@drawbridge/drawbridge-utils 0.0.177 → 0.0.178

package/dist/connections/index.js

@@ -501,6 +501,16 @@ var TRIGGERS = Object.freeze({
   "range.ended": Object.freeze({ event: "range.ended", type: "range" }),
   "range.started": Object.freeze({ event: "range.started", type: "range" }),
   "schedule.day": Object.freeze({ event: "day", type: "schedule" }),
+  // THE THREE SHOPIFY TRIGGERS, which were never in this vocabulary because the
+  // four workflows they fire were hand-written in drawbridge-sync's register job
+  // rather than provisioned from the manifest. `webhook` is a fourth trigger
+  // TYPE, and it is the honest name: these fire when the vendor calls us, which
+  // is neither an event Drawbridge raised nor a schedule it keeps.
+  "shopify.order.create": Object.freeze({ event: "shopify.order.create", type: "webhook" }),
+  "shopify.product.update": Object.freeze({ event: "shopify.product.update", type: "webhook" }),
+  // The token audit, dispatched programmatically by the register job when a
+  // store's grant is exchanged or rotated.
+  "shopify.token": Object.freeze({ event: "shopify.token", type: "event" }),
   "schedule.month": Object.freeze({ event: "month", type: "schedule" }),
   "schedule.week": Object.freeze({ event: "week", type: "schedule" }),
   "segment.contact.add": Object.freeze({ event: "segment.contact.add", type: "event" }),
@@ -553,7 +563,7 @@ var OUTCOMES = Object.freeze({
   unimplemented: "unimplemented",
   unsupported: "unsupported"
 });
-var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var STATUSES = Object.freeze(["active", "error", "pending"]);
 var PLATFORM_CREDENTIALS = Object.freeze([
   // Seals a merchant's stored connection settings. The webhook connection is
   // gated on it because its whole credential is a secret WE mint and store, so
@@ -610,10 +620,7 @@ var ERROR_SOURCES = Object.freeze({
   "shopify.register.webhooks": true
 });
 var bearing = (entry) => ERROR_SOURCES[entry == null ? void 0 : entry.source] !== false;
-var assess = ({ errors = [], status = null } = {}) => {
-  if (status === "disconnected") return status;
-  return (errors || []).some(bearing) ? "error" : "active";
-};
+var assess = ({ errors = [] } = {}) => (errors || []).some(bearing) ? "error" : "active";
 var surviving = ({ errors = [], proved = [] } = {}) => (errors || []).filter((entry) => !proved.includes(entry == null ? void 0 : entry.source));
 var isStatus = (status) => STATUSES.includes(status);
 
@@ -805,16 +812,28 @@ var systemSteps = (node, path = []) => Object.entries(node || {}).flatMap(
     return value && typeof value === "object" ? systemSteps(value, [...path, key]) : [];
   }
 );
+var systemWorkflows = (manifest) => {
+  var _a, _b, _c;
+  const grouped = /* @__PURE__ */ new Map();
+  for (const [type, declared] of systemSteps(manifest == null ? void 0 : manifest.steps)) {
+    const trigger = ((_a = declared.workflow) == null ? void 0 : _a.trigger) || declared.trigger;
+    if (!(trigger == null ? void 0 : trigger.event) || !(trigger == null ? void 0 : trigger.type)) continue;
+    const title = ((_b = declared.workflow) == null ? void 0 : _b.key) || declared.key;
+    if (!title) continue;
+    if (!grouped.has(title)) grouped.set(title, { steps: [], title, trigger });
+    grouped.get(title).steps.push({ order: ((_c = declared.workflow) == null ? void 0 : _c.order) ?? 0, type });
+  }
+  return [...grouped.values()].map((workflow) => ({
+    ...workflow,
+    steps: workflow.steps.slice().sort((a, b) => a.order - b.order)
+  }));
+};
 var ensureSystemWorkflows = async ({ connections: registry = connections, controller, doc }) => {
-  var _a, _b;
-  if (!(doc == null ? void 0 : doc.id) || doc.slug === "shopify") return [];
+  if (!(doc == null ? void 0 : doc.id)) return [];
   const manifest = registry[doc.slug];
   if (!manifest) return [];
   const provisioned = [];
-  for (const [type, declared] of systemSteps(manifest.steps)) {
-    if (!((_a = declared.trigger) == null ? void 0 : _a.event) || !((_b = declared.trigger) == null ? void 0 : _b.type)) continue;
-    const title = declared.key;
-    if (!title) continue;
+  for (const { steps: members, title, trigger } of systemWorkflows(manifest)) {
     const existing = await controller.count({
       collection: "workflow",
       query: {
@@ -831,13 +850,10 @@ var ensureSystemWorkflows = async ({ connections: registry = connections, contro
       connection: doc.id,
       organization: doc.organization,
       status: "active",
-      steps: [{
-        settings: {},
-        type
-      }],
+      steps: members.map(({ type }) => ({ settings: {}, type })),
       system: true,
       title,
-      trigger: declared.trigger
+      trigger
     };
     let created;
     try {
@@ -854,6 +870,135 @@ var ensureSystemWorkflows = async ({ connections: registry = connections, contro
   return provisioned;
 };
 
+// lib/connections/reference.js
+var MARKER = {
+  end: "<!-- /generated -->",
+  start: "<!-- generated: drawbridge-utils lib/connections/reference.js \u2014 do not edit by hand -->"
+};
+var slugs = () => Object.keys(connections).sort();
+var slots = (node = HOOKS, path = []) => Object.entries(node).flatMap(
+  ([key, value]) => Array.isArray(value) ? value.map((verb) => [...path, key, verb].join(".")) : slots(value, [...path, key])
+);
+var implemented = (hooks, name) => {
+  const found = name.split(".").reduce(
+    (node, key) => node && typeof node === "object" && Object.hasOwn(node, key) ? node[key] : void 0,
+    hooks
+  );
+  if (typeof found === "function") return "yes";
+  if (found && typeof found === "object") return "elsewhere";
+  return "no";
+};
+var table = (header, rows) => [
+  "| " + header.join(" | ") + " |",
+  "|" + header.map(() => "---").join("|") + "|",
+  ...rows.map((row2) => "| " + row2.join(" | ") + " |")
+].join("\n");
+var matrix = () => {
+  const columns = slugs();
+  return table(
+    ["Hook", ...columns],
+    slots().map((name) => [
+      "`" + name + "`",
+      ...columns.map((slug2) => implemented(connections[slug2].hooks, name))
+    ])
+  );
+};
+var vocabularies = () => {
+  const list2 = (values) => values.map((value) => "`" + value + "`").join(", ");
+  return table(
+    ["Vocabulary", "Values"],
+    [
+      ["`AUTH_KINDS`", list2(AUTH_KINDS)],
+      ["`GROUPS`", list2(GROUPS)],
+      ["`INPUTS`", list2(INPUTS)],
+      ["`STATUSES`", list2(STATUSES)],
+      ["`TRIGGERS`", list2(Object.keys(TRIGGERS).sort())],
+      ["`TRIGGER_TYPES`", list2(TRIGGER_TYPES)]
+    ]
+  );
+};
+var steps = () => {
+  const rows = [];
+  const walk = (node, path, slug2) => {
+    var _a;
+    if (!node || typeof node !== "object") return;
+    for (const [key, value] of Object.entries(node)) {
+      if (typeof value === "function") {
+        let declared;
+        try {
+          declared = value({});
+        } catch {
+          continue;
+        }
+        if (!(declared == null ? void 0 : declared.type)) continue;
+        const fires = ((_a = declared.workflow) == null ? void 0 : _a.trigger) || declared.trigger;
+        rows.push([
+          "`" + declared.type + "`",
+          slug2,
+          declared.hook ? "`" + declared.hook + "`" : "\u2014",
+          declared.queue,
+          declared.system ? "system" : declared.withdrawn ? "withdrawn" : "builder",
+          fires ? "`" + fires.event + "` / `" + fires.type + "`" : (declared.triggers || []).map((t) => "`" + t + "`").join(", ") || "\u2014"
+        ]);
+        continue;
+      }
+      walk(value, [...path, key], slug2);
+    }
+  };
+  for (const slug2 of slugs()) walk(connections[slug2].steps, [], slug2);
+  return table(["Step", "Connection", "Hook", "Queue", "Shape", "Fired by"], rows.sort((a, b) => a[0].localeCompare(b[0]) || a[1].localeCompare(b[1])));
+};
+var workflows = () => table(
+  ["Workflow", "Connection", "Steps", "Trigger"],
+  slugs().flatMap((slug2) => systemWorkflows(connections[slug2]).map((workflow) => [
+    workflow.title,
+    slug2,
+    workflow.steps.map((step) => "`" + step.type + "`").join(" \u2192 "),
+    "`" + workflow.trigger.event + "` / `" + workflow.trigger.type + "`"
+  ]))
+);
+var reference = () => [
+  MARKER.start,
+  "",
+  "### The support matrix",
+  "",
+  "`yes` is a body in this package. `elsewhere` is declared here and implemented in the repo holding the dependencies \u2014 a different fact from `no`, and collapsing the two is how a table tells a reader the package can do something it cannot.",
+  "",
+  matrix(),
+  "",
+  "### The closed vocabularies",
+  "",
+  vocabularies(),
+  "",
+  "### Every step",
+  "",
+  "A step with no hook is real: Shopify's token-audit pair is declared so a stray dispatch lands on a real queue, and is never fired.",
+  "",
+  steps(),
+  "",
+  "### The system workflows a connection is provisioned with",
+  "",
+  "Idempotent on (connection, system, title), so the TITLE is load-bearing \u2014 one that varied by account would provision a second workflow every time it changed.",
+  "",
+  workflows(),
+  "",
+  "### Counts",
+  "",
+  "- **" + slugs().length + "** connections",
+  "- **" + slots().length + "** hook slots",
+  "- **" + Object.keys(STEPS).length + "** step types",
+  "- **" + Object.keys(TRIGGERS).length + "** triggers",
+  "",
+  MARKER.end
+].join("\n");
+var spliced = (document) => {
+  const from = document.indexOf(MARKER.start);
+  const to = document.indexOf(MARKER.end);
+  if (from < 0 || to < 0) return document;
+  return document.slice(0, from) + reference() + document.slice(to + MARKER.end.length);
+};
+var MARKERS = MARKER;
+
 // lib/connections/oauth.js
 import { createHash, randomBytes } from "crypto";
 var credentials = ({ basic, clientId, clientSecret }) => basic ? {
@@ -5822,7 +5967,7 @@ var getAppToken = async ({ clientId, clientSecret, fetcher }) => {
   return fetchAppToken({ clientId, clientSecret, fetcher });
 };
 var toShopGid = (shopId) => String(shopId).startsWith("gid://") ? String(shopId) : "gid://shopify/Shop/" + shopId;
-var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference, revision, shopId, timestamp, value }) => {
+var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference: reference2, revision, shopId, timestamp, value }) => {
   if (!shopId || !eventHandle || !(Number(value) > 0)) {
     throw new Error("sendAppEvent requires shopId, eventHandle, and a positive value");
   }
@@ -5836,8 +5981,8 @@ var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempo
   const body = {
     attributes: {
       value: Number(value),
-      ...reference && {
-        reference: String(reference).slice(0, 128)
+      ...reference2 && {
+        reference: String(reference2).slice(0, 128)
       }
     },
     event_handle: eventHandle,
@@ -7998,6 +8143,12 @@ var shopify_default2 = {
             orderId: String(orderId),
             rate,
             shopId: connection.source.id,
+            // WHICH VENDOR IS BEING CHARGED, so the sender does not have
+            // to assume. queue/usage.js named the slug itself and
+            // defaults to it for anything already queued when this
+            // shipped — an app-store vendor billing through its own meter
+            // enqueues the same job with its own slug.
+            slug: connection.slug,
             // The App Events API returns no event id, so one is generated
             // here — the event handle plus the order id — and sent as the
             // event's `reference`. queue/usage.js stamps the same id onto
@@ -9221,6 +9372,13 @@ var shopify_default2 = {
           key: "Shopify Order Tracking",
           queue: "connection",
           system: true,
+          // THE TRIGGER THE REGISTER JOB HAND-WROTE. It is byte-identical to
+          // the one on every stored workflow, because these documents exist on
+          // prod with thousands of runs behind them and provisioning is
+          // idempotent on (connection, system, title) — a different trigger
+          // here would not be picked up by the existing rows anyway, and a
+          // different TITLE would provision a second workflow for every store.
+          trigger: { event: "shopify.order.create", type: "webhook" },
           type: "step.commerce.order.record"
         })
       },
@@ -9231,6 +9389,15 @@ var shopify_default2 = {
           key: "Shopify Product Sync",
           queue: "connection",
           system: true,
+          // `shopify.product.update`, NOT `product.insert`. The plan named the
+          // latter, and it is the right long-term answer — a Drawbridge product
+          // row appearing should pull the vendor's copy, rather than
+          // stream/product.js branching on the slug and enqueueing a
+          // vendor-named queue. But a workflow carries ONE trigger, this one is
+          // stored on prod against the webhook, and changing a live workflow's
+          // trigger is a data migration. So the declaration matches what exists
+          // and `product.insert` stays a separate, migration-gated change.
+          trigger: { event: "shopify.product.update", type: "webhook" },
           type: "step.commerce.product.sync"
         })
       }
@@ -9252,26 +9419,37 @@ var shopify_default2 = {
           type: "step.connection.health.check"
         })
       },
-      // Audit-only. The "Shopify Token Activity" system workflow lists these
-      // for descriptive grouping, but its audit step docs are written manually
-      // at OAuth time — the workflow is never dispatched. Routing is declared
-      // defensively so that if it ever IS dispatched, the job lands on a real
-      // queue and the handler lookup misses cleanly instead of throwing
-      // "Unknown step type".
+      // THE ONE WORKFLOW THAT CARRIES TWO STEPS, and the shape the plan called
+      // the single genuinely new thing in it.
+      //
+      // Every other system step is its own workflow, titled by its own `key`.
+      // These two are "Shopify Token Activity", one row in the merchant's list
+      // with both steps in it — so they declare `workflow`, which names the
+      // title, the trigger and the ORDER, and the provisioner groups on it.
+      // Without that key the pair could only be provisioned by the hand-written
+      // spec in drawbridge-sync's register job, which is exactly why that spec
+      // outlived every other one.
+      //
+      // AUDIT-ONLY. The step documents are written manually at OAuth time and
+      // the workflow is never dispatched; `queue` is declared defensively so
+      // that if it ever IS, the job lands on a real queue and the handler lookup
+      // misses cleanly rather than throwing "Unknown step type".
       token: {
         exchange: () => ({
           description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
           key: "Shopify Token Exchange",
           queue: "connection",
           system: true,
-          type: "step.connection.token.exchange"
+          type: "step.connection.token.exchange",
+          workflow: { key: "Shopify Token Activity", order: 0, trigger: { event: "shopify.token", type: "event" } }
         }),
         refresh: () => ({
           description: "Records a token rotation. Audit only \u2014 never dispatched.",
           key: "Shopify Token Refresh",
           queue: "connection",
           system: true,
-          type: "step.connection.token.refresh"
+          type: "step.connection.token.refresh",
+          workflow: { key: "Shopify Token Activity", order: 1, trigger: { event: "shopify.token", type: "event" } }
         })
       }
     }
@@ -9727,7 +9905,7 @@ var webhook_default = {
   // The connect prompt only where connecting is not already the card's whole
   // story: a disconnected or errored document renders a Connect action itself,
   // and a task repeating it talks over the button.
-  tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
+  tasks: ({ settings, status } = {}) => status === "error" ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
       message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
@@ -9814,6 +9992,77 @@ var attentive_default3 = {
   }
 };
 
+// lib/connections/icons/brightdata.js
+var brightdata_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#0F58FF"/>
+<circle cx="250" cy="250" r="52" fill="white"/>
+<rect x="234" y="70" width="32" height="96" rx="16" fill="white"/>
+<rect x="234" y="334" width="32" height="96" rx="16" fill="white"/>
+<rect x="70" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="334" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="117" y="140" width="32" height="96" rx="16" transform="rotate(-45 117 140)" fill="white"/>
+<rect x="304" y="327" width="32" height="96" rx="16" transform="rotate(-45 304 327)" fill="white"/>
+<rect x="360" y="117" width="32" height="96" rx="16" transform="rotate(45 360 117)" fill="white"/>
+<rect x="173" y="304" width="32" height="96" rx="16" transform="rotate(45 173 304)" fill="white"/>
+</svg>`;
+
+// lib/connections/vendors/brightdata.js
+var brightdata_default2 = {
+  fields: [
+    {
+      credential: "BRIGHTDATA_BROWSER_URI",
+      input: "password",
+      key: "browserUri",
+      // A wss:// endpoint with the account's user and password in its
+      // authority, which is why it is a password field rather than a url one:
+      // the whole string is the credential.
+      label: "Scraping Browser endpoint",
+      message: "The wss:// Scraping Browser endpoint, carrying its own credentials. Used to render pages that need a real browser.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_API_KEY",
+      input: "password",
+      key: "unlockerApiKey",
+      label: "Web Unlocker API key",
+      // NO EXPIRY FIELD, and that is a decision rather than an omission. Bright
+      // Data offers an `Unlimited` expiry and recommends against it; Drawbridge
+      // takes the unlimited key deliberately, because there is no way to rotate
+      // this programmatically and a date nothing can act on is a date that only
+      // surfaces after it has already broken scraping. If a fixed expiry is ever
+      // taken instead, the field to add is a stored date and a warning ahead of
+      // it — not a rotation, which the vendor cannot support.
+      message: "Bright Data account settings \u2192 API keys. Taken with an unlimited expiry: their API offers no way to rotate a key, so a dated one can only ever break scraping silently.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_ZONE",
+      input: "text",
+      key: "unlockerZone",
+      label: "Web Unlocker zone",
+      // Not secret — a zone is a label on the account, and it is shown rather
+      // than redacted so an operator can confirm which one is in use without
+      // clearing the field to read it.
+      message: "The zone name the Unlocker requests run against.",
+      required: true
+    }
+  ],
+  icon: brightdata_default,
+  name: "Bright Data",
+  slug: "brightdata",
+  // WHERE THE FACTS CAME FROM, read 2026-09-16.
+  urls: {
+    api: "https://docs.brightdata.com/api-reference/authentication",
+    dashboard: "https://brightdata.com/cp/setting/users",
+    // Bright Data has no scope model — a key carries the account's own access —
+    // so there is nothing to link. `false` is the recorded answer rather than a
+    // missing key.
+    scopes: false
+  }
+};
+
 // lib/connections/vendors/hubspot.js
 var hubspot_default2 = {
   // WHAT AN ADMIN TYPES on the provider screen. `credential` names the env var a
@@ -10127,7 +10376,7 @@ var twilio_default2 = {
 
 // lib/connections/index.js
 var QUEUES = ["connection", "notification", "segment", "webhook"];
-var implemented = (hooks, path) => {
+var implemented2 = (hooks, path) => {
   const hook = path.split(".").reduce((node, key) => node == null ? void 0 : node[key], hooks);
   return typeof hook === "function" || !!hook && typeof hook === "object";
 };
@@ -10189,7 +10438,7 @@ var checkIcon = (owner, icon) => {
   }
 };
 var vendors = Object.freeze(Object.fromEntries(
-  [attentive_default3, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
+  [attentive_default3, brightdata_default2, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
 ));
 var buildVendor = (vendor) => {
   if (!(vendor == null ? void 0 : vendor.slug)) throw new Error("A vendor needs a slug");
@@ -10216,7 +10465,7 @@ for (const [slug2, vendor] of Object.entries(vendors)) {
   buildVendor(vendor);
 }
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (manifest == null ? void 0 : manifest.private) throw new Error(manifest.slug + " declares private \u2014 that is feature : false now");
@@ -10245,7 +10494,7 @@ var build = (manifest) => {
       if (!field.hook.startsWith("resources.")) {
         throw new Error(manifest.slug + "." + field.key + " reads from " + field.hook + " \u2014 a picker may only read resources.*");
       }
-      if (!implemented(manifest.hooks, field.hook)) {
+      if (!implemented2(manifest.hooks, field.hook)) {
         throw new Error(manifest.slug + "." + field.key + " reads " + field.hook + ", which this vendor does not implement");
       }
     }
@@ -10284,7 +10533,7 @@ var build = (manifest) => {
   }
   let callback = null;
   const type = kinds[0];
-  if (["install", "oauth"].includes(type) && !implemented(manifest.hooks, "lifecycle.health")) {
+  if (["install", "oauth"].includes(type) && !implemented2(manifest.hooks, "lifecycle.health")) {
     throw new Error(
       manifest.slug + " is " + type + " and must implement hooks.lifecycle.health \u2014 a credential somebody else can revoke, expire or narrow tells us nothing when it dies"
     );
@@ -10313,10 +10562,10 @@ var build = (manifest) => {
     }
     callback = "/api/connection/" + manifest.slug + "/callback";
   }
-  if (implemented(manifest.hooks, "inbound.event") && typeof ((_n = (_m = manifest.hooks) == null ? void 0 : _m.inbound) == null ? void 0 : _n.event) !== "function" && !((_r = (_q = (_p = (_o = manifest.hooks) == null ? void 0 : _o.inbound) == null ? void 0 : _p.config) == null ? void 0 : _q.headers) == null ? void 0 : _r.event)) {
+  if (implemented2(manifest.hooks, "inbound.event") && typeof ((_n = (_m = manifest.hooks) == null ? void 0 : _m.inbound) == null ? void 0 : _n.event) !== "function" && !((_r = (_q = (_p = (_o = manifest.hooks) == null ? void 0 : _o.inbound) == null ? void 0 : _p.config) == null ? void 0 : _q.headers) == null ? void 0 : _r.event)) {
     throw new Error(manifest.slug + " implements inbound.event but declares no inbound.headers.event");
   }
-  if (implemented(manifest.hooks, "inbound.verify") && !((_v = (_u = (_t = (_s = manifest.hooks) == null ? void 0 : _s.inbound) == null ? void 0 : _t.config) == null ? void 0 : _u.headers) == null ? void 0 : _v.signature)) {
+  if (implemented2(manifest.hooks, "inbound.verify") && !((_v = (_u = (_t = (_s = manifest.hooks) == null ? void 0 : _s.inbound) == null ? void 0 : _t.config) == null ? void 0 : _u.headers) == null ? void 0 : _v.signature)) {
     throw new Error(manifest.slug + " implements inbound.verify but declares no inbound.headers.signature");
   }
   if (!Array.isArray((_w = manifest == null ? void 0 : manifest.content) == null ? void 0 : _w.guide) || !manifest.content.guide.length) {
@@ -10327,7 +10576,7 @@ var build = (manifest) => {
     if (Array.isArray(node)) {
       for (const verb of node) {
         const hook = declared2 == null ? void 0 : declared2[verb];
-        if (hook !== false && !implemented({ [verb]: hook }, verb)) {
+        if (hook !== false && !implemented2({ [verb]: hook }, verb)) {
           throw new Error(manifest.slug + " must answer hooks." + [...path, verb].join(".") + " \u2014 false, a function, or {} if another repo implements it");
         }
       }
@@ -10473,7 +10722,7 @@ var build = (manifest) => {
     if (!QUEUES.includes(declared2 == null ? void 0 : declared2.queue)) {
       throw new Error(manifest.slug + " step " + type2 + " needs a queue \u2014 one of " + QUEUES.join(", "));
     }
-    if (declared2.hook && !implemented(manifest.hooks, declared2.hook)) {
+    if (declared2.hook && !implemented2(manifest.hooks, declared2.hook)) {
       throw new Error(manifest.slug + " step " + type2 + " points at hook " + declared2.hook + ", which this vendor does not implement");
     }
     for (const trigger of declared2.triggers || []) {
@@ -10482,11 +10731,22 @@ var build = (manifest) => {
         manifest.slug + " step " + type2 + " may be triggered by " + trigger + ", which is not a trigger \u2014 one of " + Object.keys(TRIGGERS).join(", ")
       );
     }
-    if (declared2.trigger) {
-      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === declared2.trigger.event && TRIGGERS[key].type === declared2.trigger.type)];
+    if (declared2.workflow) {
+      if (!declared2.workflow.key) {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no key \u2014 the title several steps share");
+      }
+      if (typeof declared2.workflow.order !== "number") {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no order \u2014 two steps in one row need a sequence");
+      }
+      if (declared2.trigger) {
+        throw new Error(manifest.slug + " step " + type2 + " declares BOTH a trigger and a workflow \u2014 the workflow carries the trigger for every step in it");
+      }
+    }
+    for (const candidate of [declared2.trigger, (_y = declared2.workflow) == null ? void 0 : _y.trigger].filter(Boolean)) {
+      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === candidate.event && TRIGGERS[key].type === candidate.type)];
       if (!known2) {
         throw new Error(
-          manifest.slug + " step " + type2 + " declares trigger { event : " + declared2.trigger.event + ", type : " + declared2.trigger.type + " }, which nothing dispatches"
+          manifest.slug + " step " + type2 + " declares trigger { event : " + candidate.event + ", type : " + candidate.type + " }, which nothing dispatches"
         );
       }
     }
@@ -10556,9 +10816,10 @@ var publicSettingsBySlug = Object.fromEntries(
 var connectionSteps = (env = {}) => Object.entries(availableConnections(env)).flatMap(
   ([slug2, manifest]) => leaves(manifest.steps).map(([, step]) => ({ ...step({}), slug: slug2 }))
 );
+var implementsHook = (hooks, name) => implemented2(hooks, name);
 var hookSupport = (name) => ({
-  no: Object.keys(connections).filter((slug2) => !implemented(connections[slug2].hooks, name)),
-  yes: Object.keys(connections).filter((slug2) => implemented(connections[slug2].hooks, name))
+  no: Object.keys(connections).filter((slug2) => !implemented2(connections[slug2].hooks, name)),
+  yes: Object.keys(connections).filter((slug2) => implemented2(connections[slug2].hooks, name))
 });
 var connectFields = (slug2) => {
   var _a;
@@ -10714,6 +10975,7 @@ export {
   HOOK_PROPS,
   HOOK_SLOT_PROPS,
   INPUTS,
+  MARKERS,
   OAUTH_ENDPOINTS,
   OAUTH_FIELDS,
   OUTCOMES,
@@ -10741,6 +11003,7 @@ export {
   effectsOf,
   ensureSystemWorkflows,
   hookSupport,
+  implementsHook,
   isStale,
   isStatus,
   mergeSettings,
@@ -10751,14 +11014,17 @@ export {
   publicSettingsBySlug,
   reconcileConnectionScopes,
   redactSettings,
+  reference,
   resolveConnection,
   runHook,
   scopesMessage,
+  spliced,
   stepLabels,
   stepQueues,
   stepRoutes,
   surviving,
   systemSteps,
+  systemWorkflows,
   tokenSettings,
   vendors
 };