@tangle-network/agent-integrations 0.44.0 → 0.46.0

package/dist/{chunk-ZBMMGAE2.js → chunk-F6MF4YNI.js}

@@ -6,13 +6,15 @@ import {
 import {
   CredentialsExpired,
   DEFAULT_TANGLE_PLATFORM_URL,
+  ProviderConfigError,
+  ProviderRateLimited,
   ResourceContention,
   TANGLE_API_KEY_PREFIX,
   TANGLE_SERVICE_TOKEN_PREFIX,
   TangleIdentityUnreachableError,
   createTangleIdentityClient,
   tangleIdentity
-} from "./chunk-BDSGHMY6.js";
+} from "./chunk-UWF33ESC.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -112,6 +114,8 @@ __export(adapters_exports, {
   chatwootConnector: () => chatwootConnector,
   checkoutConnector: () => checkoutConnector,
   circleConnector: () => circleConnector,
+  classifyGoogleError: () => classifyGoogleError,
+  classifyGoogleReason: () => classifyGoogleReason,
   clayConnector: () => clayConnector,
   clearoutConnector: () => clearoutConnector,
   clicdataConnector: () => clicdataConnector,
@@ -215,12 +219,14 @@ __export(adapters_exports, {
   gmail: () => gmail,
   gongConnector: () => gongConnector,
   googleAnalyticsConnector: () => googleAnalyticsConnector,
+  googleApiError: () => googleApiError,
   googleBigqueryConnector: () => googleBigqueryConnector,
   googleCalendar: () => googleCalendar,
   googleCloudStorageConnector: () => googleCloudStorageConnector,
   googleContactsConnector: () => googleContactsConnector,
   googleDocs: () => googleDocs,
   googleDrive: () => googleDrive,
+  googleErrorReason: () => googleErrorReason,
   googleForms: () => googleForms,
   googleGeminiConnector: () => googleGeminiConnector,
   googleMeetConnector: () => googleMeetConnector,
@@ -230,6 +236,7 @@ __export(adapters_exports, {
   googleSheets: () => googleSheets,
   googleSlidesConnector: () => googleSlidesConnector,
   googleTasksConnector: () => googleTasksConnector,
+  googleTestFailureReason: () => googleTestFailureReason,
   googleVertexaiConnector: () => googleVertexaiConnector,
   googlechatConnector: () => googlechatConnector,
   gorgiasConnector: () => gorgiasConnector,
@@ -689,6 +696,117 @@ function _resetPendingFlowsForTests() {
   defaultFlowStore.clear?.();
 }
 
+// src/connectors/adapters/google-errors.ts
+var AUTH_REASONS = /* @__PURE__ */ new Set([
+  "autherror",
+  "authenticationerror",
+  "invalidcredentials",
+  "invalid_grant",
+  "invalidgrant",
+  "unauthorized",
+  "unauthenticated",
+  "logindenied"
+]);
+var CONFIG_REASONS = /* @__PURE__ */ new Set([
+  "accessnotconfigured",
+  "insufficientpermissions",
+  "insufficientscopes",
+  "forbidden",
+  "permissiondenied",
+  "permission_denied",
+  "ssorequired"
+]);
+var QUOTA_REASONS = /* @__PURE__ */ new Set([
+  "ratelimitexceeded",
+  "userratelimitexceeded",
+  "userratelimitexceededunreg",
+  "dailylimitexceeded",
+  "quotaexceeded",
+  "resourceexhausted",
+  "resource_exhausted"
+]);
+function googleErrorReason(body) {
+  if (!body || typeof body !== "object") return void 0;
+  const error = body.error;
+  if (!error || typeof error !== "object") return void 0;
+  const fromErrors = error.errors?.find(
+    (entry) => typeof entry?.reason === "string" && entry.reason.length > 0
+  )?.reason;
+  if (fromErrors) return fromErrors;
+  if (typeof error.status === "string" && error.status.length > 0) {
+    return error.status;
+  }
+  return void 0;
+}
+function classifyGoogleReason(reason) {
+  if (!reason) return void 0;
+  const key = reason.toLowerCase();
+  if (QUOTA_REASONS.has(key)) return "quota";
+  if (AUTH_REASONS.has(key)) return "auth";
+  if (CONFIG_REASONS.has(key)) return "config";
+  return void 0;
+}
+function stringifyBody(body) {
+  const text = typeof body === "string" ? body : JSON.stringify(body ?? {});
+  return text.slice(0, 200);
+}
+function classifyGoogleError(status, body, context, dataSourceId) {
+  const reason = googleErrorReason(body);
+  const cls = classifyGoogleReason(reason);
+  const init = { status, reason, body };
+  const suffix = reason ? `: ${reason}` : "";
+  if (cls === "quota" || status === 429) {
+    return new ProviderRateLimited(
+      `${context} rate limit (${status})${suffix}`,
+      dataSourceId,
+      init
+    );
+  }
+  if (cls === "auth" || status === 401) {
+    return new CredentialsExpired(
+      `${context} rejected token (${status})${suffix}`,
+      dataSourceId,
+      init
+    );
+  }
+  if (cls === "config" || status === 403) {
+    return new ProviderConfigError(
+      `${context} permission/config error (${status})${suffix}`,
+      dataSourceId,
+      init
+    );
+  }
+  return new Error(`${context} ${status}: ${stringifyBody(body)}`);
+}
+async function googleApiError(res, context, dataSourceId) {
+  const body = await readErrorBody(res);
+  return classifyGoogleError(res.status, body, context, dataSourceId);
+}
+function googleTestFailureReason(status, body, provider) {
+  const reason = googleErrorReason(body);
+  const cls = classifyGoogleReason(reason);
+  const detail = reason ? `, ${reason}` : "";
+  if (cls === "quota" || status === 429) {
+    return `${provider} rate limit (${status}${detail}) \u2014 retry later`;
+  }
+  if (cls === "auth" || status === 401) {
+    return `${provider} rejected token (${status}${detail}) \u2014 reconnect required`;
+  }
+  if (cls === "config" || status === 403) {
+    return `${provider} permission/config error (${status}${detail}) \u2014 check the API is enabled and scopes are granted`;
+  }
+  return `${provider} returned ${status}`;
+}
+async function readErrorBody(res) {
+  const text = await res.text().catch(() => "");
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
 // src/connectors/adapters/google-calendar.ts
 var SCOPE_CALENDAR = "https://www.googleapis.com/auth/calendar";
 var SCOPE_WRITE = "https://www.googleapis.com/auth/calendar.events";
@@ -871,7 +989,7 @@ function googleCalendar(opts) {
       if (inv.capabilityName === "list_availability") {
         const calendarId = readMetaString(inv.source.metadata, "calendarId");
         const { timeMin, timeMax } = inv.args;
-        const fb = await freebusyQuery({ accessToken, calendarId, timeMin, timeMax });
+        const fb = await freebusyQuery({ accessToken, calendarId, timeMin, timeMax, sourceId: inv.source.id });
         return {
           data: { busy: fb.busy },
           fetchedAt: Date.now()
@@ -891,7 +1009,7 @@ function googleCalendar(opts) {
       }
       const calendarId = readMetaString(inv.source.metadata, "calendarId");
       const { start, end, summary, description, attendees } = inv.args;
-      const fb = await freebusyQuery({ accessToken, calendarId, timeMin: start, timeMax: end });
+      const fb = await freebusyQuery({ accessToken, calendarId, timeMin: start, timeMax: end, sourceId: inv.source.id });
       if (fb.busy.length > 0) {
         const startMs = Date.parse(start);
         const endMs = Date.parse(end);
@@ -901,7 +1019,8 @@ function googleCalendar(opts) {
           calendarId,
           searchFromMs: endMs,
           durationMs: durMs,
-          wanted: 3
+          wanted: 3,
+          sourceId: inv.source.id
         });
         throw new ResourceContention(
           `requested slot ${start}\u2013${end} is no longer free`,
@@ -939,12 +1058,8 @@ function googleCalendar(opts) {
           idempotentReplay: true
         };
       }
-      if (res.status === 401 || res.status === 403) {
-        throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-      }
       if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        throw new Error(`google-calendar book_slot ${res.status}: ${text.slice(0, 200)}`);
+        throw await googleApiError(res, "google-calendar book_slot", inv.source.id);
       }
       const created = await res.json();
       return {
@@ -1001,10 +1116,10 @@ function googleCalendar(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Google Calendar") };
         }
-        if (!res.ok) return { ok: false, reason: `Google returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -1048,12 +1163,8 @@ async function createEvent(inv, accessToken, timeoutMs) {
     body: JSON.stringify(event),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-calendar create_event ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar create_event", inv.source.id);
   }
   const created = await res.json();
   return {
@@ -1093,12 +1204,8 @@ async function updateEvent(inv, accessToken, timeoutMs) {
     body: JSON.stringify(patch),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-calendar update_event ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar update_event", inv.source.id);
   }
   const updated = await res.json();
   return {
@@ -1124,13 +1231,9 @@ async function deleteEvent(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-  }
   const idempotent = res.status === 404 || res.status === 410;
   if (!res.ok && !idempotent) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-calendar delete_event ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar delete_event", inv.source.id);
   }
   return {
     status: "committed",
@@ -1148,12 +1251,8 @@ async function getEvent(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-calendar get_event ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar get_event", inv.source.id);
   }
   const event = await res.json();
   return {
@@ -1178,12 +1277,8 @@ async function listEvents(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Calendar rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-calendar list_events ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar list_events", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -1210,8 +1305,7 @@ async function freebusyQuery(input) {
     signal: AbortSignal.timeout(1e4)
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`freebusy ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-calendar freebusy", input.sourceId);
   }
   const json = await res.json();
   return { busy: json.calendars?.[input.calendarId]?.busy ?? [] };
@@ -1226,7 +1320,8 @@ async function findNextFreeSlots(input) {
       accessToken: input.accessToken,
       calendarId: input.calendarId,
       timeMin: new Date(cursor).toISOString(),
-      timeMax: new Date(windowEnd).toISOString()
+      timeMax: new Date(windowEnd).toISOString(),
+      sourceId: input.sourceId
     });
     const busy = fb.busy.map((b) => ({ s: Date.parse(b.start), e: Date.parse(b.end) })).filter((b) => Number.isFinite(b.s) && Number.isFinite(b.e)).sort((a, b) => a.s - b.s);
     let pos = cursor;
@@ -1480,10 +1575,10 @@ function googleDrive(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected Drive token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Google Drive") };
         }
-        if (!res.ok) return { ok: false, reason: `Google Drive returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -1508,12 +1603,8 @@ async function listFiles(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive list_files ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive list_files", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -1532,15 +1623,11 @@ async function readFile(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (metaRes.status === 401 || metaRes.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${metaRes.status})`, inv.source.id);
-  }
   if (metaRes.status === 404) {
     throw new Error(`google-drive read_file: file ${fileId} not found`);
   }
   if (!metaRes.ok) {
-    const text = await metaRes.text().catch(() => "");
-    throw new Error(`google-drive read_file meta ${metaRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(metaRes, "google-drive read_file meta", inv.source.id);
   }
   const meta = await metaRes.json();
   const isNative = meta.mimeType.startsWith("application/vnd.google-apps.");
@@ -1552,8 +1639,7 @@ async function readFile(inv, accessToken, timeoutMs) {
       signal: AbortSignal.timeout(timeoutMs)
     });
     if (!res2.ok) {
-      const text = await res2.text().catch(() => "");
-      throw new Error(`google-drive read_file export ${res2.status}: ${text.slice(0, 200)}`);
+      throw await googleApiError(res2, "google-drive read_file export", inv.source.id);
     }
     const isTextLike2 = /^text\/|application\/(json|xml|csv|javascript)/.test(targetMime);
     if (isTextLike2) {
@@ -1574,8 +1660,7 @@ async function readFile(inv, accessToken, timeoutMs) {
     signal: AbortSignal.timeout(timeoutMs)
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive read_file media ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive read_file media", inv.source.id);
   }
   const isTextLike = /^text\/|application\/(json|xml|csv|javascript)/.test(meta.mimeType);
   if (isTextLike) {
@@ -1608,9 +1693,6 @@ async function watchFolder(inv, accessToken, timeoutMs) {
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 409) {
     const cached = inv.source.metadata.watchedChannels?.[channelId];
     return {
@@ -1621,8 +1703,7 @@ async function watchFolder(inv, accessToken, timeoutMs) {
     };
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive watch_folder ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive watch_folder", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -1667,12 +1748,8 @@ Content-Type: ${mimeType}\r
     body,
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive upload_file ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive upload_file", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -1707,12 +1784,8 @@ async function createFolder(inv, accessToken, timeoutMs) {
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive create_folder ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive create_folder", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -1736,12 +1809,8 @@ async function deleteFile(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok && res.status !== 204) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive delete_file ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive delete_file", inv.source.id);
   }
   return {
     status: "committed",
@@ -1771,12 +1840,8 @@ async function moveFile(inv, accessToken, timeoutMs) {
     body: "{}",
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Drive rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-drive move_file ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-drive move_file", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -2030,10 +2095,10 @@ function googleSheets(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Google Sheets") };
         }
-        if (!res.ok) return { ok: false, reason: `Google returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -2060,12 +2125,8 @@ async function fetchAllRows(accessToken, meta) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(15e3)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Sheets rejected token (${res.status})`, "");
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-sheets values.get ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-sheets values.get", "");
   }
   const json = await res.json();
   const grid = json.values ?? [];
@@ -2178,12 +2239,8 @@ async function updateRow(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ values: [updatedValues] }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Sheets rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-sheets update_row ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-sheets update_row", inv.source.id);
   }
   const updatedValuesByHeader = Object.fromEntries(
     meta.headers.map((h, i) => [h, updatedValues[i] ?? ""])
@@ -2218,12 +2275,8 @@ async function appendRow(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ values: args.values }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Sheets rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-sheets append_row ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-sheets append_row", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -2254,12 +2307,8 @@ async function clearRange(inv, accessToken, timeoutMs) {
     body: "{}",
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Sheets rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-sheets clear_range ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-sheets clear_range", inv.source.id);
   }
   const json = await res.json().catch(() => ({}));
   return {
@@ -2285,12 +2334,8 @@ async function createSheet(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ properties: { title: args.title } }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Sheets rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-sheets create_sheet ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-sheets create_sheet", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -2305,6 +2350,119 @@ async function createSheet(inv, accessToken, timeoutMs) {
   };
 }
 
+// src/connectors/adapters/aws-sigv4.ts
+import { createHash as createHash3, createHmac } from "crypto";
+var ALGORITHM = "AWS4-HMAC-SHA256";
+function parseAwsCredentialBundle(credentials) {
+  if (credentials.kind !== "api-key") {
+    throw new Error(`AWS SigV4 connectors require api-key credentials, got ${credentials.kind}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(credentials.apiKey);
+  } catch {
+    throw new Error(
+      "AWS credential must be a JSON object with accessKeyId, secretAccessKey, and region \u2014 received a non-JSON string"
+    );
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("AWS credential bundle must be a JSON object with accessKeyId, secretAccessKey, and region");
+  }
+  const o = raw;
+  const accessKeyId = pickString(o, ["accessKeyId", "access_key_id", "awsAccessKeyId", "AccessKeyId"]);
+  const secretAccessKey = pickString(o, [
+    "secretAccessKey",
+    "secret_access_key",
+    "awsSecretAccessKey",
+    "SecretAccessKey",
+    "secretKey"
+  ]);
+  const region = pickString(o, ["region", "awsRegion", "Region"]) ?? "";
+  const sessionToken = pickString(o, ["sessionToken", "session_token", "awsSessionToken", "SessionToken"]);
+  const endpoint = pickString(o, ["endpoint", "Endpoint"]);
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("AWS credential bundle is missing accessKeyId and/or secretAccessKey");
+  }
+  return { accessKeyId, secretAccessKey, region, sessionToken, endpoint };
+}
+function signSigV4(input) {
+  const { method, url, body, service, region, accessKeyId, secretAccessKey, sessionToken, amzDate } = input;
+  const dateStamp = amzDate.slice(0, 8);
+  const payloadHash = hashSha256Hex(body);
+  const headerMap = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(input.headers)) {
+    const name = key.toLowerCase().trim();
+    if (name === "authorization") continue;
+    headerMap.set(name, collapseWhitespace(value));
+  }
+  headerMap.set("host", url.host);
+  headerMap.set("x-amz-date", amzDate);
+  if (sessionToken) headerMap.set("x-amz-security-token", sessionToken);
+  const sortedNames = [...headerMap.keys()].sort();
+  const canonicalHeaders = sortedNames.map((name) => `${name}:${headerMap.get(name)}
+`).join("");
+  const signedHeaders = sortedNames.join(";");
+  const canonicalRequest = [
+    method.toUpperCase(),
+    canonicalUri(url.pathname, service),
+    canonicalizeAwsQuery(url.searchParams),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash
+  ].join("\n");
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+  const stringToSign = [ALGORITHM, amzDate, credentialScope, hashSha256Hex(canonicalRequest)].join("\n");
+  const signingKey = deriveSigningKey(secretAccessKey, dateStamp, region, service);
+  const signature = createHmac("sha256", signingKey).update(stringToSign, "utf8").digest("hex");
+  const authorization = `${ALGORITHM} Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  return { amzDate, signedHeaders, canonicalRequest, stringToSign, signature, authorization };
+}
+function amzDateNow(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+function hashSha256Hex(data) {
+  return createHash3("sha256").update(data, "utf8").digest("hex");
+}
+function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
+  const kDate = createHmac("sha256", `AWS4${secretAccessKey}`).update(dateStamp, "utf8").digest();
+  const kRegion = createHmac("sha256", kDate).update(region, "utf8").digest();
+  const kService = createHmac("sha256", kRegion).update(service, "utf8").digest();
+  return createHmac("sha256", kService).update("aws4_request", "utf8").digest();
+}
+function canonicalUri(pathname, service) {
+  if (!pathname) return "/";
+  if (service === "s3") return pathname;
+  const segments = [];
+  for (const segment of pathname.split("/")) {
+    if (segment.length === 0 || segment === ".") continue;
+    if (segment === "..") segments.pop();
+    else segments.push(segment);
+  }
+  const normalized = `/${segments.join("/")}${segments.length > 0 && pathname.endsWith("/") ? "/" : ""}`;
+  return awsUriEncode(normalized).replace(/%2F/g, "/");
+}
+function canonicalizeAwsQuery(params) {
+  const pairs = [];
+  for (const [key, value] of params) {
+    pairs.push([awsUriEncode(key), awsUriEncode(value)]);
+  }
+  pairs.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+  return pairs.map(([key, value]) => `${key}=${value}`).join("&");
+}
+function awsUriEncode(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function collapseWhitespace(value) {
+  return value.trim().replace(/\s+/g, " ");
+}
+function pickString(obj, keys) {
+  for (const key of keys) {
+    const value = obj[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+
 // src/connectors/adapters/declarative-rest.ts
 function declarativeRestConnector(spec) {
   const capabilities = spec.capabilities.map(operationToCapability);
@@ -2404,7 +2562,11 @@ function requiredArgsOf(parameters) {
   return Array.isArray(required) ? required.filter((entry) => typeof entry === "string") : void 0;
 }
 async function executeRestRequest(spec, request, inv, requiredArgs) {
-  const baseUrl = resolveBaseUrl(spec.baseUrl, inv.source.metadata);
+  const placement = spec.credentialPlacement ?? { kind: "bearer" };
+  const aws = placement.kind === "aws-sigv4" ? parseAwsCredentialBundle(inv.source.credentials) : void 0;
+  const awsRegion = aws ? resolveAwsRegion(aws, inv.source.metadata, placement) : void 0;
+  let baseUrl = resolveBaseUrl(spec.baseUrl, inv.source.metadata);
+  if (aws) baseUrl = applyRegionTemplate(baseUrl, awsRegion, aws.endpoint);
   const renderedPath = interpolate(request.path, inv.args).replace(/^\/+/, "");
   const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
   const url = new URL(renderedPath, baseWithSlash);
@@ -2412,21 +2574,36 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
     const rendered = renderQueryValue(value, inv.args);
     if (rendered !== void 0 && rendered !== "") url.searchParams.set(key, String(rendered));
   }
+  const requestHeaders = request.headers ?? {};
+  const hostOverride = aws ? Object.entries(requestHeaders).find(([key]) => key.toLowerCase() === "host")?.[1] : void 0;
+  const renderableHeaders = hostOverride ? Object.fromEntries(Object.entries(requestHeaders).filter(([key]) => key.toLowerCase() !== "host")) : requestHeaders;
   const headers = {
     accept: "application/json",
     ...spec.defaultHeaders,
-    ...renderHeaders(request.headers ?? {}, inv.args)
+    ...renderHeaders(renderableHeaders, inv.args)
   };
-  applyCredentials(headers, url, spec.credentialPlacement ?? { kind: "bearer" }, inv.source.credentials);
+  if (hostOverride) url.host = hostOverride.replace(/\{region\}/g, awsRegion);
   if (inv.expectedEtag) headers["if-match"] = inv.expectedEtag;
   const sendsBody = request.method !== "GET" && (request.method !== "DELETE" || request.body !== void 0);
-  if (sendsBody) {
-    headers["content-type"] = headers["content-type"] ?? "application/json";
+  if (sendsBody && getHeaderCI(headers, "content-type") === void 0) {
+    headers["content-type"] = "application/json";
+  }
+  const bodyString = sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, requiredArgs)) : void 0;
+  if (placement.kind === "aws-sigv4") {
+    signAwsRequest(headers, url, {
+      method: request.method,
+      body: bodyString ?? "",
+      service: placement.service,
+      region: awsRegion,
+      bundle: aws
+    });
+  } else {
+    applyCredentials(headers, url, placement, inv.source.credentials);
   }
   const res = await fetch(url, {
     method: request.method,
     headers,
-    body: sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, requiredArgs)) : void 0,
+    body: bodyString,
     signal: AbortSignal.timeout(2e4)
   });
   if (res.status === 401 || res.status === 403) {
@@ -2450,6 +2627,9 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
       }
     };
   }
+  if (request.existenceCheck && (res.status === 204 || res.status === 404)) {
+    return { data: { exists: res.status === 204 } };
+  }
   if (!res.ok) {
     throw new Error(`${spec.kind} ${request.method} ${url.pathname} HTTP ${res.status}: ${(await safeErrorText(res)).slice(0, 300)}`);
   }
@@ -2482,6 +2662,42 @@ function credentialToken(credentials) {
   if (credentials.kind === "api-key") return credentials.apiKey;
   throw new Error(`declarative REST connectors require oauth2 or api-key credentials, got ${credentials.kind}`);
 }
+function resolveAwsRegion(bundle, metadata, placement) {
+  if (bundle.region) return bundle.region;
+  if (typeof metadata.region === "string" && metadata.region.trim()) return metadata.region;
+  return placement.defaultRegion ?? "us-east-1";
+}
+function applyRegionTemplate(baseUrl, region, endpoint) {
+  if (endpoint) return endpoint;
+  return baseUrl.replace(/\{region\}/g, region);
+}
+function getHeaderCI(headers, name) {
+  const lower = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === lower) return value;
+  }
+  return void 0;
+}
+function signAwsRequest(headers, url, opts) {
+  const canonicalSearch = canonicalizeAwsQuery(url.searchParams);
+  url.search = canonicalSearch ? `?${canonicalSearch}` : "";
+  headers["x-amz-content-sha256"] = hashSha256Hex(opts.body);
+  if (opts.bundle.sessionToken) headers["x-amz-security-token"] = opts.bundle.sessionToken;
+  const signed = signSigV4({
+    method: opts.method,
+    url,
+    headers,
+    body: opts.body,
+    service: opts.service,
+    region: opts.region,
+    accessKeyId: opts.bundle.accessKeyId,
+    secretAccessKey: opts.bundle.secretAccessKey,
+    sessionToken: opts.bundle.sessionToken,
+    amzDate: amzDateNow()
+  });
+  headers["x-amz-date"] = signed.amzDate;
+  headers.authorization = signed.authorization;
+}
 function resolveBody(body, args, requiredArgs) {
   if (!body || body === "args") return args;
   if (typeof body === "string") return renderValue(body, args, requiredArgs);
@@ -2882,10 +3098,10 @@ function gmail(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected Gmail token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Gmail") };
         }
-        if (!res.ok) return { ok: false, reason: `Gmail returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -2906,12 +3122,8 @@ async function listMessages(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (listRes.status === 401 || listRes.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${listRes.status})`, inv.source.id);
-  }
   if (!listRes.ok) {
-    const text = await listRes.text().catch(() => "");
-    throw new Error(`gmail list_messages ${listRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(listRes, "gmail list_messages", inv.source.id);
   }
   const listJson = await listRes.json();
   const ids = listJson.messages ?? [];
@@ -2951,15 +3163,11 @@ async function readMessage(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`gmail read_message: message ${id} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`gmail read_message ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "gmail read_message", inv.source.id);
   }
   const full = await res.json();
   const headers = new Map((full.payload?.headers ?? []).map((h) => [h.name.toLowerCase(), h.value]));
@@ -3035,12 +3243,8 @@ ${args.body}`;
     body: JSON.stringify({ raw: encodeBase64Url(raw) }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (sendRes.status === 401 || sendRes.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${sendRes.status})`, inv.source.id);
-  }
   if (!sendRes.ok) {
-    const text = await sendRes.text().catch(() => "");
-    throw new Error(`gmail send ${sendRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(sendRes, "gmail send", inv.source.id);
   }
   const sent = await sendRes.json();
   return {
@@ -3056,12 +3260,8 @@ async function sendReply(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (threadRes.status === 401 || threadRes.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${threadRes.status})`, inv.source.id);
-  }
   if (!threadRes.ok) {
-    const text = await threadRes.text().catch(() => "");
-    throw new Error(`gmail send_reply thread fetch ${threadRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(threadRes, "gmail send_reply thread fetch", inv.source.id);
   }
   const thread = await threadRes.json();
   const last = thread.messages?.[thread.messages.length - 1];
@@ -3104,12 +3304,8 @@ ${body}`;
     body: JSON.stringify(sendBody),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (sendRes.status === 401 || sendRes.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${sendRes.status})`, inv.source.id);
-  }
   if (!sendRes.ok) {
-    const text = await sendRes.text().catch(() => "");
-    throw new Error(`gmail send_reply ${sendRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(sendRes, "gmail send_reply", inv.source.id);
   }
   const sent = await sendRes.json();
   return {
@@ -3135,12 +3331,8 @@ async function watchLabel(inv, accessToken, timeoutMs) {
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Gmail rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`gmail watch_label ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "gmail watch_label", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -4704,7 +4896,7 @@ async function uploadFile2(inv, accessToken, timeoutMs) {
 }
 
 // src/connectors/adapters/docuseal.ts
-import { createHmac, timingSafeEqual } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
 var DEFAULT_BASE = "https://api.docuseal.com";
 function readDocuSealCredentials(creds) {
   if (creds.kind === "api-key" && typeof creds.apiKey === "string" && creds.apiKey.length > 0) {
@@ -4829,7 +5021,7 @@ function docuseal(opts = {}) {
       if (!creds?.webhookSecret) return { valid: false, reason: "missing_webhook_secret" };
       const sig = firstHeader(headers, "x-docuseal-signature");
       if (!sig) return { valid: false, reason: "missing_signature_header" };
-      const expected = createHmac("sha256", creds.webhookSecret).update(rawBody).digest("hex");
+      const expected = createHmac2("sha256", creds.webhookSecret).update(rawBody).digest("hex");
       const a = Buffer.from(sig.toLowerCase(), "utf-8");
       const b = Buffer.from(expected, "utf-8");
       if (a.length !== b.length) return { valid: false, reason: "invalid_signature" };
@@ -7021,7 +7213,7 @@ function readApiKey(creds) {
 }
 
 // src/connectors/adapters/webhook.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 var webhookConnector = {
   manifest: {
     kind: "webhook",
@@ -7135,7 +7327,7 @@ function signHeaders(creds, body, idempotencyKey) {
     "x-phony-idempotency-key": idempotencyKey
   };
   if (creds.kind === "hmac" && typeof creds.secret === "string" && creds.secret.length > 0) {
-    const sig = createHmac2("sha256", creds.secret).update(`${ts}.${body}`).digest("hex");
+    const sig = createHmac3("sha256", creds.secret).update(`${ts}.${body}`).digest("hex");
     headers["x-phony-signature"] = `sha256=${sig}`;
   }
   return headers;
@@ -7297,6 +7489,83 @@ var githubConnector = declarativeRestConnector({
       },
       request: { method: "GET", path: "/search/issues", query: { q: "{q}", per_page: "{per_page}" } }
     },
+    {
+      name: "users.getAuthenticated",
+      class: "read",
+      description: "Resolve the authenticated user (the token owner). Quest verification anchors author:/owner: filters to this login, so it must be resolved first.",
+      parameters: { type: "object", properties: {}, required: [] },
+      request: { method: "GET", path: "/user" }
+    },
+    {
+      name: "activity.checkStarred",
+      class: "read",
+      description: "Check whether the authenticated user has starred a repository. Returns { exists: true } when starred, { exists: false } when not.",
+      parameters: repoParams,
+      request: { method: "GET", path: "/user/starred/{owner}/{repo}", existenceCheck: true }
+    },
+    {
+      name: "users.checkFollowing",
+      class: "read",
+      description: "Check whether the authenticated user follows another user. Returns { exists: true } when following, { exists: false } when not.",
+      parameters: {
+        type: "object",
+        properties: { target: { type: "string", description: "Login of the user to check the follow against." } },
+        required: ["target"]
+      },
+      request: { method: "GET", path: "/user/following/{target}", existenceCheck: true }
+    },
+    {
+      name: "repos.listCommits",
+      class: "read",
+      description: "List commits on a repository, optionally filtered to a single author login/email. Used to verify a user contributed to the repo.",
+      parameters: {
+        type: "object",
+        properties: {
+          owner: { type: "string" },
+          repo: { type: "string" },
+          author: { type: "string", description: "Restrict to commits authored by this GitHub login or email." },
+          per_page: { type: "integer", minimum: 1, maximum: 100 }
+        },
+        required: ["owner", "repo"]
+      },
+      request: {
+        method: "GET",
+        path: "/repos/{owner}/{repo}/commits",
+        query: { author: "{author}", per_page: "{per_page}" }
+      }
+    },
+    {
+      name: "repos.getReadme",
+      class: "read",
+      description: "Read a repository's README (returns base64-encoded content). Used to verify README mentions.",
+      parameters: repoParams,
+      request: { method: "GET", path: "/repos/{owner}/{repo}/readme" }
+    },
+    {
+      name: "search.code",
+      class: "read",
+      description: "Search code across GitHub. Used to verify code usage of a symbol or string.",
+      parameters: {
+        type: "object",
+        properties: { q: { type: "string" }, per_page: { type: "integer", minimum: 1, maximum: 100 } },
+        required: ["q"]
+      },
+      request: { method: "GET", path: "/search/code", query: { q: "{q}", per_page: "{per_page}" } }
+    },
+    {
+      name: "orgs.checkMembership",
+      class: "read",
+      description: "Check whether a user is a member of an organization. Returns { exists: true } when a member, { exists: false } when not.",
+      parameters: {
+        type: "object",
+        properties: {
+          org: { type: "string" },
+          user: { type: "string", description: "Login of the user to check membership for." }
+        },
+        required: ["org", "user"]
+      },
+      request: { method: "GET", path: "/orgs/{org}/members/{user}", existenceCheck: true }
+    },
     {
       name: "issues.create",
       class: "mutation",
@@ -37162,7 +37431,7 @@ var smooveConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/hellosign.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var SCOPES7 = [
   "basic_account_info",
   "request_signature",
@@ -37385,7 +37654,7 @@ function hellosign(opts) {
       if (!event || typeof event.event_time !== "string" || typeof event.event_type !== "string" || typeof event.event_hash !== "string") {
         return { valid: false, reason: "missing_event_fields" };
       }
-      const expected = createHmac3("sha256", source.credentials.accessToken).update(`${event.event_time}${event.event_type}`).digest("hex");
+      const expected = createHmac4("sha256", source.credentials.accessToken).update(`${event.event_time}${event.event_type}`).digest("hex");
       const a = Buffer.from(event.event_hash.toLowerCase(), "utf-8");
       const b = Buffer.from(expected.toLowerCase(), "utf-8");
       if (a.length !== b.length) return { valid: false, reason: "invalid_signature" };
@@ -38378,10 +38647,10 @@ function googleDocs(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected Docs token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Google Docs") };
         }
-        if (!res.ok) return { ok: false, reason: `Google userinfo returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -38417,15 +38686,11 @@ async function getDocument2(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-docs get_document: document ${documentId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-docs get_document ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-docs get_document", inv.source.id);
   }
   const doc = await res.json();
   return {
@@ -38456,12 +38721,8 @@ async function createDocument2(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ title }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (createRes.status === 401 || createRes.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${createRes.status})`, inv.source.id);
-  }
   if (!createRes.ok) {
-    const text = await createRes.text().catch(() => "");
-    throw new Error(`google-docs create_document ${createRes.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(createRes, "google-docs create_document", inv.source.id);
   }
   const created = await createRes.json();
   let revisionId = created.revisionId;
@@ -38487,12 +38748,8 @@ async function createDocument2(inv, accessToken, timeoutMs) {
         signal: AbortSignal.timeout(timeoutMs)
       }
     );
-    if (insertRes.status === 401 || insertRes.status === 403) {
-      throw new CredentialsExpired(`Google Docs rejected token (${insertRes.status})`, inv.source.id);
-    }
     if (!insertRes.ok) {
-      const text = await insertRes.text().catch(() => "");
-      throw new Error(`google-docs create_document insertText ${insertRes.status}: ${text.slice(0, 200)}`);
+      throw await googleApiError(insertRes, "google-docs create_document insertText", inv.source.id);
     }
     const insertJson = await insertRes.json();
     revisionId = insertJson.writeControl?.requiredRevisionId ?? revisionId;
@@ -38514,15 +38771,11 @@ async function appendText(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (docRes.status === 401 || docRes.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${docRes.status})`, inv.source.id);
-  }
   if (docRes.status === 404) {
     throw new Error(`google-docs append_text: document ${documentId} not found`);
   }
   if (!docRes.ok) {
-    const errText = await docRes.text().catch(() => "");
-    throw new Error(`google-docs append_text fetch ${docRes.status}: ${errText.slice(0, 200)}`);
+    throw await googleApiError(docRes, "google-docs append_text fetch", inv.source.id);
   }
   const doc = await docRes.json();
   const insertIndex = findAppendIndex(doc);
@@ -38551,9 +38804,6 @@ async function appendText(inv, accessToken, timeoutMs) {
       signal: AbortSignal.timeout(timeoutMs)
     }
   );
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 400 && requiredRevisionId) {
     const errBody = await res.text().catch(() => "");
     if (/FAILED_PRECONDITION|requiredRevisionId/i.test(errBody)) {
@@ -38566,8 +38816,7 @@ async function appendText(inv, accessToken, timeoutMs) {
     throw new Error(`google-docs append_text ${res.status}: ${errBody.slice(0, 200)}`);
   }
   if (!res.ok) {
-    const errBody = await res.text().catch(() => "");
-    throw new Error(`google-docs append_text ${res.status}: ${errBody.slice(0, 200)}`);
+    throw await googleApiError(res, "google-docs append_text", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -38592,15 +38841,11 @@ async function deleteDocument(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ trashed: true }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-docs delete_document: document ${documentId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-docs delete_document ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-docs delete_document", inv.source.id);
   }
   const json = await res.json().catch(() => ({}));
   return {
@@ -38626,15 +38871,11 @@ async function exportDocument(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Docs rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-docs export_document: document ${documentId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-docs export_document ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-docs export_document", inv.source.id);
   }
   const buf = new Uint8Array(await res.arrayBuffer());
   let binary = "";
@@ -38879,10 +39120,10 @@ function googleForms(opts) {
           headers: { authorization: `Bearer ${accessToken}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Google rejected Forms token (${res.status}) \u2014 reconnect required` };
+        if (!res.ok) {
+          const body = await res.json().catch(() => void 0);
+          return { ok: false, reason: googleTestFailureReason(res.status, body, "Google Forms") };
         }
-        if (!res.ok) return { ok: false, reason: `Google userinfo returned ${res.status}` };
         return { ok: true };
       } catch (err) {
         return { ok: false, reason: err instanceof Error ? err.message : String(err) };
@@ -38910,15 +39151,11 @@ async function getForm(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Forms rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-forms get_form: form ${formId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-forms get_form ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-forms get_form", inv.source.id);
   }
   const form = await res.json();
   return {
@@ -38946,15 +39183,11 @@ async function listResponses(inv, accessToken, timeoutMs) {
     headers: { authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Forms rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-forms list_responses: form ${formId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-forms list_responses ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-forms list_responses", inv.source.id);
   }
   const envelope = await res.json();
   const responses = (envelope.responses ?? []).map((r) => ({
@@ -38984,15 +39217,11 @@ async function getResponse(inv, accessToken, timeoutMs) {
       signal: AbortSignal.timeout(timeoutMs)
     }
   );
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Forms rejected token (${res.status})`, inv.source.id);
-  }
   if (res.status === 404) {
     throw new Error(`google-forms get_response: response ${responseId} not found`);
   }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-forms get_response ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-forms get_response", inv.source.id);
   }
   const r = await res.json();
   return {
@@ -39021,12 +39250,8 @@ async function createForm(inv, accessToken, timeoutMs) {
     body: JSON.stringify({ info }),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Forms rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-forms create_form ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-forms create_form", inv.source.id);
   }
   const form = await res.json();
   return {
@@ -39060,12 +39285,8 @@ async function batchUpdate(inv, accessToken, timeoutMs) {
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs)
   });
-  if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Google Forms rejected token (${res.status})`, inv.source.id);
-  }
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`google-forms batch_update ${res.status}: ${text.slice(0, 200)}`);
+    throw await googleApiError(res, "google-forms batch_update", inv.source.id);
   }
   const json = await res.json();
   return {
@@ -44804,16 +45025,17 @@ var amazonBedrockConnector = declarativeRestConnector({
   kind: "amazon-bedrock",
   displayName: "Amazon Bedrock",
   description: "Invoke AWS Bedrock foundation models for text generation, image analysis, image generation, and embeddings; list available foundation models.",
-  auth: { kind: "api-key", hint: "AWS access key id / secret access key pair (the connection should also carry metadata.region; requests are signed with AWS Signature V4 at the gateway)." },
+  auth: { kind: "api-key", hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the bedrock-runtime.<region>.amazonaws.com endpoint.' },
   category: "other",
   // Bedrock model invocations are non-idempotent generative calls; the manifest
   // surfaces are advisory (best-effort), not authoritative state.
   defaultConsistencyModel: "advisory",
   // bedrock-runtime is the workhorse endpoint for invoke/converse. Control-plane
   // listing operations override the host on a per-capability basis below.
-  baseUrl: { metadataKey: "runtimeEndpoint", fallback: "https://bedrock-runtime.us-east-1.amazonaws.com" },
+  credentialPlacement: { kind: "aws-sigv4", service: "bedrock" },
+  baseUrl: { metadataKey: "runtimeEndpoint", fallback: "https://bedrock-runtime.{region}.amazonaws.com" },
   defaultHeaders: { "content-type": "application/json", accept: "application/json" },
-  test: { method: "GET", path: "/foundation-models", headers: { host: "bedrock.us-east-1.amazonaws.com" } },
+  test: { method: "GET", path: "/foundation-models", headers: { host: "bedrock.{region}.amazonaws.com" } },
   capabilities: [
     {
       name: "models.list",
@@ -44835,9 +45057,10 @@ var amazonBedrockConnector = declarativeRestConnector({
           byOutputModality: "{byOutputModality}",
           byInferenceType: "{byInferenceType}"
         },
-        // Control-plane host override; declarative-rest forwards the header to
-        // the gateway, which rewrites the upstream Host for SigV4.
-        headers: { host: "bedrock.us-east-1.amazonaws.com" }
+        // Control-plane host override: the runtime folds this `host` header into
+        // the request URL (region substituted) so SigV4 signs the bedrock.<region>
+        // control-plane host, not the bedrock-runtime base host.
+        headers: { host: "bedrock.{region}.amazonaws.com" }
       }
     },
     {
@@ -44854,7 +45077,7 @@ var amazonBedrockConnector = declarativeRestConnector({
       request: {
         method: "GET",
         path: "/foundation-models/{modelIdentifier}",
-        headers: { host: "bedrock.us-east-1.amazonaws.com" }
+        headers: { host: "bedrock.{region}.amazonaws.com" }
       }
     },
     {
@@ -44967,13 +45190,14 @@ var amazonSecretsManagerConnector = declarativeRestConnector({
   description: "Create, read, update, find, and delete secrets in AWS Secrets Manager, or generate a random password.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the secretsmanager.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "secretsmanager" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://secretsmanager.us-east-1.amazonaws.com"
+    fallback: "https://secretsmanager.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.1"
@@ -45871,11 +46095,15 @@ var amazonSesConnector = declarativeRestConnector({
   description: "Send transactional and templated email and manage SES email templates via the Amazon SES v2 REST API.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key ID + secret access key with ses:SendEmail / ses:SendTemplatedEmail / template-management permissions. The region selects the SES endpoint (e.g. us-east-1)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"} (the key needs ses:SendEmail / ses:SendTemplatedEmail / template-management permissions). Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the email.<region>.amazonaws.com (SES v2) endpoint.'
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
-  baseUrl: { metadataKey: "endpoint" },
+  // SES v2 REST API: the SigV4 signing name is `ses`, but the regional host is
+  // the `email.` subdomain. metadata.endpoint still overrides when a tenant
+  // pins a host.
+  credentialPlacement: { kind: "aws-sigv4", service: "ses" },
+  baseUrl: { metadataKey: "endpoint", fallback: "https://email.{region}.amazonaws.com" },
   test: { method: "GET", path: "/v2/email/identities" },
   capabilities: [
     {
@@ -46138,13 +46366,14 @@ var amazonSnsConnector = declarativeRestConnector({
   description: "Publish messages to Amazon Simple Notification Service topics, manage topics, and manage subscriptions.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the sns.<region>.amazonaws.com endpoint.'
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "sns" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://sns.us-east-1.amazonaws.com"
+    fallback: "https://sns.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
@@ -46413,16 +46642,17 @@ var amazonSqsConnector = declarativeRestConnector({
   description: "Send, receive, and delete messages on AWS SQS queues, and discover queue URLs and attributes.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle; metadata.endpoint may override the regional host)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" (STS temp creds) and "endpoint" (override host). Requests are signed with AWS Signature V4; the region selects the sqs.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   // SQS is an at-least-once durable queue: sends, deletes, and queue-attribute
   // reads are authoritative against the service. Receive returns a transient
   // visibility-locked view, but the queue state itself is authoritative.
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "sqs" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://sqs.us-east-1.amazonaws.com"
+    fallback: "https://sqs.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.0"
@@ -46745,13 +46975,14 @@ var amazonTextractConnector = declarativeRestConnector({
   description: "Extract text, forms, tables, signatures, and structured data (expense, identity) from documents using AWS Textract.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle; the gateway signs each request)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the textract.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "textract" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://textract.us-east-1.amazonaws.com"
+    fallback: "https://textract.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.1"
@@ -52204,15 +52435,14 @@ var backblazeConnector = declarativeRestConnector({
   description: "Read and upload objects on a Backblaze B2 bucket via the S3-compatible REST API at s3.{region}.backblazeb2.com.",
   auth: {
     kind: "api-key",
-    hint: "Backblaze B2 application key pair (accessKeyId + secretAccessKey) scoped to the target bucket. Region selects the s3.{region}.backblazeb2.com endpoint."
+    hint: 'Backblaze B2 application key pair as JSON: {"accessKeyId":"\u2026","secretAccessKey":"\u2026","region":"us-west-001"} scoped to the target bucket. Optional "endpoint" overrides the host. Requests are signed with AWS Signature V4 (S3-compatible); the region selects the s3.<region>.backblazeb2.com endpoint.'
   },
   category: "storage",
   defaultConsistencyModel: "authoritative",
-  // Endpoint is region-derived in the activepieces piece; the runtime
-  // resolves {region} from the credential bundle when constructing the
-  // request URL. The declarative-REST adapter takes a string baseUrl, so
-  // we keep the template here and rely on the runtime's URL resolver to
-  // substitute the region placeholder from the credential metadata.
+  // Backblaze B2 speaks the S3 API, so it signs with AWS SigV4 under the `s3`
+  // service. The runtime substitutes {region} from the credential bundle into
+  // the host template below (or honors an explicit bundle `endpoint`).
+  credentialPlacement: { kind: "aws-sigv4", service: "s3" },
   baseUrl: "https://s3.{region}.backblazeb2.com",
   test: { method: "GET", path: "/{bucket}?list-type=2&max-keys=1" },
   capabilities: [
@@ -113175,11 +113405,11 @@ var twinLabsConnector = declarativeRestConnector({
 // src/connectors/adapters/twitter.ts
 var AUTH_URL18 = "https://twitter.com/i/oauth2/authorize";
 var TOKEN_URL19 = "https://api.twitter.com/2/oauth2/token";
-var SCOPES14 = ["tweet.read", "tweet.write", "users.read", "like.write", "offline.access"];
+var SCOPES14 = ["tweet.read", "tweet.write", "users.read", "follows.read", "like.write", "like.read", "offline.access"];
 var TWITTER_SPEC = {
   kind: "twitter",
   displayName: "Twitter",
-  description: "Post tweets and reply to tweets on Twitter.",
+  description: "Read and verify Twitter/X engagement (follows, tweets, likes, retweets, mentions) and post or reply to tweets.",
   auth: {
     kind: "one_of",
     preferred: "oauth2",
@@ -113201,7 +113431,10 @@ var TWITTER_SPEC = {
   category: "comms",
   defaultConsistencyModel: "authoritative",
   baseUrl: "https://api.twitter.com/2",
-  test: { method: "GET", path: "/tweets/search/recent" },
+  // `/users/me` is the cheapest read that proves the grant: it needs only
+  // users.read, carries no required query param, and works on the free tier
+  // (unlike `/tweets/search/recent`, which 400s without a `query`).
+  test: { method: "GET", path: "/users/me" },
   capabilities: [
     {
       name: "tweets.create",
@@ -113299,6 +113532,123 @@ var TWITTER_SPEC = {
       },
       cas: "native-idempotency",
       externalEffect: true
+    },
+    // Read capabilities (official X API v2) — power quest verification in
+    // blueprint-agent. `users.me` is the anchor: it resolves the connected
+    // user id every other read needs. Optional `max_results` / `pagination_token`
+    // are dropped from the query when the caller omits them, so the declarative
+    // engine renders the bare endpoint by default. `following`, `liking_users`,
+    // and `retweeted_by` are gated behind a PAID X API tier at runtime — the
+    // capability is always present; availability is the registered app's tier.
+    {
+      name: "users.me",
+      class: "read",
+      description: 'Resolve the connected account (id, name, username) \u2014 anchors every other read. Pass user_fields (e.g. "public_metrics,created_at") to also fetch follower count and account age for anti-bot gating.',
+      parameters: {
+        type: "object",
+        properties: {
+          user_fields: {
+            type: "string",
+            description: 'Optional X `user.fields` selector, e.g. "public_metrics,created_at".'
+          }
+        }
+      },
+      request: { method: "GET", path: "/users/me", query: { "user.fields": "{user_fields}" } }
+    },
+    {
+      name: "users.following",
+      class: "read",
+      description: "List the accounts a user follows, for verifying follows and followed_by. Cursor with pagination_token. Gated behind a paid X API tier.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "User id whose following list to read (from users.me)." },
+          max_results: { type: "integer", description: "Page size (1\u20131000)." },
+          pagination_token: { type: "string", description: "Cursor from a prior page (meta.next_token)." }
+        },
+        required: ["id"]
+      },
+      request: {
+        method: "GET",
+        path: "/users/{id}/following",
+        query: { max_results: "{max_results}", pagination_token: "{pagination_token}" }
+      }
+    },
+    {
+      name: "users.tweets",
+      class: "read",
+      description: "List recent tweets authored by a user, for verifying tweeted. Hashtag filtering is applied by the caller. Cursor with pagination_token.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "Author user id (from users.me)." },
+          max_results: { type: "integer", description: "Page size (5\u2013100)." },
+          pagination_token: { type: "string", description: "Cursor from a prior page (meta.next_token)." }
+        },
+        required: ["id"]
+      },
+      request: {
+        method: "GET",
+        path: "/users/{id}/tweets",
+        query: { max_results: "{max_results}", "tweet.fields": "text,created_at", pagination_token: "{pagination_token}" }
+      }
+    },
+    {
+      name: "tweets.retweetedBy",
+      class: "read",
+      description: "List the accounts that retweeted a tweet, for verifying retweeted. Cursor with pagination_token. Gated behind a paid X API tier.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "Tweet id to inspect." },
+          max_results: { type: "integer", description: "Page size (1\u2013100)." },
+          pagination_token: { type: "string", description: "Cursor from a prior page (meta.next_token)." }
+        },
+        required: ["id"]
+      },
+      request: {
+        method: "GET",
+        path: "/tweets/{id}/retweeted_by",
+        query: { max_results: "{max_results}", pagination_token: "{pagination_token}" }
+      }
+    },
+    {
+      name: "tweets.likingUsers",
+      class: "read",
+      description: "List the accounts that liked a tweet, for verifying liked. Requires the like.read scope and a paid X API tier.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "Tweet id to inspect." },
+          max_results: { type: "integer", description: "Page size (1\u2013100)." },
+          pagination_token: { type: "string", description: "Cursor from a prior page (meta.next_token)." }
+        },
+        required: ["id"]
+      },
+      request: {
+        method: "GET",
+        path: "/tweets/{id}/liking_users",
+        query: { max_results: "{max_results}", pagination_token: "{pagination_token}" }
+      }
+    },
+    {
+      name: "users.mentions",
+      class: "read",
+      description: "List tweets that mention a user, for verifying mentioned. Author filtering is applied by the caller. Cursor with pagination_token.",
+      parameters: {
+        type: "object",
+        properties: {
+          id: { type: "string", description: "Mentioned user id (from users.me)." },
+          max_results: { type: "integer", description: "Page size (5\u2013100)." },
+          pagination_token: { type: "string", description: "Cursor from a prior page (meta.next_token)." }
+        },
+        required: ["id"]
+      },
+      request: {
+        method: "GET",
+        path: "/users/{id}/mentions",
+        query: { max_results: "{max_results}", "tweet.fields": "author_id,text", pagination_token: "{pagination_token}" }
+      }
     }
   ]
 };
@@ -124598,6 +124948,11 @@ export {
   exchangeAuthorizationCode,
   refreshAccessToken,
   _resetPendingFlowsForTests,
+  googleErrorReason,
+  classifyGoogleReason,
+  classifyGoogleError,
+  googleApiError,
+  googleTestFailureReason,
   googleCalendar,
   googleDrive,
   googleSheets,
@@ -125135,4 +125490,4 @@ export {
   demandbaseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-ZBMMGAE2.js.map
+//# sourceMappingURL=chunk-F6MF4YNI.js.map