@drawbridge/drawbridge-utils 0.0.177 → 0.0.178

package/dist/plans.cjs

@@ -486,6 +486,16 @@ var TRIGGERS = Object.freeze({
   "range.ended": Object.freeze({ event: "range.ended", type: "range" }),
   "range.started": Object.freeze({ event: "range.started", type: "range" }),
   "schedule.day": Object.freeze({ event: "day", type: "schedule" }),
+  // THE THREE SHOPIFY TRIGGERS, which were never in this vocabulary because the
+  // four workflows they fire were hand-written in drawbridge-sync's register job
+  // rather than provisioned from the manifest. `webhook` is a fourth trigger
+  // TYPE, and it is the honest name: these fire when the vendor calls us, which
+  // is neither an event Drawbridge raised nor a schedule it keeps.
+  "shopify.order.create": Object.freeze({ event: "shopify.order.create", type: "webhook" }),
+  "shopify.product.update": Object.freeze({ event: "shopify.product.update", type: "webhook" }),
+  // The token audit, dispatched programmatically by the register job when a
+  // store's grant is exchanged or rotated.
+  "shopify.token": Object.freeze({ event: "shopify.token", type: "event" }),
   "schedule.month": Object.freeze({ event: "month", type: "schedule" }),
   "schedule.week": Object.freeze({ event: "week", type: "schedule" }),
   "segment.contact.add": Object.freeze({ event: "segment.contact.add", type: "event" }),
@@ -538,7 +548,7 @@ var OUTCOMES = Object.freeze({
   unimplemented: "unimplemented",
   unsupported: "unsupported"
 });
-var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var STATUSES = Object.freeze(["active", "error", "pending"]);
 var PLATFORM_CREDENTIALS = Object.freeze([
   // Seals a merchant's stored connection settings. The webhook connection is
   // gated on it because its whole credential is a secret WE mint and store, so
@@ -5519,7 +5529,7 @@ var getAppToken = async ({ clientId, clientSecret, fetcher }) => {
   return fetchAppToken({ clientId, clientSecret, fetcher });
 };
 var toShopGid = (shopId) => String(shopId).startsWith("gid://") ? String(shopId) : "gid://shopify/Shop/" + shopId;
-var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference, revision, shopId, timestamp, value }) => {
+var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference: reference2, revision, shopId, timestamp, value }) => {
   if (!shopId || !eventHandle || !(Number(value) > 0)) {
     throw new Error("sendAppEvent requires shopId, eventHandle, and a positive value");
   }
@@ -5533,8 +5543,8 @@ var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempo
   const body = {
     attributes: {
       value: Number(value),
-      ...reference && {
-        reference: String(reference).slice(0, 128)
+      ...reference2 && {
+        reference: String(reference2).slice(0, 128)
       }
     },
     event_handle: eventHandle,
@@ -7695,6 +7705,12 @@ var shopify_default2 = {
             orderId: String(orderId),
             rate,
             shopId: connection2.source.id,
+            // WHICH VENDOR IS BEING CHARGED, so the sender does not have
+            // to assume. queue/usage.js named the slug itself and
+            // defaults to it for anything already queued when this
+            // shipped — an app-store vendor billing through its own meter
+            // enqueues the same job with its own slug.
+            slug: connection2.slug,
             // The App Events API returns no event id, so one is generated
             // here — the event handle plus the order id — and sent as the
             // event's `reference`. queue/usage.js stamps the same id onto
@@ -8918,6 +8934,13 @@ var shopify_default2 = {
           key: "Shopify Order Tracking",
           queue: "connection",
           system: true,
+          // THE TRIGGER THE REGISTER JOB HAND-WROTE. It is byte-identical to
+          // the one on every stored workflow, because these documents exist on
+          // prod with thousands of runs behind them and provisioning is
+          // idempotent on (connection, system, title) — a different trigger
+          // here would not be picked up by the existing rows anyway, and a
+          // different TITLE would provision a second workflow for every store.
+          trigger: { event: "shopify.order.create", type: "webhook" },
           type: "step.commerce.order.record"
         })
       },
@@ -8928,6 +8951,15 @@ var shopify_default2 = {
           key: "Shopify Product Sync",
           queue: "connection",
           system: true,
+          // `shopify.product.update`, NOT `product.insert`. The plan named the
+          // latter, and it is the right long-term answer — a Drawbridge product
+          // row appearing should pull the vendor's copy, rather than
+          // stream/product.js branching on the slug and enqueueing a
+          // vendor-named queue. But a workflow carries ONE trigger, this one is
+          // stored on prod against the webhook, and changing a live workflow's
+          // trigger is a data migration. So the declaration matches what exists
+          // and `product.insert` stays a separate, migration-gated change.
+          trigger: { event: "shopify.product.update", type: "webhook" },
           type: "step.commerce.product.sync"
         })
       }
@@ -8949,26 +8981,37 @@ var shopify_default2 = {
           type: "step.connection.health.check"
         })
       },
-      // Audit-only. The "Shopify Token Activity" system workflow lists these
-      // for descriptive grouping, but its audit step docs are written manually
-      // at OAuth time — the workflow is never dispatched. Routing is declared
-      // defensively so that if it ever IS dispatched, the job lands on a real
-      // queue and the handler lookup misses cleanly instead of throwing
-      // "Unknown step type".
+      // THE ONE WORKFLOW THAT CARRIES TWO STEPS, and the shape the plan called
+      // the single genuinely new thing in it.
+      //
+      // Every other system step is its own workflow, titled by its own `key`.
+      // These two are "Shopify Token Activity", one row in the merchant's list
+      // with both steps in it — so they declare `workflow`, which names the
+      // title, the trigger and the ORDER, and the provisioner groups on it.
+      // Without that key the pair could only be provisioned by the hand-written
+      // spec in drawbridge-sync's register job, which is exactly why that spec
+      // outlived every other one.
+      //
+      // AUDIT-ONLY. The step documents are written manually at OAuth time and
+      // the workflow is never dispatched; `queue` is declared defensively so
+      // that if it ever IS, the job lands on a real queue and the handler lookup
+      // misses cleanly rather than throwing "Unknown step type".
       token: {
         exchange: () => ({
           description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
           key: "Shopify Token Exchange",
           queue: "connection",
           system: true,
-          type: "step.connection.token.exchange"
+          type: "step.connection.token.exchange",
+          workflow: { key: "Shopify Token Activity", order: 0, trigger: { event: "shopify.token", type: "event" } }
         }),
         refresh: () => ({
           description: "Records a token rotation. Audit only \u2014 never dispatched.",
           key: "Shopify Token Refresh",
           queue: "connection",
           system: true,
-          type: "step.connection.token.refresh"
+          type: "step.connection.token.refresh",
+          workflow: { key: "Shopify Token Activity", order: 1, trigger: { event: "shopify.token", type: "event" } }
         })
       }
     }
@@ -9424,7 +9467,7 @@ var webhook_default = {
   // The connect prompt only where connecting is not already the card's whole
   // story: a disconnected or errored document renders a Connect action itself,
   // and a task repeating it talks over the button.
-  tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
+  tasks: ({ settings, status } = {}) => status === "error" ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
       message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
@@ -9511,6 +9554,77 @@ var attentive_default3 = {
   }
 };
 
+// lib/connections/icons/brightdata.js
+var brightdata_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#0F58FF"/>
+<circle cx="250" cy="250" r="52" fill="white"/>
+<rect x="234" y="70" width="32" height="96" rx="16" fill="white"/>
+<rect x="234" y="334" width="32" height="96" rx="16" fill="white"/>
+<rect x="70" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="334" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="117" y="140" width="32" height="96" rx="16" transform="rotate(-45 117 140)" fill="white"/>
+<rect x="304" y="327" width="32" height="96" rx="16" transform="rotate(-45 304 327)" fill="white"/>
+<rect x="360" y="117" width="32" height="96" rx="16" transform="rotate(45 360 117)" fill="white"/>
+<rect x="173" y="304" width="32" height="96" rx="16" transform="rotate(45 173 304)" fill="white"/>
+</svg>`;
+
+// lib/connections/vendors/brightdata.js
+var brightdata_default2 = {
+  fields: [
+    {
+      credential: "BRIGHTDATA_BROWSER_URI",
+      input: "password",
+      key: "browserUri",
+      // A wss:// endpoint with the account's user and password in its
+      // authority, which is why it is a password field rather than a url one:
+      // the whole string is the credential.
+      label: "Scraping Browser endpoint",
+      message: "The wss:// Scraping Browser endpoint, carrying its own credentials. Used to render pages that need a real browser.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_API_KEY",
+      input: "password",
+      key: "unlockerApiKey",
+      label: "Web Unlocker API key",
+      // NO EXPIRY FIELD, and that is a decision rather than an omission. Bright
+      // Data offers an `Unlimited` expiry and recommends against it; Drawbridge
+      // takes the unlimited key deliberately, because there is no way to rotate
+      // this programmatically and a date nothing can act on is a date that only
+      // surfaces after it has already broken scraping. If a fixed expiry is ever
+      // taken instead, the field to add is a stored date and a warning ahead of
+      // it — not a rotation, which the vendor cannot support.
+      message: "Bright Data account settings \u2192 API keys. Taken with an unlimited expiry: their API offers no way to rotate a key, so a dated one can only ever break scraping silently.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_ZONE",
+      input: "text",
+      key: "unlockerZone",
+      label: "Web Unlocker zone",
+      // Not secret — a zone is a label on the account, and it is shown rather
+      // than redacted so an operator can confirm which one is in use without
+      // clearing the field to read it.
+      message: "The zone name the Unlocker requests run against.",
+      required: true
+    }
+  ],
+  icon: brightdata_default,
+  name: "Bright Data",
+  slug: "brightdata",
+  // WHERE THE FACTS CAME FROM, read 2026-09-16.
+  urls: {
+    api: "https://docs.brightdata.com/api-reference/authentication",
+    dashboard: "https://brightdata.com/cp/setting/users",
+    // Bright Data has no scope model — a key carries the account's own access —
+    // so there is nothing to link. `false` is the recorded answer rather than a
+    // missing key.
+    scopes: false
+  }
+};
+
 // lib/connections/vendors/hubspot.js
 var hubspot_default2 = {
   // WHAT AN ADMIN TYPES on the provider screen. `credential` names the env var a
@@ -9886,7 +10000,7 @@ var checkIcon = (owner, icon) => {
   }
 };
 var vendors = Object.freeze(Object.fromEntries(
-  [attentive_default3, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
+  [attentive_default3, brightdata_default2, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
 ));
 var buildVendor = (vendor) => {
   if (!(vendor == null ? void 0 : vendor.slug)) throw new Error("A vendor needs a slug");
@@ -9913,7 +10027,7 @@ for (const [slug2, vendor] of Object.entries(vendors)) {
   buildVendor(vendor);
 }
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (manifest == null ? void 0 : manifest.private) throw new Error(manifest.slug + " declares private \u2014 that is feature : false now");
@@ -10179,11 +10293,22 @@ var build = (manifest) => {
         manifest.slug + " step " + type2 + " may be triggered by " + trigger + ", which is not a trigger \u2014 one of " + Object.keys(TRIGGERS).join(", ")
       );
     }
-    if (declared2.trigger) {
-      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === declared2.trigger.event && TRIGGERS[key].type === declared2.trigger.type)];
+    if (declared2.workflow) {
+      if (!declared2.workflow.key) {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no key \u2014 the title several steps share");
+      }
+      if (typeof declared2.workflow.order !== "number") {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no order \u2014 two steps in one row need a sequence");
+      }
+      if (declared2.trigger) {
+        throw new Error(manifest.slug + " step " + type2 + " declares BOTH a trigger and a workflow \u2014 the workflow carries the trigger for every step in it");
+      }
+    }
+    for (const candidate of [declared2.trigger, (_y = declared2.workflow) == null ? void 0 : _y.trigger].filter(Boolean)) {
+      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === candidate.event && TRIGGERS[key].type === candidate.type)];
       if (!known2) {
         throw new Error(
-          manifest.slug + " step " + type2 + " declares trigger { event : " + declared2.trigger.event + ", type : " + declared2.trigger.type + " }, which nothing dispatches"
+          manifest.slug + " step " + type2 + " declares trigger { event : " + candidate.event + ", type : " + candidate.type + " }, which nothing dispatches"
         );
       }
     }

package/dist/plans.d.cts

@@ -1,6 +1,6 @@
 import { organization, page, fields, field, connection } from './features.cjs';
 import { infinite, gigabyte } from './index.cjs';
-import './index-C59xHago.cjs';
+import './index-C2rxasGZ.cjs';
 import './usage.cjs';
 import './encrypt.cjs';
 import 'crypto';

package/dist/plans.d.ts

@@ -1,6 +1,6 @@
 import { organization, page, fields, field, connection } from './features.js';
 import { infinite, gigabyte } from './index.js';
-import './index-B546oDNo.js';
+import './index-DOYCXtd7.js';
 import './usage.js';
 import './encrypt.js';
 import 'crypto';

package/dist/plans.js

@@ -453,6 +453,16 @@ var TRIGGERS = Object.freeze({
   "range.ended": Object.freeze({ event: "range.ended", type: "range" }),
   "range.started": Object.freeze({ event: "range.started", type: "range" }),
   "schedule.day": Object.freeze({ event: "day", type: "schedule" }),
+  // THE THREE SHOPIFY TRIGGERS, which were never in this vocabulary because the
+  // four workflows they fire were hand-written in drawbridge-sync's register job
+  // rather than provisioned from the manifest. `webhook` is a fourth trigger
+  // TYPE, and it is the honest name: these fire when the vendor calls us, which
+  // is neither an event Drawbridge raised nor a schedule it keeps.
+  "shopify.order.create": Object.freeze({ event: "shopify.order.create", type: "webhook" }),
+  "shopify.product.update": Object.freeze({ event: "shopify.product.update", type: "webhook" }),
+  // The token audit, dispatched programmatically by the register job when a
+  // store's grant is exchanged or rotated.
+  "shopify.token": Object.freeze({ event: "shopify.token", type: "event" }),
   "schedule.month": Object.freeze({ event: "month", type: "schedule" }),
   "schedule.week": Object.freeze({ event: "week", type: "schedule" }),
   "segment.contact.add": Object.freeze({ event: "segment.contact.add", type: "event" }),
@@ -505,7 +515,7 @@ var OUTCOMES = Object.freeze({
   unimplemented: "unimplemented",
   unsupported: "unsupported"
 });
-var STATUSES = Object.freeze(["active", "disconnected", "error", "pending"]);
+var STATUSES = Object.freeze(["active", "error", "pending"]);
 var PLATFORM_CREDENTIALS = Object.freeze([
   // Seals a merchant's stored connection settings. The webhook connection is
   // gated on it because its whole credential is a secret WE mint and store, so
@@ -5486,7 +5496,7 @@ var getAppToken = async ({ clientId, clientSecret, fetcher }) => {
   return fetchAppToken({ clientId, clientSecret, fetcher });
 };
 var toShopGid = (shopId) => String(shopId).startsWith("gid://") ? String(shopId) : "gid://shopify/Shop/" + shopId;
-var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference, revision, shopId, timestamp, value }) => {
+var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempotencyKey, reference: reference2, revision, shopId, timestamp, value }) => {
   if (!shopId || !eventHandle || !(Number(value) > 0)) {
     throw new Error("sendAppEvent requires shopId, eventHandle, and a positive value");
   }
@@ -5500,8 +5510,8 @@ var sendAppEvent = async ({ fetcher, clientId, clientSecret, eventHandle, idempo
   const body = {
     attributes: {
       value: Number(value),
-      ...reference && {
-        reference: String(reference).slice(0, 128)
+      ...reference2 && {
+        reference: String(reference2).slice(0, 128)
       }
     },
     event_handle: eventHandle,
@@ -7662,6 +7672,12 @@ var shopify_default2 = {
             orderId: String(orderId),
             rate,
             shopId: connection2.source.id,
+            // WHICH VENDOR IS BEING CHARGED, so the sender does not have
+            // to assume. queue/usage.js named the slug itself and
+            // defaults to it for anything already queued when this
+            // shipped — an app-store vendor billing through its own meter
+            // enqueues the same job with its own slug.
+            slug: connection2.slug,
             // The App Events API returns no event id, so one is generated
             // here — the event handle plus the order id — and sent as the
             // event's `reference`. queue/usage.js stamps the same id onto
@@ -8885,6 +8901,13 @@ var shopify_default2 = {
           key: "Shopify Order Tracking",
           queue: "connection",
           system: true,
+          // THE TRIGGER THE REGISTER JOB HAND-WROTE. It is byte-identical to
+          // the one on every stored workflow, because these documents exist on
+          // prod with thousands of runs behind them and provisioning is
+          // idempotent on (connection, system, title) — a different trigger
+          // here would not be picked up by the existing rows anyway, and a
+          // different TITLE would provision a second workflow for every store.
+          trigger: { event: "shopify.order.create", type: "webhook" },
           type: "step.commerce.order.record"
         })
       },
@@ -8895,6 +8918,15 @@ var shopify_default2 = {
           key: "Shopify Product Sync",
           queue: "connection",
           system: true,
+          // `shopify.product.update`, NOT `product.insert`. The plan named the
+          // latter, and it is the right long-term answer — a Drawbridge product
+          // row appearing should pull the vendor's copy, rather than
+          // stream/product.js branching on the slug and enqueueing a
+          // vendor-named queue. But a workflow carries ONE trigger, this one is
+          // stored on prod against the webhook, and changing a live workflow's
+          // trigger is a data migration. So the declaration matches what exists
+          // and `product.insert` stays a separate, migration-gated change.
+          trigger: { event: "shopify.product.update", type: "webhook" },
           type: "step.commerce.product.sync"
         })
       }
@@ -8916,26 +8948,37 @@ var shopify_default2 = {
           type: "step.connection.health.check"
         })
       },
-      // Audit-only. The "Shopify Token Activity" system workflow lists these
-      // for descriptive grouping, but its audit step docs are written manually
-      // at OAuth time — the workflow is never dispatched. Routing is declared
-      // defensively so that if it ever IS dispatched, the job lands on a real
-      // queue and the handler lookup misses cleanly instead of throwing
-      // "Unknown step type".
+      // THE ONE WORKFLOW THAT CARRIES TWO STEPS, and the shape the plan called
+      // the single genuinely new thing in it.
+      //
+      // Every other system step is its own workflow, titled by its own `key`.
+      // These two are "Shopify Token Activity", one row in the merchant's list
+      // with both steps in it — so they declare `workflow`, which names the
+      // title, the trigger and the ORDER, and the provisioner groups on it.
+      // Without that key the pair could only be provisioned by the hand-written
+      // spec in drawbridge-sync's register job, which is exactly why that spec
+      // outlived every other one.
+      //
+      // AUDIT-ONLY. The step documents are written manually at OAuth time and
+      // the workflow is never dispatched; `queue` is declared defensively so
+      // that if it ever IS, the job lands on a real queue and the handler lookup
+      // misses cleanly rather than throwing "Unknown step type".
       token: {
         exchange: () => ({
           description: "Records the token exchange that completed an install. Audit only \u2014 never dispatched.",
           key: "Shopify Token Exchange",
           queue: "connection",
           system: true,
-          type: "step.connection.token.exchange"
+          type: "step.connection.token.exchange",
+          workflow: { key: "Shopify Token Activity", order: 0, trigger: { event: "shopify.token", type: "event" } }
         }),
         refresh: () => ({
           description: "Records a token rotation. Audit only \u2014 never dispatched.",
           key: "Shopify Token Refresh",
           queue: "connection",
           system: true,
-          type: "step.connection.token.refresh"
+          type: "step.connection.token.refresh",
+          workflow: { key: "Shopify Token Activity", order: 1, trigger: { event: "shopify.token", type: "event" } }
         })
       }
     }
@@ -9391,7 +9434,7 @@ var webhook_default = {
   // The connect prompt only where connecting is not already the card's whole
   // story: a disconnected or errored document renders a Connect action itself,
   // and a task repeating it talks over the button.
-  tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
+  tasks: ({ settings, status } = {}) => status === "error" ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
       message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
@@ -9478,6 +9521,77 @@ var attentive_default3 = {
   }
 };
 
+// lib/connections/icons/brightdata.js
+var brightdata_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="500" height="500" fill="#0F58FF"/>
+<circle cx="250" cy="250" r="52" fill="white"/>
+<rect x="234" y="70" width="32" height="96" rx="16" fill="white"/>
+<rect x="234" y="334" width="32" height="96" rx="16" fill="white"/>
+<rect x="70" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="334" y="234" width="96" height="32" rx="16" fill="white"/>
+<rect x="117" y="140" width="32" height="96" rx="16" transform="rotate(-45 117 140)" fill="white"/>
+<rect x="304" y="327" width="32" height="96" rx="16" transform="rotate(-45 304 327)" fill="white"/>
+<rect x="360" y="117" width="32" height="96" rx="16" transform="rotate(45 360 117)" fill="white"/>
+<rect x="173" y="304" width="32" height="96" rx="16" transform="rotate(45 173 304)" fill="white"/>
+</svg>`;
+
+// lib/connections/vendors/brightdata.js
+var brightdata_default2 = {
+  fields: [
+    {
+      credential: "BRIGHTDATA_BROWSER_URI",
+      input: "password",
+      key: "browserUri",
+      // A wss:// endpoint with the account's user and password in its
+      // authority, which is why it is a password field rather than a url one:
+      // the whole string is the credential.
+      label: "Scraping Browser endpoint",
+      message: "The wss:// Scraping Browser endpoint, carrying its own credentials. Used to render pages that need a real browser.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_API_KEY",
+      input: "password",
+      key: "unlockerApiKey",
+      label: "Web Unlocker API key",
+      // NO EXPIRY FIELD, and that is a decision rather than an omission. Bright
+      // Data offers an `Unlimited` expiry and recommends against it; Drawbridge
+      // takes the unlimited key deliberately, because there is no way to rotate
+      // this programmatically and a date nothing can act on is a date that only
+      // surfaces after it has already broken scraping. If a fixed expiry is ever
+      // taken instead, the field to add is a stored date and a warning ahead of
+      // it — not a rotation, which the vendor cannot support.
+      message: "Bright Data account settings \u2192 API keys. Taken with an unlimited expiry: their API offers no way to rotate a key, so a dated one can only ever break scraping silently.",
+      redact: true,
+      required: true
+    },
+    {
+      credential: "BRIGHTDATA_UNLOCKER_ZONE",
+      input: "text",
+      key: "unlockerZone",
+      label: "Web Unlocker zone",
+      // Not secret — a zone is a label on the account, and it is shown rather
+      // than redacted so an operator can confirm which one is in use without
+      // clearing the field to read it.
+      message: "The zone name the Unlocker requests run against.",
+      required: true
+    }
+  ],
+  icon: brightdata_default,
+  name: "Bright Data",
+  slug: "brightdata",
+  // WHERE THE FACTS CAME FROM, read 2026-09-16.
+  urls: {
+    api: "https://docs.brightdata.com/api-reference/authentication",
+    dashboard: "https://brightdata.com/cp/setting/users",
+    // Bright Data has no scope model — a key carries the account's own access —
+    // so there is nothing to link. `false` is the recorded answer rather than a
+    // missing key.
+    scopes: false
+  }
+};
+
 // lib/connections/vendors/hubspot.js
 var hubspot_default2 = {
   // WHAT AN ADMIN TYPES on the provider screen. `credential` names the env var a
@@ -9853,7 +9967,7 @@ var checkIcon = (owner, icon) => {
   }
 };
 var vendors = Object.freeze(Object.fromEntries(
-  [attentive_default3, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
+  [attentive_default3, brightdata_default2, hubspot_default2, klaviyo_default3, mailchimp_default3, sendgrid_default2, shopify_default3, twilio_default2].map((vendor) => [vendor.slug, vendor])
 ));
 var buildVendor = (vendor) => {
   if (!(vendor == null ? void 0 : vendor.slug)) throw new Error("A vendor needs a slug");
@@ -9880,7 +9994,7 @@ for (const [slug2, vendor] of Object.entries(vendors)) {
   buildVendor(vendor);
 }
 var build = (manifest) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
   if (!(manifest == null ? void 0 : manifest.slug)) throw new Error("A connection needs a slug");
   if (!(manifest == null ? void 0 : manifest.title)) throw new Error(manifest.slug + " needs a title");
   if (manifest == null ? void 0 : manifest.private) throw new Error(manifest.slug + " declares private \u2014 that is feature : false now");
@@ -10146,11 +10260,22 @@ var build = (manifest) => {
         manifest.slug + " step " + type2 + " may be triggered by " + trigger + ", which is not a trigger \u2014 one of " + Object.keys(TRIGGERS).join(", ")
       );
     }
-    if (declared2.trigger) {
-      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === declared2.trigger.event && TRIGGERS[key].type === declared2.trigger.type)];
+    if (declared2.workflow) {
+      if (!declared2.workflow.key) {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no key \u2014 the title several steps share");
+      }
+      if (typeof declared2.workflow.order !== "number") {
+        throw new Error(manifest.slug + " step " + type2 + " declares a workflow with no order \u2014 two steps in one row need a sequence");
+      }
+      if (declared2.trigger) {
+        throw new Error(manifest.slug + " step " + type2 + " declares BOTH a trigger and a workflow \u2014 the workflow carries the trigger for every step in it");
+      }
+    }
+    for (const candidate of [declared2.trigger, (_y = declared2.workflow) == null ? void 0 : _y.trigger].filter(Boolean)) {
+      const known2 = TRIGGERS[Object.keys(TRIGGERS).find((key) => TRIGGERS[key].event === candidate.event && TRIGGERS[key].type === candidate.type)];
       if (!known2) {
         throw new Error(
-          manifest.slug + " step " + type2 + " declares trigger { event : " + declared2.trigger.event + ", type : " + declared2.trigger.type + " }, which nothing dispatches"
+          manifest.slug + " step " + type2 + " declares trigger { event : " + candidate.event + ", type : " + candidate.type + " }, which nothing dispatches"
         );
       }
     }