rather
@@ -2506,8 +2753,10 @@ var mailchimp_default2 = {
   content: {
     confirm: "Disconnecting removes Drawbridge's stored Mailchimp access. You can also remove Drawbridge from the Authorized Apps page in your Mailchimp account. Your contacts stay in both Drawbridge and Mailchimp \u2014 neither list is deleted.",
     description: [
-      "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Networking in your organization settings puts your own brand in the from line.",
-      "This connection is becoming the way your Drawbridge contacts sync into a Mailchimp audience. Audience syncing is not live yet, so connecting today does nothing except choose the audience it will use when it ships."
+      "Drawbridge no longer sends email through Mailchimp. Notification email now sends from Drawbridge itself, and verifying a domain under Messaging in your organization settings puts your own brand in the from line.",
+      "Connecting Mailchimp lets Drawbridge sync the contacts your campaigns collect into a Mailchimp audience, so the people who enter a giveaway can be marketed to alongside the rest of your list.",
+      "Anyone who has opted out in Drawbridge is synced as unsubscribed rather than omitted, so a person who asked not to be contacted stays suppressed in both systems instead of quietly reappearing.",
+      "Someone who unsubscribed inside Mailchimp keeps that choice: a resync only sets the status of a subscriber Mailchimp has never seen before."
     ],
     excerpt: "Sync your Drawbridge contacts into a Mailchimp audience.",
     guide: [
@@ -2582,7 +2831,51 @@ var mailchimp_default2 = {
       token: authToken
     },
     commerce: false,
-    contacts: { remove: false, sync: false },
+    // The verb the contacts.sync step points at.
+    contacts: {
+      // Not yet. Suppression syncs an opt-out as unsubscribed, which is a
+      // different thing from deleting the member — and Mailchimp's own delete is
+      // permanent, so the address can never be re-added.
+      remove: false,
+      // PUT /lists/{list_id}/members/{subscriber_hash} — an UPSERT, which is
+      // why there is no create-or-update branch here. Quoted from Mailchimp's
+      // Marketing API reference for the list-members resource.
+      sync: async ({ lead, settings, suppressed, token }, { fetcher } = {}) => {
+        var _a, _b;
+        const audience = settings == null ? void 0 : settings.audience;
+        if (!audience) return { message: "No Mailchimp audience is chosen for this connection.", skipped: true };
+        const email = ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email);
+        if (!email) return { message: "That lead has no email address to sync.", skipped: true };
+        const hash = subscriberHash(email);
+        const member = await api3("/lists/" + audience + "/members/" + hash, {
+          dc: settings == null ? void 0 : settings.dc,
+          fetcher,
+          method: "PUT",
+          payload: {
+            email_address: email,
+            // FNAME ONLY. Unlike Klaviyo, Mailchimp's custom fields are not
+            // schemaless — a merge tag that does not exist on the audience is
+            // refused, taking the whole request with it — and FNAME is one of
+            // the two tags every audience is created with. The Drawbridge
+            // totals Klaviyo receives cannot travel until something registers
+            // merge fields on the chosen audience, which is lifecycle.register's
+            // job and is not built.
+            ...(lead == null ? void 0 : lead.name) && { merge_fields: { FNAME: String(lead.name).trim().split(/\s+/)[0] } },
+            ...suppressed && { status: "unsubscribed" },
+            status_if_new: suppressed ? "unsubscribed" : "subscribed"
+          },
+          token
+        });
+        return {
+          // Merged into `context` for later steps in this run.
+          context: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash },
+          message: suppressed ? "Synced to Mailchimp as unsubscribed \u2014 this contact has opted out." : "Synced to the Mailchimp audience.",
+          // Recorded on the run for support to read back, not a write
+          // instruction — the hook has already written what it needed to.
+          response: { mailchimpMemberId: (member == null ? void 0 : member.id) || hash }
+        };
+      }
+    },
     // Drawbridge sends its own notification email and SMS, and owns its own
     // segments — see the private `drawbridge` manifest. A vendor answering
     // these would be a second sender, which is the arrangement the platform
@@ -2601,24 +2894,13 @@ var mailchimp_default2 = {
       // successful — the same silent truncation Klaviyo has, at a different
       // number. Paged against total_items so an account past a thousand still
       // resolves.
-      audiences: async ({ cursor, limit = 100, search, settings, token }, { fetcher = fetch } = {}) => {
-        const dc = settings == null ? void 0 : settings.dc;
+      audiences: async ({ cursor, limit = 100, search, settings, token }, { fetcher } = {}) => {
         const count = Math.min(limit, 1e3);
         const offset = Number(cursor || 0);
-        const response = await fetcher(
-          base(dc) + "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
-          {
-            headers: { authorization: "Bearer " + token },
-            signal: AbortSignal.timeout(15e3)
-          }
+        const body = await api3(
+          "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
+          { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        if (!response.ok) {
-          throw Object.assign(
-            new Error("Mailchimp refused the request (" + response.status + ")"),
-            { status: response.status }
-          );
-        }
-        const body = await response.json();
         const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
@@ -2640,6 +2922,15 @@ var mailchimp_default2 = {
     webhook: false
   },
   icon: mailchimp_default,
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen, beside the `requires` naming the
+  // same variables.
+  provider: {
+    fields: [
+      { input: "text", key: "clientId", credential: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", required: true },
+      { input: "password", key: "clientSecret", credential: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
+    ]
+  },
   // The OAuth client this deployment registered. Without both, the vendor drops
   // out of availableConnections rather than offering a Connect button that
   // cannot complete.
@@ -2648,32 +2939,58 @@ var mailchimp_default2 = {
     "MAILCHIMP_OAUTH_CLIENT_SECRET"
   ],
   slug: "mailchimp",
-  // A key with no audience chosen is authenticated and inert. Mailchimp also
-  // needs its merge fields created on that audience before any Drawbridge total
-  // can be written to a member — unlike Klaviyo, its custom fields are not
-  // schemaless — so the audience must be picked before lifecycle.register has
-  // anything to register against.
+  // A grant with no audience chosen is authenticated and useless — the sync has
+  // nowhere to put anyone — so the card must say Pending rather than Active over
+  // nothing. Mailchimp also needs its merge fields created on that audience
+  // before any Drawbridge total can be written to a member — unlike Klaviyo, its
+  // custom fields are not schemaless — so the audience must be picked before
+  // lifecycle.register has anything to register against.
   status: (data2) => {
     var _a;
     return ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? data2.status : "pending";
   },
-  // No steps: audience sync has not shipped, so this vendor contributes nothing
-  // to a workflow yet. An empty steps object is the honest declaration — the
-  // catalog renders the connection, and no builder offers a step it cannot run.
-  steps: {},
+  steps: {
+    contacts: {
+      // A DECLARATION, not the work. It names the hook that does the work, and
+      // the nesting IS the name: this is `step.contacts.sync`, the string a
+      // workflow document stores. Klaviyo and Attentive declare the same type —
+      // a step belongs to the capability, not to whoever implements it — and the
+      // connection on the step document is what says which vendor runs.
+      sync: ({ data: data2 }) => ({
+        hook: "contacts.sync",
+        // NO ACCOUNT NAME TO INTERPOLATE, unlike Klaviyo. Mailchimp's
+        // auth.connect deliberately stores only the data centre (a test pins
+        // that), and settings.audience is an opaque list id no merchant would
+        // recognise in a builder label — so the label names the vendor rather
+        // than showing a string like a1b2c3d4e5.
+        key: "Sync contact to Mailchimp",
+        queue: "connection",
+        // Nothing for a merchant to configure on the step itself — the audience
+        // is chosen once on the connection. Declared empty rather than omitted,
+        // so "this step takes no settings" and "nobody thought about settings"
+        // stay different statements.
+        settings: {},
+        // BOTH triggers, for the same reason as Klaviyo: lead.insert alone only
+        // ever fires for someone with no history yet, and crossing into a
+        // segment is the other moment a contact is worth pushing.
+        triggers: ["lead.insert", "segment.contact.add"],
+        // One source for cost: what the builder discloses before a merchant
+        // adds this step, and what is charged when it runs.
+        usage: { actions: 1 }
+      })
+    }
+  },
+  // WHY, in the merchant's words, and what to do about it.
+  // ONLY FOR A LIVE GRANT. A disconnected or errored connection's next step
+  // is reconnecting — prompting "choose a audience" there asks the merchant to
+  // configure a grant that no longer exists. `pending` is exactly this task's
+  // moment: the grant is good and the audience is the missing half.
   tasks: (data2) => {
     var _a;
-    return [
-      ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
-        {
-          message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
-          title: "Choose an audience"
-        }
-      ],
+    return !["active", "pending"].includes(data2 == null ? void 0 : data2.status) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.audience) ? [] : [
       {
-        message: "Contact syncing to Mailchimp audiences has not shipped yet, and this connection no longer sends your email. Nothing is being sent to Mailchimp right now.",
-        title: "Audience sync not available yet",
-        type: "warning"
+        message: "Choose which Mailchimp audience your contacts should sync into. Until you do, nothing is being synced.",
+        title: "Choose an audience"
       }
     ];
   },
@@ -2681,19 +2998,18 @@ var mailchimp_default2 = {
 };
 
 // lib/connections/providers/shopify.js
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_nanoid2 = require("nanoid");
 
 // lib/connections/icons/shopify.js
 var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="500" height="500" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M309.524 407.192L308.799 128.423C306.921 126.545 303.258 127.112 301.827 127.531L292.29 130.487C291.113 126.613 289.585 122.854 287.726 119.258C280.959 106.337 271.069 99.5052 259.096 99.4866H259.059C258.259 99.4866 257.469 99.5609 256.67 99.626L256.577 99.6353C256.231 99.2089 255.871 98.7935 255.499 98.3897C250.293 92.8125 243.601 90.0889 235.588 90.3213C220.139 90.7675 204.755 101.941 192.271 121.786C183.487 135.757 176.823 153.298 174.917 166.878L144.493 176.313C135.542 179.129 135.263 179.408 134.082 187.858C133.199 194.253 109.766 375.69 109.766 375.69L306.159 409.692L309.524 407.192ZM245.181 103.065C242.569 101.346 239.511 100.546 235.885 100.621C212.033 101.308 191.23 138.611 185.923 163.467L208.771 156.384L212.851 155.119C215.845 139.336 223.355 122.957 233.181 112.416C236.616 108.639 240.671 105.477 245.172 103.065H245.181ZM224.145 151.615L256.94 141.446C257.042 132.894 256.112 120.252 251.836 111.329C247.282 113.207 243.452 116.497 240.7 119.444C233.329 127.373 227.315 139.466 224.155 151.615H224.145ZM267.211 138.267L282.455 133.536C280.02 125.616 274.238 112.342 262.517 110.111C266.161 119.527 267.099 130.431 267.211 138.267Z" fill="#95BF47"/>
-<path d="M353.528 149.156C352.356 149.063 329.657 148.709 329.657 148.709C329.657 148.709 310.666 130.249 308.789 128.362C308.062 127.691 307.141 127.268 306.158 127.153V409.64L391.257 388.456C391.257 388.456 356.53 153.366 356.307 151.758C356.199 151.075 355.866 150.448 355.361 149.976C354.856 149.505 354.216 149.216 353.528 149.156Z" fill="#5E8E3E"/>
-<path d="M258.993 193.019L249.103 230.052C249.103 230.052 238.079 225.023 225 225.85C205.833 227.059 205.628 239.171 205.824 242.21C206.865 258.756 250.376 262.381 252.821 301.171C254.745 331.688 236.656 352.574 210.592 354.21C179.313 356.19 162.089 337.711 162.089 337.711L168.716 309.472C168.716 309.472 186.052 322.569 199.921 321.686C208.993 321.119 212.228 313.738 211.903 308.514C210.536 286.921 175.102 288.185 172.862 252.695C170.985 222.811 190.57 192.554 233.803 189.821C250.46 188.762 258.993 193.028 258.993 193.028" fill="white"/>
+<rect width="500" height="500" fill="#95C049"/>
+<path d="M292.997 147.633C292.997 147.633 289.98 148.495 285.023 150.004C284.161 147.202 282.868 143.969 281.144 140.521C275.54 129.744 267.134 123.925 257.22 123.925C256.574 123.925 255.927 123.925 255.065 124.141C254.849 123.71 254.418 123.494 254.203 123.063C249.892 118.322 244.289 116.166 237.607 116.382C224.676 116.813 211.744 126.081 201.399 142.676C194.071 154.314 188.468 168.97 186.959 180.393C172.088 184.919 161.743 188.152 161.527 188.367C153.984 190.738 153.768 190.954 152.906 198.066C151.613 203.454 132 355.4 132 355.4L294.937 383.633V147.202C294.075 147.418 293.429 147.418 292.997 147.633ZM255.281 159.271C246.66 161.858 237.176 164.875 227.909 167.677C230.495 157.547 235.668 147.418 241.702 140.736C244.073 138.365 247.306 135.564 250.97 133.839C254.634 141.598 255.496 152.159 255.281 159.271ZM237.823 125.003C240.84 125.003 243.427 125.649 245.582 126.943C242.133 128.667 238.685 131.469 235.452 134.702C227.262 143.538 221.012 157.332 218.426 170.479C210.667 172.85 202.908 175.22 195.796 177.376C200.322 156.901 217.779 125.649 237.823 125.003ZM212.607 243.542C213.469 257.335 249.892 260.353 252.048 292.897C253.556 318.545 238.47 336.002 216.701 337.295C190.407 339.02 175.967 323.502 175.967 323.502L181.571 299.794C181.571 299.794 196.011 310.786 207.649 309.924C215.193 309.493 217.995 303.242 217.779 298.932C216.701 280.828 186.959 281.905 185.019 252.163C183.295 227.377 199.675 202.161 235.883 199.79C249.892 198.928 257.005 202.377 257.005 202.377L248.815 233.412C248.815 233.412 239.547 229.102 228.555 229.964C212.607 231.041 212.391 241.171 212.607 243.542ZM263.902 156.685C263.902 150.219 263.039 140.952 260.022 133.193C269.936 135.133 274.678 146.124 276.833 152.806C272.954 153.883 268.643 155.176 263.902 156.685Z" fill="white"/>
+<path d="M300.325 382.771L368 365.96C368 365.96 338.904 169.185 338.689 167.892C338.473 166.599 337.396 165.737 336.318 165.737C335.24 165.737 316.274 165.306 316.274 165.306C316.274 165.306 304.636 154.099 300.325 149.788V382.771Z" fill="white"/>
 </svg>`;
 
 // lib/connections/inbound.js
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!secret) {
     throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
@@ -2702,10 +3018,10 @@ var verifySignature = ({ body, descriptor, headers, secret }) => {
   if (!provided) {
     throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
   }
-  const digest = (0, import_node_crypto2.createHmac)(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
+  const digest = (0, import_node_crypto3.createHmac)(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
   const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
   const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
-  if (digestBuffer.length !== providedBuffer.length || !(0, import_node_crypto2.timingSafeEqual)(digestBuffer, providedBuffer)) {
+  if (digestBuffer.length !== providedBuffer.length || !(0, import_node_crypto3.timingSafeEqual)(digestBuffer, providedBuffer)) {
     throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
   }
   return JSON.parse(body.toString());
@@ -2728,18 +3044,6 @@ var toCanonicalEmail = (value) => {
   return local + "@" + domain;
 };
 
-// lib/phone.js
-var import_libphonenumber_js = require("libphonenumber-js");
-var toE164 = (value, country) => {
-  if (!value) return null;
-  try {
-    const parsed = (0, import_libphonenumber_js.parsePhoneNumberFromString)(String(value), country);
-    return parsed ? parsed.number : null;
-  } catch {
-    return null;
-  }
-};
-
 // lib/connections/providers/shopify.js
 var toLine = ({
   price,
@@ -2839,7 +3143,7 @@ var shopify_default2 = {
     // the App Store listing, and the dashboard must never imply a store can be
     // linked from inside it.
     redirect: {
-      env: "SHOPIFY_APP_LISTING_URL",
+      credential: "SHOPIFY_APP_LISTING_URL",
       title: "View on the Shopify App Store"
     }
   },
@@ -3456,7 +3760,7 @@ var shopify_default2 = {
                 event: "shopify.register.webhooks"
               },
               name: "register",
-              options: { jobId: "connection.update.register." + workflow.connection + "." + (0, import_node_crypto3.randomUUID)() },
+              options: { jobId: "connection.update.register." + workflow.connection + "." + (0, import_node_crypto4.randomUUID)() },
               queue: "connection"
             }],
             message: (scopesMissing == null ? void 0 : scopesMissing.length) ? "Health check: ping ok, webhooks reconciled \u2014 connection errored, granted scopes are missing: " + scopesMissing.join(", ") + "." : refreshTokenRotated ? "Health check passed \u2014 refresh token rotated, ping ok, webhooks reconciled." : "Health check passed \u2014 ping ok, webhooks reconciled.",
@@ -3592,6 +3896,19 @@ var shopify_default2 = {
     const shop = (data2 == null ? void 0 : data2.shop) || ((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.domain);
     return shop ? "https://admin.shopify.com/store/" + String(shop).replace(".myshopify.com", "") + "/apps/" + (env == null ? void 0 : env.SHOPIFY_APP_HANDLE) : void 0;
   },
+  // DRAWBRIDGE'S OWN CREDENTIALS for this vendor, as opposed to a merchant's —
+  // what an admin types on the provider screen. The four names below are exactly
+  // what `requires` gates on, which is the point of declaring them together: a
+  // name required by the manifest and enterable nowhere is a vendor that can
+  // never go live from the admin screen.
+  provider: {
+    fields: [
+      { input: "text", key: "apiKey", credential: "SHOPIFY_API_KEY", label: "API key", required: true },
+      { input: "password", key: "apiSecret", credential: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
+      { input: "text", key: "appHandle", credential: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
+      { input: "text", key: "listingUrl", credential: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
+    ]
+  },
   // A pre-launch integration: it only surfaces once the App Store listing
   // exists and the app is fully configured. Requiring all four means it can
   // never render half-configured — and absence of any one excludes the
@@ -3730,7 +4047,7 @@ var shopify_default2 = {
 };
 
 // lib/connections/providers/webhook.js
-var import_node_crypto4 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 
 // lib/safe-http.js
 var import_dns2 = __toESM(require("dns"), 1);
@@ -3962,7 +4279,7 @@ var webhook_default = {
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto4.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = "sha256=" + import_node_crypto5.default.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
         }
         const response = await send2({ body, headers: outgoing, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
@@ -4008,7 +4325,10 @@ var webhook_default = {
   // pressing Connect will do; afterwards it states the verification the
   // merchant's own endpoint has to perform, because a signed payload nobody
   // checks is an unsigned payload.
-  tasks: ({ settings }) => (settings == null ? void 0 : settings.secret) ? [
+  // The connect prompt only where connecting is not already the card's whole
+  // story: a disconnected or errored document renders a Connect action itself,
+  // and a task repeating it talks over the button.
+  tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
       message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
       title: "Requests must be verified",
@@ -4033,7 +4353,7 @@ var leaves = (node, path = []) => Object.entries(node || {}).flatMap(
   ([key, value]) => typeof value === "function" ? [[[...path, key].join("."), value]] : value && typeof value === "object" ? leaves(value, [...path, key]) : []
 );
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (!(manifest == null ? void 0 : manifest.private) && !(manifest == null ? void 0 : manifest.feature)) throw new Error(manifest.slug + " needs a plan feature key");
@@ -4063,6 +4383,17 @@ var build = (manifest) => {
       }
     }
   }
+  for (const field2 of ((_c = manifest.provider) == null ? void 0 : _c.fields) || []) {
+    if (!(field2 == null ? void 0 : field2.key) || !(field2 == null ? void 0 : field2.label)) {
+      throw new Error(manifest.slug + " declares a provider field with no key or label");
+    }
+    if (!INPUTS.includes(field2.input)) {
+      throw new Error(manifest.slug + ".provider." + field2.key + " needs an input the admin form can render \u2014 one of " + INPUTS.join(", "));
+    }
+    if (field2.input === "password" && !field2.redact) {
+      throw new Error(manifest.slug + ".provider." + field2.key + " is a password and must declare redact : true \u2014 the api would hand the value back");
+    }
+  }
   if (typeof (manifest == null ? void 0 : manifest.icon) !== "string" || !manifest.icon.includes("<svg")) {
     throw new Error(manifest.slug + " needs an icon \u2014 the svg markup itself, not a path to one");
   }
@@ -4075,23 +4406,23 @@ var build = (manifest) => {
   if (!GROUPS.includes(manifest == null ? void 0 : manifest.group)) {
     throw new Error(manifest.slug + " needs a group \u2014 one of " + GROUPS.join(", "));
   }
-  if ((_c = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _c.type) {
+  if ((_d = manifest == null ? void 0 : manifest.connect) == null ? void 0 : _d.type) {
     throw new Error(manifest.slug + " declares connect.type \u2014 that is auth.type now");
   }
-  if (!AUTH_TYPES.includes((_d = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _d.type)) {
+  if (!AUTH_TYPES.includes((_e = manifest == null ? void 0 : manifest.auth) == null ? void 0 : _e.type)) {
     throw new Error(manifest.slug + " needs auth.type \u2014 one of " + AUTH_TYPES.join(", "));
   }
   if (manifest.auth.type === "oauth") {
     for (const field2 of OAUTH_FIELDS) {
-      if (!((_e = manifest.auth.oauth) == null ? void 0 : _e[field2])) {
+      if (!((_f = manifest.auth.oauth) == null ? void 0 : _f[field2])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth." + field2);
       }
     }
-    if (typeof ((_g = (_f = manifest.hooks) == null ? void 0 : _f.auth) == null ? void 0 : _g.token) !== "function") {
+    if (typeof ((_h = (_g = manifest.hooks) == null ? void 0 : _g.auth) == null ? void 0 : _h.token) !== "function") {
       throw new Error(manifest.slug + " is oauth and must implement hooks.auth.token \u2014 point it at authToken() or wrap it");
     }
     for (const url of OAUTH_URLS) {
-      if (!((_i = (_h = manifest.auth.oauth) == null ? void 0 : _h.urls) == null ? void 0 : _i[url])) {
+      if (!((_j = (_i = manifest.auth.oauth) == null ? void 0 : _i.urls) == null ? void 0 : _j[url])) {
         throw new Error(manifest.slug + " is oauth and must declare auth.oauth.urls." + url);
       }
     }
@@ -4101,16 +4432,16 @@ var build = (manifest) => {
       );
     }
   }
-  if (implemented(manifest.hooks, "inbound.event") && !((_k = (_j = manifest.inbound) == null ? void 0 : _j.headers) == null ? void 0 : _k.event)) {
+  if (implemented(manifest.hooks, "inbound.event") && !((_l = (_k = manifest.inbound) == null ? void 0 : _k.headers) == null ? void 0 : _l.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_m = (_l = manifest.inbound) == null ? void 0 : _l.headers) == null ? void 0 : _m.signature)) {
+  if (implemented(manifest.hooks, "inbound.verify") && !((_n = (_m = manifest.inbound) == null ? void 0 : _m.headers) == null ? void 0 : _n.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
     throw new Error(manifest.slug + " must declare status( data ) \u2014 return null to accept the connection's own status, or { message, status } to override it");
   }
-  if (!Array.isArray((_n = manifest == null ? void 0 : manifest.content) == null ? void 0 : _n.guide) || !manifest.content.guide.length) {
+  if (!Array.isArray((_o = manifest == null ? void 0 : manifest.content) == null ? void 0 : _o.guide) || !manifest.content.guide.length) {
     throw new Error(manifest.slug + " needs content.guide \u2014 an array of steps for its page");
   }
   if (typeof (manifest == null ? void 0 : manifest.status) !== "function") {
@@ -4122,8 +4453,8 @@ var build = (manifest) => {
   }
   for (const [domain, verbs] of Object.entries(HOOKS)) {
     for (const verb of verbs) {
-      const hook = (_p = (_o = manifest.hooks) == null ? void 0 : _o[domain]) == null ? void 0 : _p[verb];
-      if (((_q = manifest.hooks) == null ? void 0 : _q[domain]) === false) continue;
+      const hook = (_q = (_p = manifest.hooks) == null ? void 0 : _p[domain]) == null ? void 0 : _q[verb];
+      if (((_r = manifest.hooks) == null ? void 0 : _r[domain]) === false) continue;
       if (hook !== false && !implemented({ [domain]: { [verb]: hook } }, domain + "." + verb)) {
         throw new Error(manifest.slug + " must answer hooks." + domain + "." + verb + " \u2014 false, a function, or {} if another repo implements it");
       }
@@ -4169,14 +4500,18 @@ var connections = Object.freeze({
   webhook: build(webhook_default)
 });
 (() => {
-  const owners = {};
+  var _a;
+  const routes = {};
   for (const [slug, manifest] of Object.entries(connections)) {
-    for (const [name] of leaves(manifest.steps)) {
+    for (const [name, step] of leaves(manifest.steps)) {
       const type = "step." + name;
-      if (owners[type]) {
-        throw new Error("Step " + type + " is declared by both " + owners[type] + " and " + slug);
+      const queue = (_a = step({})) == null ? void 0 : _a.queue;
+      if (routes[type] && routes[type].queue !== queue) {
+        throw new Error(
+          "Step " + type + " routes to " + routes[type].queue + " for " + routes[type].slug + " and " + queue + " for " + slug + " \u2014 one of them would be enqueued nowhere"
+        );
       }
-      owners[type] = slug;
+      routes[type] = { queue, slug };
     }
   }
 })();
@@ -4270,43 +4605,11 @@ var decrypt = (value) => {
 };
 
 // lib/providers.js
-var FIELDS = {
-  attentive: [
-    { input: "text", key: "clientId", env: "ATTENTIVE_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "ATTENTIVE_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  drawbridge: [
-    { input: "email", key: "accountSender", env: "SENDGRID_FROM_ADDRESS", label: "Account sender", message: "Verification codes and security alerts send from here.", required: true },
-    { input: "password", key: "apiKey", env: "SENDGRID_API_KEY", label: "SendGrid API key", redact: true, required: true },
-    // NOT required. The CRM sync is best-effort internal tooling and no-ops
-    // without a token — requiring it would make the whole drawbridge provider
-    // read not-live over something no merchant ever sees.
-    { input: "password", key: "hubspotToken", env: "HUBSPOT_ACCESS_TOKEN", label: "HubSpot access token", message: "Drawbridge's own CRM portal. Internal \u2014 no merchant sees this.", redact: true },
-    // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
-    // either. Unset, it degrades to the account sender rather than
-    // refusing to start.
-    { input: "email", key: "leadSender", env: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." },
-    { input: "text", key: "smsFrom", env: "TWILIO_ACCOUNT_FROM", label: "SMS number", required: true },
-    { input: "password", key: "smsSid", env: "TWILIO_ACCOUNT_SID", label: "Twilio account SID", redact: true, required: true },
-    { input: "password", key: "smsToken", env: "TWILIO_AUTH_TOKEN", label: "Twilio auth token", redact: true, required: true }
-  ],
-  klaviyo: [
-    { input: "text", key: "clientId", env: "KLAVIYO_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "KLAVIYO_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  mailchimp: [
-    { input: "text", key: "clientId", env: "MAILCHIMP_OAUTH_CLIENT_ID", label: "Client ID", required: true },
-    { input: "password", key: "clientSecret", env: "MAILCHIMP_OAUTH_CLIENT_SECRET", label: "Client secret", redact: true, required: true }
-  ],
-  shopify: [
-    { input: "text", key: "apiKey", env: "SHOPIFY_API_KEY", label: "API key", required: true },
-    { input: "password", key: "apiSecret", env: "SHOPIFY_API_SECRET", label: "API secret", redact: true, required: true },
-    { input: "text", key: "appHandle", env: "SHOPIFY_APP_HANDLE", label: "App handle", required: true },
-    { input: "text", key: "listingUrl", env: "SHOPIFY_APP_LISTING_URL", label: "App listing URL", required: true }
-  ]
+var providerFields = (slug) => {
+  var _a;
+  return Object.hasOwn(connections, slug) ? ((_a = connections[slug].provider) == null ? void 0 : _a.fields) || [] : [];
 };
-var providerFields = (slug) => Object.hasOwn(FIELDS, slug) ? FIELDS[slug] : [];
-var providerSlugs = () => Object.keys(FIELDS).sort();
+var providerSlugs = () => Object.keys(connections).filter((slug) => connections[slug].provider).sort();
 var isLive = (slug, settings) => {
   const fields2 = providerFields(slug);
   if (!fields2.length) return false;
@@ -4363,7 +4666,7 @@ var saveProviderSettings = async ({ authenticated, clear, controller, settings,
   return result;
 };
 var providerEnvNames = () => new Set(
-  providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.env).filter(Boolean)
+  providerSlugs().flatMap((slug) => providerFields(slug)).map((field2) => field2.credential).filter(Boolean)
 );
 var providerCredentials = async ({ controller }) => {
   const credentials2 = {};
@@ -4372,7 +4675,7 @@ var providerCredentials = async ({ controller }) => {
       const settings = await providerSettings({ controller, slug });
       for (const field2 of providerFields(slug)) {
         const value = settings == null ? void 0 : settings[field2.key];
-        if (field2.env && value) credentials2[field2.env] = value;
+        if (field2.credential && value) credentials2[field2.credential] = value;
       }
     } catch {
       continue;