@drawbridge/drawbridge-utils 0.0.172 → 0.0.173

package/dist/connections/index.cjs

@@ -2168,16 +2168,16 @@ var deliveryWrite = ({ at, code: code2, notification, permanent, provider, reaso
   };
 };
 var summariseEvents = (events) => {
-  const list = Array.isArray(events) ? events : [];
-  if (!list.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
+  const list2 = Array.isArray(events) ? events : [];
+  if (!list2.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
   const counts = {};
-  for (const { event } of list) {
+  for (const { event } of list2) {
     const name = event || "unknown";
     counts[name] = (counts[name] || 0) + 1;
   }
   const tally = Object.entries(counts).map(([name, count]) => count + " " + name).join(", ");
-  const refused = list.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
-  const writes = list.map((event) => {
+  const refused = list2.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
+  const writes = list2.map((event) => {
     var _a;
     return deliveryWrite({
       at: event.timestamp ? new Date(event.timestamp * 1e3) : void 0,
@@ -2197,7 +2197,7 @@ var summariseEvents = (events) => {
     });
   }).filter(Boolean);
   return {
-    message: [list.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
+    message: [list2.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
     ...writes.length ? { writes } : { skipped: true }
   };
 };
@@ -3064,6 +3064,14 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// lib/connections/scopes.js
+var list = (value) => (Array.isArray(value) ? value.flatMap((entry) => String(entry).split(/\s+/)) : String(value ?? "").split(/\s+/)).map((entry) => entry.trim()).filter(Boolean);
+var missingScopes = ({ granted, required }) => {
+  if (granted === null || granted === void 0 || granted === "") return null;
+  const held = new Set(list(granted));
+  return list(required).filter((scope) => !held.has(scope));
+};
+
 // lib/connections/providers/klaviyo.js
 var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
@@ -3092,7 +3100,9 @@ var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) =>
   return response.status === 204 ? null : response.json();
 };
 var segmentName = (title, id) => "Drawbridge: " + title + " (" + String(id).slice(-6) + ")";
-var canManageSegments = (settings) => String((settings == null ? void 0 : settings.scope) || "").split(/\s+/).includes("segments:write");
+var SCOPES = "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write";
+var missing = (settings) => missingScopes({ granted: settings == null ? void 0 : settings.scope, required: SCOPES });
+var canManageSegments = (settings) => !(missing(settings) || []).includes("segments:write");
 var klaviyo_default2 = {
   // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
   // exchange without a code_verifier matching the challenge the consent
@@ -3136,7 +3146,7 @@ var klaviyo_default2 = {
       // Update and Delete Segment each list `segments:write`
       // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
       // revision 2026-07-15, fetched 2026-09-11).
-      scopes: "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write",
+      scopes: SCOPES,
       // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
       // the disconnect hook — three vendor addresses, two of them declared,
       // which is exactly the kind of split that goes unnoticed.
@@ -3317,8 +3327,14 @@ var klaviyo_default2 = {
         });
         return { ok: Boolean(token) };
       },
-      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
-      scopes: false,
+      // THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+      // scopes are fixed on the APP, so adding one re-consents every NEW grant
+      // and leaves every EXISTING one exactly as narrow as it was — with no
+      // error, no webhook, and nothing that notices. That is what left grants
+      // authenticating perfectly while silently unable to manage a segment.
+      //
+      // The same slot Shopify answers, so one caller can ask any vendor.
+      scopes: ({ scope }) => missingScopes({ granted: scope, required: SCOPES }),
       // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
       // client_id/client_secret pair as body fields. Everything else about the
       // request is standard, so this is the shared implementation told the one
@@ -3339,9 +3355,9 @@ var klaviyo_default2 = {
       remove: false,
       sync: async ({ context, lead, segments, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c, _d, _e;
-        const list = settings == null ? void 0 : settings.list;
+        const list2 = settings == null ? void 0 : settings.list;
         const request2 = { email: ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email) || null, list: (settings == null ? void 0 : settings.list) || null };
-        if (!list) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
+        if (!list2) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
         const email = ((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.email) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", request: request2, skipped: true };
         const person = (context == null ? void 0 : context.contact) || null;
@@ -3420,7 +3436,7 @@ var klaviyo_default2 = {
                   }]
                 }
               },
-              relationships: { list: { data: { id: list, type: "list" } } },
+              relationships: { list: { data: { id: list2, type: "list" } } },
               type: "profile-subscription-bulk-create-job"
             }
           },
@@ -3593,7 +3609,7 @@ var klaviyo_default2 = {
       // The one call below proves the minted token is HONOURED — mint and
       // acceptance are different facts, and /accounts is already the call
       // the connect flow makes (auth.connect), so it needs no new scope.
-      health: async ({ connection: connection2, token }, { fetcher, read } = {}) => {
+      health: async ({ connection: connection2, settings, token }, { fetcher, read } = {}) => {
         const request2 = { connectionId: connection2.id };
         try {
           await api2("/accounts", { fetcher, token });
@@ -3645,8 +3661,8 @@ var klaviyo_default2 = {
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
           const body = await api2(next, { fetcher, token });
-          for (const list of (body == null ? void 0 : body.data) || []) {
-            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          for (const list2 of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list2.id, title: ((_a = list2 == null ? void 0 : list2.attributes) == null ? void 0 : _a.name) || list2.id });
           }
           const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
           next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
@@ -3812,13 +3828,14 @@ var klaviyo_default2 = {
     var _a;
     if (!["active", "pending"].includes(data2 == null ? void 0 : data2.status)) return [];
     return [
-      // A connection made before segments were requested is authenticated and
-      // cannot manage them, and no error surfaces anywhere else — the register
-      // runs skip rather than fail.
-      ...canManageSegments(data2 == null ? void 0 : data2.settings) ? [] : [{
-        message: "Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.",
-        title: "Reconnect Klaviyo"
-      }],
+      // THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+      // written by the health check, because a task is quiet: it renders only in
+      // the body of this connection's own page, so a merchant who never opens it
+      // never learns that their segments stopped being published. An error entry
+      // reaches the card and the organization checklist too.
+      //
+      // Deliberately not a status change — see the health hook for why that
+      // would stop the contact sync that still works.
       ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [{
         message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
         title: "Choose a list"
@@ -4225,7 +4242,7 @@ var mailchimp_default2 = {
           "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list2) => ({ id: list2.id, title: (list2 == null ? void 0 : list2.name) || list2.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
         const nextOffset = offset + count;

package/dist/connections/index.d.cts

@@ -3502,6 +3502,39 @@ var icon$2 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// WHAT A GRANT IS MISSING, as set arithmetic and nothing else.
+//
+// Every vendor that can drift answers `auth.scopes` with what is absent from the
+// grant it was handed. The comparison itself is the same everywhere — which
+// strings did we ask for, which strings came back — so it lives here rather than
+// being retyped per manifest, where each copy is a chance to split on the wrong
+// character or forget to filter the empty string.
+//
+// SPACE SEPARATED IN, ARRAY OUT. OAuth scope strings are space separated by
+// RFC 6749 §3.3, and both halves are tolerated as arrays because a vendor SDK may
+// already have parsed one.
+//
+// AN EMPTY ANSWER IS NOT THE SAME AS AN UNKNOWN ONE. A caller with no grant
+// string has learned nothing and must not read "nothing missing" from that — so
+// an absent `granted` answers null, and only a grant we actually read answers a
+// list. Getting this wrong reports every connection healthy the moment a read
+// fails, which is the silent direction.
+const list = ( value ) => (
+	Array.isArray( value )
+		? value.flatMap( ( entry ) => String( entry ).split( /\s+/ ) )
+		: String( value ?? '' ).split( /\s+/ )
+).map( ( entry ) => entry.trim() ).filter( Boolean );
+
+const missingScopes = ({ granted, required }) => {
+
+	if( granted === null || granted === undefined || granted === '' ) return null;
+
+	const held = new Set( list( granted ) );
+
+	return list( required ).filter( ( scope ) => ! held.has( scope ) );
+
+};
+
 const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token } ) => {
 
 	const response = await fetcher( 'https://a.klaviyo.com/api' + path, {
@@ -3539,7 +3572,6 @@ const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token }
 // The segment's name at Klaviyo, spelled once. It is a LABEL — the definition
 // below keys on the id — so a rename never has to touch a profile.
 //
-// THE ID IS IN THE LABEL TOO, and that part is not cosmetic. Nothing makes a
 // THE ID IS IN THE NAME BECAUSE THE NAME IS NOT AN IDENTITY. Keyed on title
 // alone, a second segment called "VIP" found the first one's Klaviyo segment by
 // name and adopted it: both rows then pointed at one segment whose definition
@@ -3563,20 +3595,35 @@ const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token }
 // guessing.
 const segmentName = ( title, id ) => 'Drawbridge: ' + title + ' (' + String( id ).slice( -6 ) + ')';
 
-// THE GRANT THIS NEEDS. Klaviyo's scopes are set on the app and a token carries
-// only what the merchant consented to, so a connection made before segments were
-// asked for holds one that cannot write a segment — Create, Update and Delete
-// Segment each list `segments:write`
+// `scope` on the stored settings is the grant Klaviyo RETURNED on the exchange,
+// which its OAuth guide describes as "The scopes that this access token has
+// access to for accessing API resources"
+// (developers.klaviyo.com/en/docs/set_up_oauth, fetched 2026-09-11) — not the
+// list this manifest asks for. That difference is the whole drift: a connection
+// older than the ask holds a narrower grant and nothing says so.
+//
+// THE SCOPES THIS APP ASKS FOR, named once. The consent url and the drift check
+// read the same constant, so a scope added to one is never missing from the
+// other — which is exactly how a grant ends up unable to do something nobody
+// noticed it could no longer do.
+//
+// Space separated. accounts:read is required by Klaviyo on every app; the rest
+// are what a contact sync and the segment hooks need — Get Segments lists
+// `segments:read`, and Create, Update and Delete Segment each list
+// `segments:write`
 // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json, revision
-// 2026-07-15, fetched 2026-09-11). Answering 403 three times tells the merchant
-// nothing; this does.
-//
-// `scope` is the grant Klaviyo returned on the exchange, which its OAuth guide
-// describes as "The scopes that this access token has access to for accessing
-// API resources" (developers.klaviyo.com/en/docs/set_up_oauth, fetched
-// 2026-09-11) — not the list this manifest asks for, which is why a connection
-// older than the ask reads as false rather than true.
-const canManageSegments = ( settings ) => String( settings?.scope || '' ).split( /\s+/ ).includes( 'segments:write' );
+// 2026-07-15, fetched 2026-09-11).
+const SCOPES = 'accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write';
+
+// WHAT THIS GRANT CANNOT DO, through the shared comparison every vendor uses.
+// Answers null when there is no grant string to judge, which is not the same as
+// "nothing missing" — see lib/connections/scopes.js.
+const missing = ( settings ) => missingScopes({ granted : settings?.scope, required : SCOPES });
+
+// The register and remove hooks hard-skip on this rather than calling Klaviyo
+// and reading a 403 back. It asks the same question the drift check does, of the
+// same constant.
+const canManageSegments = ( settings ) => ! ( missing( settings ) || [] ).includes( 'segments:write' );
 
 // Klaviyo — contact sync, over OAuth.
 //
@@ -3641,7 +3688,7 @@ var klaviyo = {
 			// Update and Delete Segment each list `segments:write`
 			// (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
 			// revision 2026-07-15, fetched 2026-09-11).
-			scopes : 'accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write',
+			scopes : SCOPES,
 			// EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
 			// the disconnect hook — three vendor addresses, two of them declared,
 			// which is exactly the kind of split that goes unnoticed.
@@ -3848,8 +3895,14 @@ var klaviyo = {
 
 			},
 
-			// Klaviyo scopes are fixed at app level and re-consented, not drifted.
-			scopes : false,
+			// THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+			// scopes are fixed on the APP, so adding one re-consents every NEW grant
+			// and leaves every EXISTING one exactly as narrow as it was — with no
+			// error, no webhook, and nothing that notices. That is what left grants
+			// authenticating perfectly while silently unable to manage a segment.
+			//
+			// The same slot Shopify answers, so one caller can ask any vendor.
+			scopes : ({ scope }) => missingScopes({ granted : scope, required : SCOPES }),
 
 			// KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
 			// client_id/client_secret pair as body fields. Everything else about the
@@ -4275,7 +4328,7 @@ var klaviyo = {
 			// The one call below proves the minted token is HONOURED — mint and
 			// acceptance are different facts, and /accounts is already the call
 			// the connect flow makes (auth.connect), so it needs no new scope.
-			health : async ( { connection, token }, { fetcher, read } = {} ) => {
+			health : async ( { connection, settings, token }, { fetcher, read } = {} ) => {
 
 				const request = { connectionId : connection.id };
 
@@ -4283,6 +4336,10 @@ var klaviyo = {
 
 					await api$1( '/accounts', { fetcher, token });
 
+					// SCOPE DRIFT IS NOT CHECKED HERE. The shell does it for every vendor
+					// after this step succeeds, by asking hooks.auth.scopes — see
+					// reconcileScopes in drawbridge-sync lib/step-runner.js. This hook
+					// answers only whether the token was minted and honoured.
 					return {
 						message : 'Health check passed — token minted and accepted.',
 						request,
@@ -4566,13 +4623,14 @@ var klaviyo = {
 		// discovers the second. The grant leads because reconnecting is the longer
 		// errand.
 		return [
-			// A connection made before segments were requested is authenticated and
-			// cannot manage them, and no error surfaces anywhere else — the register
-			// runs skip rather than fail.
-			...( canManageSegments( data?.settings ) ? [] : [ {
-				message : 'Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.',
-				title : 'Reconnect Klaviyo'
-			} ] ),
+			// THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+			// written by the health check, because a task is quiet: it renders only in
+			// the body of this connection's own page, so a merchant who never opens it
+			// never learns that their segments stopped being published. An error entry
+			// reaches the card and the organization checklist too.
+			//
+			// Deliberately not a status change — see the health hook for why that
+			// would stop the contact sync that still works.
 			...( data?.settings?.list ? [] : [ {
 				message : 'Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.',
 				title : 'Choose a list'

package/dist/connections/index.d.ts

@@ -3502,6 +3502,39 @@ var icon$2 = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xm
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// WHAT A GRANT IS MISSING, as set arithmetic and nothing else.
+//
+// Every vendor that can drift answers `auth.scopes` with what is absent from the
+// grant it was handed. The comparison itself is the same everywhere — which
+// strings did we ask for, which strings came back — so it lives here rather than
+// being retyped per manifest, where each copy is a chance to split on the wrong
+// character or forget to filter the empty string.
+//
+// SPACE SEPARATED IN, ARRAY OUT. OAuth scope strings are space separated by
+// RFC 6749 §3.3, and both halves are tolerated as arrays because a vendor SDK may
+// already have parsed one.
+//
+// AN EMPTY ANSWER IS NOT THE SAME AS AN UNKNOWN ONE. A caller with no grant
+// string has learned nothing and must not read "nothing missing" from that — so
+// an absent `granted` answers null, and only a grant we actually read answers a
+// list. Getting this wrong reports every connection healthy the moment a read
+// fails, which is the silent direction.
+const list = ( value ) => (
+	Array.isArray( value )
+		? value.flatMap( ( entry ) => String( entry ).split( /\s+/ ) )
+		: String( value ?? '' ).split( /\s+/ )
+).map( ( entry ) => entry.trim() ).filter( Boolean );
+
+const missingScopes = ({ granted, required }) => {
+
+	if( granted === null || granted === undefined || granted === '' ) return null;
+
+	const held = new Set( list( granted ) );
+
+	return list( required ).filter( ( scope ) => ! held.has( scope ) );
+
+};
+
 const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token } ) => {
 
 	const response = await fetcher( 'https://a.klaviyo.com/api' + path, {
@@ -3539,7 +3572,6 @@ const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token }
 // The segment's name at Klaviyo, spelled once. It is a LABEL — the definition
 // below keys on the id — so a rename never has to touch a profile.
 //
-// THE ID IS IN THE LABEL TOO, and that part is not cosmetic. Nothing makes a
 // THE ID IS IN THE NAME BECAUSE THE NAME IS NOT AN IDENTITY. Keyed on title
 // alone, a second segment called "VIP" found the first one's Klaviyo segment by
 // name and adopted it: both rows then pointed at one segment whose definition
@@ -3563,20 +3595,35 @@ const api$1 = async ( path, { fetcher = fetch, method = 'GET', payload, token }
 // guessing.
 const segmentName = ( title, id ) => 'Drawbridge: ' + title + ' (' + String( id ).slice( -6 ) + ')';
 
-// THE GRANT THIS NEEDS. Klaviyo's scopes are set on the app and a token carries
-// only what the merchant consented to, so a connection made before segments were
-// asked for holds one that cannot write a segment — Create, Update and Delete
-// Segment each list `segments:write`
+// `scope` on the stored settings is the grant Klaviyo RETURNED on the exchange,
+// which its OAuth guide describes as "The scopes that this access token has
+// access to for accessing API resources"
+// (developers.klaviyo.com/en/docs/set_up_oauth, fetched 2026-09-11) — not the
+// list this manifest asks for. That difference is the whole drift: a connection
+// older than the ask holds a narrower grant and nothing says so.
+//
+// THE SCOPES THIS APP ASKS FOR, named once. The consent url and the drift check
+// read the same constant, so a scope added to one is never missing from the
+// other — which is exactly how a grant ends up unable to do something nobody
+// noticed it could no longer do.
+//
+// Space separated. accounts:read is required by Klaviyo on every app; the rest
+// are what a contact sync and the segment hooks need — Get Segments lists
+// `segments:read`, and Create, Update and Delete Segment each list
+// `segments:write`
 // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json, revision
-// 2026-07-15, fetched 2026-09-11). Answering 403 three times tells the merchant
-// nothing; this does.
-//
-// `scope` is the grant Klaviyo returned on the exchange, which its OAuth guide
-// describes as "The scopes that this access token has access to for accessing
-// API resources" (developers.klaviyo.com/en/docs/set_up_oauth, fetched
-// 2026-09-11) — not the list this manifest asks for, which is why a connection
-// older than the ask reads as false rather than true.
-const canManageSegments = ( settings ) => String( settings?.scope || '' ).split( /\s+/ ).includes( 'segments:write' );
+// 2026-07-15, fetched 2026-09-11).
+const SCOPES = 'accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write';
+
+// WHAT THIS GRANT CANNOT DO, through the shared comparison every vendor uses.
+// Answers null when there is no grant string to judge, which is not the same as
+// "nothing missing" — see lib/connections/scopes.js.
+const missing = ( settings ) => missingScopes({ granted : settings?.scope, required : SCOPES });
+
+// The register and remove hooks hard-skip on this rather than calling Klaviyo
+// and reading a 403 back. It asks the same question the drift check does, of the
+// same constant.
+const canManageSegments = ( settings ) => ! ( missing( settings ) || [] ).includes( 'segments:write' );
 
 // Klaviyo — contact sync, over OAuth.
 //
@@ -3641,7 +3688,7 @@ var klaviyo = {
 			// Update and Delete Segment each list `segments:write`
 			// (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
 			// revision 2026-07-15, fetched 2026-09-11).
-			scopes : 'accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write',
+			scopes : SCOPES,
 			// EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
 			// the disconnect hook — three vendor addresses, two of them declared,
 			// which is exactly the kind of split that goes unnoticed.
@@ -3848,8 +3895,14 @@ var klaviyo = {
 
 			},
 
-			// Klaviyo scopes are fixed at app level and re-consented, not drifted.
-			scopes : false,
+			// THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+			// scopes are fixed on the APP, so adding one re-consents every NEW grant
+			// and leaves every EXISTING one exactly as narrow as it was — with no
+			// error, no webhook, and nothing that notices. That is what left grants
+			// authenticating perfectly while silently unable to manage a segment.
+			//
+			// The same slot Shopify answers, so one caller can ask any vendor.
+			scopes : ({ scope }) => missingScopes({ granted : scope, required : SCOPES }),
 
 			// KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
 			// client_id/client_secret pair as body fields. Everything else about the
@@ -4275,7 +4328,7 @@ var klaviyo = {
 			// The one call below proves the minted token is HONOURED — mint and
 			// acceptance are different facts, and /accounts is already the call
 			// the connect flow makes (auth.connect), so it needs no new scope.
-			health : async ( { connection, token }, { fetcher, read } = {} ) => {
+			health : async ( { connection, settings, token }, { fetcher, read } = {} ) => {
 
 				const request = { connectionId : connection.id };
 
@@ -4283,6 +4336,10 @@ var klaviyo = {
 
 					await api$1( '/accounts', { fetcher, token });
 
+					// SCOPE DRIFT IS NOT CHECKED HERE. The shell does it for every vendor
+					// after this step succeeds, by asking hooks.auth.scopes — see
+					// reconcileScopes in drawbridge-sync lib/step-runner.js. This hook
+					// answers only whether the token was minted and honoured.
 					return {
 						message : 'Health check passed — token minted and accepted.',
 						request,
@@ -4566,13 +4623,14 @@ var klaviyo = {
 		// discovers the second. The grant leads because reconnecting is the longer
 		// errand.
 		return [
-			// A connection made before segments were requested is authenticated and
-			// cannot manage them, and no error surfaces anywhere else — the register
-			// runs skip rather than fail.
-			...( canManageSegments( data?.settings ) ? [] : [ {
-				message : 'Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.',
-				title : 'Reconnect Klaviyo'
-			} ] ),
+			// THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+			// written by the health check, because a task is quiet: it renders only in
+			// the body of this connection's own page, so a merchant who never opens it
+			// never learns that their segments stopped being published. An error entry
+			// reaches the card and the organization checklist too.
+			//
+			// Deliberately not a status change — see the health hook for why that
+			// would stop the contact sync that still works.
 			...( data?.settings?.list ? [] : [ {
 				message : 'Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.',
 				title : 'Choose a list'

package/dist/connections/index.js

@@ -2092,16 +2092,16 @@ var deliveryWrite = ({ at, code: code2, notification, permanent, provider, reaso
   };
 };
 var summariseEvents = (events) => {
-  const list = Array.isArray(events) ? events : [];
-  if (!list.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
+  const list2 = Array.isArray(events) ? events : [];
+  if (!list2.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
   const counts = {};
-  for (const { event } of list) {
+  for (const { event } of list2) {
     const name = event || "unknown";
     counts[name] = (counts[name] || 0) + 1;
   }
   const tally = Object.entries(counts).map(([name, count]) => count + " " + name).join(", ");
-  const refused = list.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
-  const writes = list.map((event) => {
+  const refused = list2.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
+  const writes = list2.map((event) => {
     var _a;
     return deliveryWrite({
       at: event.timestamp ? new Date(event.timestamp * 1e3) : void 0,
@@ -2121,7 +2121,7 @@ var summariseEvents = (events) => {
     });
   }).filter(Boolean);
   return {
-    message: [list.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
+    message: [list2.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
     ...writes.length ? { writes } : { skipped: true }
   };
 };
@@ -2988,6 +2988,14 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// lib/connections/scopes.js
+var list = (value) => (Array.isArray(value) ? value.flatMap((entry) => String(entry).split(/\s+/)) : String(value ?? "").split(/\s+/)).map((entry) => entry.trim()).filter(Boolean);
+var missingScopes = ({ granted, required }) => {
+  if (granted === null || granted === void 0 || granted === "") return null;
+  const held = new Set(list(granted));
+  return list(required).filter((scope) => !held.has(scope));
+};
+
 // lib/connections/providers/klaviyo.js
 var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
@@ -3016,7 +3024,9 @@ var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) =>
   return response.status === 204 ? null : response.json();
 };
 var segmentName = (title, id) => "Drawbridge: " + title + " (" + String(id).slice(-6) + ")";
-var canManageSegments = (settings) => String((settings == null ? void 0 : settings.scope) || "").split(/\s+/).includes("segments:write");
+var SCOPES = "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write";
+var missing = (settings) => missingScopes({ granted: settings == null ? void 0 : settings.scope, required: SCOPES });
+var canManageSegments = (settings) => !(missing(settings) || []).includes("segments:write");
 var klaviyo_default2 = {
   // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
   // exchange without a code_verifier matching the challenge the consent
@@ -3060,7 +3070,7 @@ var klaviyo_default2 = {
       // Update and Delete Segment each list `segments:write`
       // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
       // revision 2026-07-15, fetched 2026-09-11).
-      scopes: "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write",
+      scopes: SCOPES,
       // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
       // the disconnect hook — three vendor addresses, two of them declared,
       // which is exactly the kind of split that goes unnoticed.
@@ -3241,8 +3251,14 @@ var klaviyo_default2 = {
         });
         return { ok: Boolean(token) };
       },
-      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
-      scopes: false,
+      // THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+      // scopes are fixed on the APP, so adding one re-consents every NEW grant
+      // and leaves every EXISTING one exactly as narrow as it was — with no
+      // error, no webhook, and nothing that notices. That is what left grants
+      // authenticating perfectly while silently unable to manage a segment.
+      //
+      // The same slot Shopify answers, so one caller can ask any vendor.
+      scopes: ({ scope }) => missingScopes({ granted: scope, required: SCOPES }),
       // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
       // client_id/client_secret pair as body fields. Everything else about the
       // request is standard, so this is the shared implementation told the one
@@ -3263,9 +3279,9 @@ var klaviyo_default2 = {
       remove: false,
       sync: async ({ context, lead, segments, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c, _d, _e;
-        const list = settings == null ? void 0 : settings.list;
+        const list2 = settings == null ? void 0 : settings.list;
         const request2 = { email: ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email) || null, list: (settings == null ? void 0 : settings.list) || null };
-        if (!list) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
+        if (!list2) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
         const email = ((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.email) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", request: request2, skipped: true };
         const person = (context == null ? void 0 : context.contact) || null;
@@ -3344,7 +3360,7 @@ var klaviyo_default2 = {
                   }]
                 }
               },
-              relationships: { list: { data: { id: list, type: "list" } } },
+              relationships: { list: { data: { id: list2, type: "list" } } },
               type: "profile-subscription-bulk-create-job"
             }
           },
@@ -3517,7 +3533,7 @@ var klaviyo_default2 = {
       // The one call below proves the minted token is HONOURED — mint and
       // acceptance are different facts, and /accounts is already the call
       // the connect flow makes (auth.connect), so it needs no new scope.
-      health: async ({ connection: connection2, token }, { fetcher, read } = {}) => {
+      health: async ({ connection: connection2, settings, token }, { fetcher, read } = {}) => {
         const request2 = { connectionId: connection2.id };
         try {
           await api2("/accounts", { fetcher, token });
@@ -3569,8 +3585,8 @@ var klaviyo_default2 = {
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
           const body = await api2(next, { fetcher, token });
-          for (const list of (body == null ? void 0 : body.data) || []) {
-            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          for (const list2 of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list2.id, title: ((_a = list2 == null ? void 0 : list2.attributes) == null ? void 0 : _a.name) || list2.id });
           }
           const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
           next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
@@ -3736,13 +3752,14 @@ var klaviyo_default2 = {
     var _a;
     if (!["active", "pending"].includes(data2 == null ? void 0 : data2.status)) return [];
     return [
-      // A connection made before segments were requested is authenticated and
-      // cannot manage them, and no error surfaces anywhere else — the register
-      // runs skip rather than fail.
-      ...canManageSegments(data2 == null ? void 0 : data2.settings) ? [] : [{
-        message: "Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.",
-        title: "Reconnect Klaviyo"
-      }],
+      // THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+      // written by the health check, because a task is quiet: it renders only in
+      // the body of this connection's own page, so a merchant who never opens it
+      // never learns that their segments stopped being published. An error entry
+      // reaches the card and the organization checklist too.
+      //
+      // Deliberately not a status change — see the health hook for why that
+      // would stop the contact sync that still works.
       ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [{
         message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
         title: "Choose a list"
@@ -4149,7 +4166,7 @@ var mailchimp_default2 = {
           "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list2) => ({ id: list2.id, title: (list2 == null ? void 0 : list2.name) || list2.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
         const nextOffset = offset + count;

package/dist/providers.cjs

@@ -2077,16 +2077,16 @@ var deliveryWrite = ({ at, code: code2, notification, permanent, provider, reaso
   };
 };
 var summariseEvents = (events) => {
-  const list = Array.isArray(events) ? events : [];
-  if (!list.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
+  const list2 = Array.isArray(events) ? events : [];
+  if (!list2.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
   const counts = {};
-  for (const { event } of list) {
+  for (const { event } of list2) {
     const name = event || "unknown";
     counts[name] = (counts[name] || 0) + 1;
   }
   const tally = Object.entries(counts).map(([name, count]) => count + " " + name).join(", ");
-  const refused = list.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
-  const writes = list.map((event) => {
+  const refused = list2.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
+  const writes = list2.map((event) => {
     var _a;
     return deliveryWrite({
       at: event.timestamp ? new Date(event.timestamp * 1e3) : void 0,
@@ -2106,7 +2106,7 @@ var summariseEvents = (events) => {
     });
   }).filter(Boolean);
   return {
-    message: [list.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
+    message: [list2.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
     ...writes.length ? { writes } : { skipped: true }
   };
 };
@@ -2973,6 +2973,14 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// lib/connections/scopes.js
+var list = (value) => (Array.isArray(value) ? value.flatMap((entry) => String(entry).split(/\s+/)) : String(value ?? "").split(/\s+/)).map((entry) => entry.trim()).filter(Boolean);
+var missingScopes = ({ granted, required }) => {
+  if (granted === null || granted === void 0 || granted === "") return null;
+  const held = new Set(list(granted));
+  return list(required).filter((scope) => !held.has(scope));
+};
+
 // lib/connections/providers/klaviyo.js
 var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
@@ -3001,7 +3009,9 @@ var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) =>
   return response.status === 204 ? null : response.json();
 };
 var segmentName = (title, id) => "Drawbridge: " + title + " (" + String(id).slice(-6) + ")";
-var canManageSegments = (settings) => String((settings == null ? void 0 : settings.scope) || "").split(/\s+/).includes("segments:write");
+var SCOPES = "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write";
+var missing = (settings) => missingScopes({ granted: settings == null ? void 0 : settings.scope, required: SCOPES });
+var canManageSegments = (settings) => !(missing(settings) || []).includes("segments:write");
 var klaviyo_default2 = {
   // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
   // exchange without a code_verifier matching the challenge the consent
@@ -3045,7 +3055,7 @@ var klaviyo_default2 = {
       // Update and Delete Segment each list `segments:write`
       // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
       // revision 2026-07-15, fetched 2026-09-11).
-      scopes: "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write",
+      scopes: SCOPES,
       // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
       // the disconnect hook — three vendor addresses, two of them declared,
       // which is exactly the kind of split that goes unnoticed.
@@ -3226,8 +3236,14 @@ var klaviyo_default2 = {
         });
         return { ok: Boolean(token) };
       },
-      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
-      scopes: false,
+      // THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+      // scopes are fixed on the APP, so adding one re-consents every NEW grant
+      // and leaves every EXISTING one exactly as narrow as it was — with no
+      // error, no webhook, and nothing that notices. That is what left grants
+      // authenticating perfectly while silently unable to manage a segment.
+      //
+      // The same slot Shopify answers, so one caller can ask any vendor.
+      scopes: ({ scope }) => missingScopes({ granted: scope, required: SCOPES }),
       // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
       // client_id/client_secret pair as body fields. Everything else about the
       // request is standard, so this is the shared implementation told the one
@@ -3248,9 +3264,9 @@ var klaviyo_default2 = {
       remove: false,
       sync: async ({ context, lead, segments, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c, _d, _e;
-        const list = settings == null ? void 0 : settings.list;
+        const list2 = settings == null ? void 0 : settings.list;
         const request2 = { email: ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email) || null, list: (settings == null ? void 0 : settings.list) || null };
-        if (!list) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
+        if (!list2) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
         const email = ((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.email) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", request: request2, skipped: true };
         const person = (context == null ? void 0 : context.contact) || null;
@@ -3329,7 +3345,7 @@ var klaviyo_default2 = {
                   }]
                 }
               },
-              relationships: { list: { data: { id: list, type: "list" } } },
+              relationships: { list: { data: { id: list2, type: "list" } } },
               type: "profile-subscription-bulk-create-job"
             }
           },
@@ -3502,7 +3518,7 @@ var klaviyo_default2 = {
       // The one call below proves the minted token is HONOURED — mint and
       // acceptance are different facts, and /accounts is already the call
       // the connect flow makes (auth.connect), so it needs no new scope.
-      health: async ({ connection: connection2, token }, { fetcher, read } = {}) => {
+      health: async ({ connection: connection2, settings, token }, { fetcher, read } = {}) => {
         const request2 = { connectionId: connection2.id };
         try {
           await api2("/accounts", { fetcher, token });
@@ -3554,8 +3570,8 @@ var klaviyo_default2 = {
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
           const body = await api2(next, { fetcher, token });
-          for (const list of (body == null ? void 0 : body.data) || []) {
-            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          for (const list2 of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list2.id, title: ((_a = list2 == null ? void 0 : list2.attributes) == null ? void 0 : _a.name) || list2.id });
           }
           const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
           next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
@@ -3721,13 +3737,14 @@ var klaviyo_default2 = {
     var _a;
     if (!["active", "pending"].includes(data2 == null ? void 0 : data2.status)) return [];
     return [
-      // A connection made before segments were requested is authenticated and
-      // cannot manage them, and no error surfaces anywhere else — the register
-      // runs skip rather than fail.
-      ...canManageSegments(data2 == null ? void 0 : data2.settings) ? [] : [{
-        message: "Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.",
-        title: "Reconnect Klaviyo"
-      }],
+      // THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+      // written by the health check, because a task is quiet: it renders only in
+      // the body of this connection's own page, so a merchant who never opens it
+      // never learns that their segments stopped being published. An error entry
+      // reaches the card and the organization checklist too.
+      //
+      // Deliberately not a status change — see the health hook for why that
+      // would stop the contact sync that still works.
       ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [{
         message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
         title: "Choose a list"
@@ -4134,7 +4151,7 @@ var mailchimp_default2 = {
           "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list2) => ({ id: list2.id, title: (list2 == null ? void 0 : list2.name) || list2.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
         const nextOffset = offset + count;

package/dist/providers.js

@@ -2028,16 +2028,16 @@ var deliveryWrite = ({ at, code: code2, notification, permanent, provider, reaso
   };
 };
 var summariseEvents = (events) => {
-  const list = Array.isArray(events) ? events : [];
-  if (!list.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
+  const list2 = Array.isArray(events) ? events : [];
+  if (!list2.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
   const counts = {};
-  for (const { event } of list) {
+  for (const { event } of list2) {
     const name = event || "unknown";
     counts[name] = (counts[name] || 0) + 1;
   }
   const tally = Object.entries(counts).map(([name, count]) => count + " " + name).join(", ");
-  const refused = list.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
-  const writes = list.map((event) => {
+  const refused = list2.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
+  const writes = list2.map((event) => {
     var _a;
     return deliveryWrite({
       at: event.timestamp ? new Date(event.timestamp * 1e3) : void 0,
@@ -2057,7 +2057,7 @@ var summariseEvents = (events) => {
     });
   }).filter(Boolean);
   return {
-    message: [list.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
+    message: [list2.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
     ...writes.length ? { writes } : { skipped: true }
   };
 };
@@ -2924,6 +2924,14 @@ var klaviyo_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M365.047 327.038H134.954V172.964H365.047L316.856 250.001L365.047 327.038Z" fill="#232121"/>
 </svg>`;
 
+// lib/connections/scopes.js
+var list = (value) => (Array.isArray(value) ? value.flatMap((entry) => String(entry).split(/\s+/)) : String(value ?? "").split(/\s+/)).map((entry) => entry.trim()).filter(Boolean);
+var missingScopes = ({ granted, required }) => {
+  if (granted === null || granted === void 0 || granted === "") return null;
+  const held = new Set(list(granted));
+  return list(required).filter((scope) => !held.has(scope));
+};
+
 // lib/connections/providers/klaviyo.js
 var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) => {
   const response = await fetcher("https://a.klaviyo.com/api" + path, {
@@ -2952,7 +2960,9 @@ var api2 = async (path, { fetcher = fetch, method = "GET", payload, token }) =>
   return response.status === 204 ? null : response.json();
 };
 var segmentName = (title, id) => "Drawbridge: " + title + " (" + String(id).slice(-6) + ")";
-var canManageSegments = (settings) => String((settings == null ? void 0 : settings.scope) || "").split(/\s+/).includes("segments:write");
+var SCOPES = "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write";
+var missing = (settings) => missingScopes({ granted: settings == null ? void 0 : settings.scope, required: SCOPES });
+var canManageSegments = (settings) => !(missing(settings) || []).includes("segments:write");
 var klaviyo_default2 = {
   // OAuth 2.1, and PKCE is REQUIRED rather than recommended: Klaviyo refuses an
   // exchange without a code_verifier matching the challenge the consent
@@ -2996,7 +3006,7 @@ var klaviyo_default2 = {
       // Update and Delete Segment each list `segments:write`
       // (raw.githubusercontent.com/klaviyo/openapi/main/openapi/stable.json,
       // revision 2026-07-15, fetched 2026-09-11).
-      scopes: "accounts:read lists:read lists:write profiles:read profiles:write segments:read segments:write",
+      scopes: SCOPES,
       // EVERY VENDOR URL, in one place. `revoke` used to be a literal inside
       // the disconnect hook — three vendor addresses, two of them declared,
       // which is exactly the kind of split that goes unnoticed.
@@ -3177,8 +3187,14 @@ var klaviyo_default2 = {
         });
         return { ok: Boolean(token) };
       },
-      // Klaviyo scopes are fixed at app level and re-consented, not drifted.
-      scopes: false,
+      // THEY DO DRIFT, and the comment here used to say they could not. Klaviyo
+      // scopes are fixed on the APP, so adding one re-consents every NEW grant
+      // and leaves every EXISTING one exactly as narrow as it was — with no
+      // error, no webhook, and nothing that notices. That is what left grants
+      // authenticating perfectly while silently unable to manage a segment.
+      //
+      // The same slot Shopify answers, so one caller can ask any vendor.
+      scopes: ({ scope }) => missingScopes({ granted: scope, required: SCOPES }),
       // KLAVIYO REQUIRES HTTP BASIC on the token endpoint and rejects the same
       // client_id/client_secret pair as body fields. Everything else about the
       // request is standard, so this is the shared implementation told the one
@@ -3199,9 +3215,9 @@ var klaviyo_default2 = {
       remove: false,
       sync: async ({ context, lead, segments, settings, suppressed, token }, { fetcher } = {}) => {
         var _a, _b, _c, _d, _e;
-        const list = settings == null ? void 0 : settings.list;
+        const list2 = settings == null ? void 0 : settings.list;
         const request2 = { email: ((_b = (_a = lead == null ? void 0 : lead.canonical) == null ? void 0 : _a.email) == null ? void 0 : _b.value) || (lead == null ? void 0 : lead.email) || null, list: (settings == null ? void 0 : settings.list) || null };
-        if (!list) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
+        if (!list2) return { message: "No Klaviyo list is chosen for this connection.", request: request2, skipped: true };
         const email = ((_d = (_c = lead == null ? void 0 : lead.canonical) == null ? void 0 : _c.email) == null ? void 0 : _d.value) || (lead == null ? void 0 : lead.email);
         if (!email) return { message: "That lead has no email address to sync.", request: request2, skipped: true };
         const person = (context == null ? void 0 : context.contact) || null;
@@ -3280,7 +3296,7 @@ var klaviyo_default2 = {
                   }]
                 }
               },
-              relationships: { list: { data: { id: list, type: "list" } } },
+              relationships: { list: { data: { id: list2, type: "list" } } },
               type: "profile-subscription-bulk-create-job"
             }
           },
@@ -3453,7 +3469,7 @@ var klaviyo_default2 = {
       // The one call below proves the minted token is HONOURED — mint and
       // acceptance are different facts, and /accounts is already the call
       // the connect flow makes (auth.connect), so it needs no new scope.
-      health: async ({ connection: connection2, token }, { fetcher, read } = {}) => {
+      health: async ({ connection: connection2, settings, token }, { fetcher, read } = {}) => {
         const request2 = { connectionId: connection2.id };
         try {
           await api2("/accounts", { fetcher, token });
@@ -3505,8 +3521,8 @@ var klaviyo_default2 = {
         let pages = 0;
         while (next && audiences.length < limit && pages < 20) {
           const body = await api2(next, { fetcher, token });
-          for (const list of (body == null ? void 0 : body.data) || []) {
-            audiences.push({ id: list.id, title: ((_a = list == null ? void 0 : list.attributes) == null ? void 0 : _a.name) || list.id });
+          for (const list2 of (body == null ? void 0 : body.data) || []) {
+            audiences.push({ id: list2.id, title: ((_a = list2 == null ? void 0 : list2.attributes) == null ? void 0 : _a.name) || list2.id });
           }
           const link = (_b = body == null ? void 0 : body.links) == null ? void 0 : _b.next;
           next = link ? String(link).replace(/^https:\/\/a\.klaviyo\.com\/api/, "") : null;
@@ -3672,13 +3688,14 @@ var klaviyo_default2 = {
     var _a;
     if (!["active", "pending"].includes(data2 == null ? void 0 : data2.status)) return [];
     return [
-      // A connection made before segments were requested is authenticated and
-      // cannot manage them, and no error surfaces anywhere else — the register
-      // runs skip rather than fail.
-      ...canManageSegments(data2 == null ? void 0 : data2.settings) ? [] : [{
-        message: "Drawbridge now keeps a Klaviyo segment in step with each of your Drawbridge segments. Reconnect Klaviyo to allow it.",
-        title: "Reconnect Klaviyo"
-      }],
+      // THE MISSING SEGMENT SCOPE IS NOT HERE ANY MORE. It is an ERROR entry,
+      // written by the health check, because a task is quiet: it renders only in
+      // the body of this connection's own page, so a merchant who never opens it
+      // never learns that their segments stopped being published. An error entry
+      // reaches the card and the organization checklist too.
+      //
+      // Deliberately not a status change — see the health hook for why that
+      // would stop the contact sync that still works.
       ...((_a = data2 == null ? void 0 : data2.settings) == null ? void 0 : _a.list) ? [] : [{
         message: "Choose which Klaviyo list your contacts should sync into. Until you do, nothing is being synced.",
         title: "Choose a list"
@@ -4085,7 +4102,7 @@ var mailchimp_default2 = {
           "/lists?count=" + count + "&offset=" + offset + "&fields=lists.id,lists.name,total_items",
           { dc: settings == null ? void 0 : settings.dc, fetcher, token }
         );
-        const audiences = ((body == null ? void 0 : body.lists) || []).map((list) => ({ id: list.id, title: (list == null ? void 0 : list.name) || list.id }));
+        const audiences = ((body == null ? void 0 : body.lists) || []).map((list2) => ({ id: list2.id, title: (list2 == null ? void 0 : list2.name) || list2.id }));
         const term = String((search == null ? void 0 : search.value) || "").trim().toLowerCase();
         const items = term ? audiences.filter((entry) => entry.title.toLowerCase().includes(term)) : audiences;
         const nextOffset = offset + count;

package/package.json

@@ -226,5 +226,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.172"
+  "version": "0.0.173"
 }