@tangle-network/agent-integrations 0.50.0 → 0.51.0

package/dist/chunk-P4FFI752.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-P4FFI752.js.map

package/dist/chunk-PUXYDSXI.js

@@ -0,0 +1,109 @@
+import {
+  CONNECTOR_ADAPTER_FACTORIES,
+  adapters_exports
+} from "./chunk-XEJKVCXB.js";
+
+// src/connectors/bundled-manifests.ts
+var MANIFEST_PROBE_PREFIX = "tangle-adapter-metadata-";
+function isConnectorAdapter(value) {
+  if (!value || typeof value !== "object") return false;
+  const manifest = value.manifest;
+  if (!manifest || typeof manifest !== "object") return false;
+  return typeof manifest.kind === "string";
+}
+function manifestFromFactory(definition) {
+  const probeOptions = Object.fromEntries(
+    Object.keys(definition.envMap).map((name) => [name, `${MANIFEST_PROBE_PREFIX}${name}`])
+  );
+  try {
+    return definition.factory(probeOptions).manifest;
+  } catch {
+    return void 0;
+  }
+}
+var cachedManifests;
+var cachedByKind;
+function buildRegistry() {
+  const byKind = /* @__PURE__ */ new Map();
+  for (const value of Object.values(adapters_exports)) {
+    if (isConnectorAdapter(value)) byKind.set(value.manifest.kind, value.manifest);
+  }
+  for (const definition of CONNECTOR_ADAPTER_FACTORIES) {
+    if (byKind.has(definition.kind)) continue;
+    const manifest = manifestFromFactory(definition);
+    if (manifest) byKind.set(manifest.kind, manifest);
+  }
+  return byKind;
+}
+function registry() {
+  if (!cachedByKind) cachedByKind = buildRegistry();
+  return cachedByKind;
+}
+function listBundledAdapterManifests() {
+  if (!cachedManifests) {
+    cachedManifests = [...registry().values()].sort((a, b) => a.kind.localeCompare(b.kind));
+  }
+  return cachedManifests;
+}
+function getBundledAdapterManifest(kind) {
+  return registry().get(kind);
+}
+function hasBundledAdapter(kind) {
+  return registry().has(kind);
+}
+function listBundledAdapterKinds() {
+  return listBundledAdapterManifests().map((manifest) => manifest.kind);
+}
+function bundledAuthMode(manifest) {
+  const auth = manifest.auth;
+  const effective = auth.kind === "one_of" ? auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0] : auth;
+  switch (effective.kind) {
+    case "oauth2":
+      return effective.grantType === "client_credentials" ? "oauth2_client_credentials" : "oauth2";
+    case "api-key":
+      return "api_key";
+    case "hmac":
+      return "hmac";
+    case "none":
+      return "none";
+    default:
+      return void 0;
+  }
+}
+function bundledApiKeyHint(manifest) {
+  const auth = manifest.auth;
+  const candidates = auth.kind === "one_of" ? auth.options : [auth];
+  for (const candidate of candidates) {
+    if (candidate.kind === "api-key") return candidate.hint;
+  }
+  return void 0;
+}
+function bundledOAuth2Auth(manifest) {
+  const auth = manifest.auth;
+  const candidates = auth.kind === "one_of" ? auth.options.filter((option) => option.kind === auth.preferred) : [auth];
+  for (const candidate of candidates) {
+    if (candidate.kind !== "oauth2") continue;
+    if (candidate.grantType === "client_credentials") continue;
+    if (!candidate.authorizationUrl) continue;
+    return {
+      authorizationUrl: candidate.authorizationUrl,
+      tokenUrl: candidate.tokenUrl,
+      scopes: candidate.scopes,
+      clientIdEnv: candidate.clientIdEnv,
+      clientSecretEnv: candidate.clientSecretEnv,
+      extraAuthParams: candidate.extraAuthParams
+    };
+  }
+  return void 0;
+}
+
+export {
+  listBundledAdapterManifests,
+  getBundledAdapterManifest,
+  hasBundledAdapter,
+  listBundledAdapterKinds,
+  bundledAuthMode,
+  bundledApiKeyHint,
+  bundledOAuth2Auth
+};
+//# sourceMappingURL=chunk-PUXYDSXI.js.map

package/dist/chunk-PUXYDSXI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connectors/bundled-manifests.ts"],"sourcesContent":["import {\n  CONNECTOR_ADAPTER_FACTORIES,\n  type ConnectorAdapterFactoryDefinition,\n} from './adapters/factories.js'\nimport * as bundledAdapters from './adapters/index.js'\nimport type { ConnectorAdapter, ConnectorManifest } from './types.js'\n\n/**\n * The bundled adapter registry — the single source of truth for \"which\n * connectors does this package actually implement, and how do they really\n * authenticate\".\n *\n * This exists because the answer was previously maintained by hand in two\n * places that drifted apart: `specs/registry.ts` carried an 18-name\n * `EXECUTABLE_KINDS` set while the package shipped 530 adapters, and the\n * platform kept its own private `collectBundledAdapters()` copy. A catalog\n * that describes connectors must derive from the connectors, never restate\n * them — restating is what let QuickBooks and Xero advertise a\n * `https://example.invalid/...` authorization URL behind a live Connect\n * button.\n *\n * Manifests are static data. Factory-style adapters need client credentials\n * to *execute*, but their manifest (auth endpoints, scopes, capability list)\n * is fixed at definition time, so we instantiate them with clearly-marked\n * placeholder options purely to read that static shape. The placeholders are\n * never used to make a request — {@link listBundledAdapterManifests} returns\n * manifests, not adapters.\n */\n\n/** Placeholder marker for factory options resolved only to read a manifest. */\nconst MANIFEST_PROBE_PREFIX = 'tangle-adapter-metadata-'\n\nfunction isConnectorAdapter(value: unknown): value is ConnectorAdapter {\n  if (!value || typeof value !== 'object') return false\n  const manifest = (value as { manifest?: unknown }).manifest\n  if (!manifest || typeof manifest !== 'object') return false\n  return typeof (manifest as { kind?: unknown }).kind === 'string'\n}\n\nfunction manifestFromFactory(\n  definition: ConnectorAdapterFactoryDefinition,\n): ConnectorManifest | undefined {\n  const probeOptions = Object.fromEntries(\n    Object.keys(definition.envMap).map((name) => [name, `${MANIFEST_PROBE_PREFIX}${name}`]),\n  )\n  try {\n    return definition.factory(probeOptions).manifest\n  } catch {\n    // A factory that cannot be constructed from placeholder options cannot\n    // contribute a manifest. Skipping is correct: it means the adapter is not\n    // describable without real credentials, so the catalog must not claim it.\n    return undefined\n  }\n}\n\nlet cachedManifests: ConnectorManifest[] | undefined\nlet cachedByKind: Map<string, ConnectorManifest> | undefined\n\nfunction buildRegistry(): Map<string, ConnectorManifest> {\n  const byKind = new Map<string, ConnectorManifest>()\n  for (const value of Object.values(bundledAdapters)) {\n    if (isConnectorAdapter(value)) byKind.set(value.manifest.kind, value.manifest)\n  }\n  for (const definition of CONNECTOR_ADAPTER_FACTORIES) {\n    if (byKind.has(definition.kind)) continue\n    const manifest = manifestFromFactory(definition)\n    if (manifest) byKind.set(manifest.kind, manifest)\n  }\n  return byKind\n}\n\nfunction registry(): Map<string, ConnectorManifest> {\n  if (!cachedByKind) cachedByKind = buildRegistry()\n  return cachedByKind\n}\n\n/** Every connector manifest this package bundles, sorted by kind. */\nexport function listBundledAdapterManifests(): ConnectorManifest[] {\n  if (!cachedManifests) {\n    cachedManifests = [...registry().values()].sort((a, b) => a.kind.localeCompare(b.kind))\n  }\n  return cachedManifests\n}\n\n/** The bundled manifest for `kind`, or undefined when nothing implements it. */\nexport function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined {\n  return registry().get(kind)\n}\n\n/** Whether this package ships a real, executable adapter for `kind`. */\nexport function hasBundledAdapter(kind: string): boolean {\n  return registry().has(kind)\n}\n\n/** Kinds this package implements. */\nexport function listBundledAdapterKinds(): string[] {\n  return listBundledAdapterManifests().map((manifest) => manifest.kind)\n}\n\n/**\n * How a bundled connector really authenticates.\n *\n * `oauth2_client_credentials` is called out separately because it IS a\n * connectable mode but has no user-facing authorize step — a caller that\n * treats \"oauth2 without an authorizationUrl\" as broken would wrongly condemn\n * these machine-to-machine providers.\n */\nexport type BundledAuthMode =\n  | 'oauth2'\n  | 'oauth2_client_credentials'\n  | 'api_key'\n  | 'hmac'\n  | 'none'\n\n/** The auth mode a connect flow would actually drive for this manifest,\n *  resolving `one_of` through its declared `preferred` mode. */\nexport function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined {\n  const auth = manifest.auth\n  const effective =\n    auth.kind === 'one_of'\n      ? (auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0])\n      : auth\n  switch (effective.kind) {\n    case 'oauth2':\n      return effective.grantType === 'client_credentials' ? 'oauth2_client_credentials' : 'oauth2'\n    case 'api-key':\n      return 'api_key'\n    case 'hmac':\n      return 'hmac'\n    case 'none':\n      return 'none'\n    default:\n      return undefined\n  }\n}\n\n/** The setup hint an api-key connector shows when collecting its credential. */\nexport function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined {\n  const auth = manifest.auth\n  const candidates = auth.kind === 'one_of' ? auth.options : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind === 'api-key') return candidate.hint\n  }\n  return undefined\n}\n\n/** The authorization-code OAuth2 branch of a manifest's auth spec, if it has\n *  one. `one_of` manifests are resolved through their `preferred` mode, which\n *  is the mode a connect flow would actually drive. Returns undefined for\n *  api-key/hmac/none connectors and for `client_credentials` OAuth (which has\n *  no user-facing authorize step). */\nexport function bundledOAuth2Auth(manifest: ConnectorManifest):\n  | {\n      authorizationUrl: string\n      tokenUrl: string\n      scopes: string[]\n      clientIdEnv: string\n      clientSecretEnv: string\n      extraAuthParams?: Record<string, string>\n    }\n  | undefined {\n  const auth = manifest.auth\n  const candidates =\n    auth.kind === 'one_of'\n      ? auth.options.filter((option) => option.kind === auth.preferred)\n      : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind !== 'oauth2') continue\n    if (candidate.grantType === 'client_credentials') continue\n    if (!candidate.authorizationUrl) continue\n    return {\n      authorizationUrl: candidate.authorizationUrl,\n      tokenUrl: candidate.tokenUrl,\n      scopes: candidate.scopes,\n      clientIdEnv: candidate.clientIdEnv,\n      clientSecretEnv: candidate.clientSecretEnv,\n      extraAuthParams: candidate.extraAuthParams,\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;AA8BA,IAAM,wBAAwB;AAE9B,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,SAAO,OAAQ,SAAgC,SAAS;AAC1D;AAEA,SAAS,oBACP,YAC+B;AAC/B,QAAM,eAAe,OAAO;AAAA,IAC1B,OAAO,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,qBAAqB,GAAG,IAAI,EAAE,CAAC;AAAA,EACxF;AACA,MAAI;AACF,WAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,EAC1C,QAAQ;AAIN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,IAAI;AAEJ,SAAS,gBAAgD;AACvD,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,SAAS,OAAO,OAAO,gBAAe,GAAG;AAClD,QAAI,mBAAmB,KAAK,EAAG,QAAO,IAAI,MAAM,SAAS,MAAM,MAAM,QAAQ;AAAA,EAC/E;AACA,aAAW,cAAc,6BAA6B;AACpD,QAAI,OAAO,IAAI,WAAW,IAAI,EAAG;AACjC,UAAM,WAAW,oBAAoB,UAAU;AAC/C,QAAI,SAAU,QAAO,IAAI,SAAS,MAAM,QAAQ;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,WAA2C;AAClD,MAAI,CAAC,aAAc,gBAAe,cAAc;AAChD,SAAO;AACT;AAGO,SAAS,8BAAmD;AACjE,MAAI,CAAC,iBAAiB;AACpB,sBAAkB,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAGO,SAAS,0BAA0B,MAA6C;AACrF,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,0BAAoC;AAClD,SAAO,4BAA4B,EAAE,IAAI,CAAC,aAAa,SAAS,IAAI;AACtE;AAmBO,SAAS,gBAAgB,UAA0D;AACxF,QAAM,OAAO,SAAS;AACtB,QAAM,YACJ,KAAK,SAAS,WACT,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,IAChF;AACN,UAAQ,UAAU,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,UAAU,cAAc,uBAAuB,8BAA8B;AAAA,IACtF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,kBAAkB,UAAiD;AACjF,QAAM,OAAO,SAAS;AACtB,QAAM,aAAa,KAAK,SAAS,WAAW,KAAK,UAAU,CAAC,IAAI;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,UAAW,QAAO,UAAU;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,UASpB;AACZ,QAAM,OAAO,SAAS;AACtB,QAAM,aACJ,KAAK,SAAS,WACV,KAAK,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,IAC9D,CAAC,IAAI;AACX,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,SAAU;AACjC,QAAI,UAAU,cAAc,qBAAsB;AAClD,QAAI,CAAC,UAAU,iBAAkB;AACjC,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,iBAAiB,UAAU;AAAA,MAC3B,iBAAiB,UAAU;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-RM6JJK4Q.js → chunk-XEJKVCXB.js}

@@ -1008,6 +1008,24 @@ function declarativeRestConnector(spec) {
     async executeMutation(inv) {
       const op = readOperation(spec, inv.capabilityName, "mutation");
       const response = await executeRestRequest(spec, op.request, inv, requiredArgsOf(op.parameters));
+      if (response.outcome === "conflict") {
+        return {
+          status: "conflict",
+          alternatives: [],
+          // The upstream's parsed body — the contract calls this "the current
+          // authoritative state", so it must be what the provider returned,
+          // not the transport's own wrapper.
+          currentState: response.data,
+          message: response.message || `${spec.displayName} rejected the write on a state conflict`
+        };
+      }
+      if (response.outcome === "rate-limited") {
+        return {
+          status: "rate-limited",
+          retryAfterMs: response.retryAfterMs ?? DEFAULT_RETRY_AFTER_MS,
+          message: response.message || `${spec.displayName} throttled the write`
+        };
+      }
       return {
         status: "committed",
         data: response.data,
@@ -1087,11 +1105,12 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
   const awsRegion = aws ? resolveAwsRegion(aws, inv.source.metadata, placement) : void 0;
   let baseUrl = resolveBaseUrl(spec.baseUrl, inv.source.metadata);
   if (aws) baseUrl = applyRegionTemplate(baseUrl, awsRegion, aws.endpoint);
-  const renderedPath = interpolate(request.path, inv.args).replace(/^\/+/, "");
+  const scope = renderScope(inv);
+  const renderedPath = interpolate(request.path, scope).replace(/^\/+/, "");
   const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
   const url = new URL(renderedPath, baseWithSlash);
   for (const [key, value] of Object.entries(request.query ?? {})) {
-    const rendered = renderQueryValue(value, inv.args);
+    const rendered = renderQueryValue(value, scope);
     if (rendered !== void 0 && rendered !== "") url.searchParams.set(key, String(rendered));
   }
   const requestHeaders = request.headers ?? {};
@@ -1100,7 +1119,7 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
   const headers = {
     accept: "application/json",
     ...spec.defaultHeaders,
-    ...renderHeaders(renderableHeaders, inv.args)
+    ...renderHeaders(renderableHeaders, scope)
   };
   if (hostOverride) url.host = hostOverride.replace(/\{region\}/g, awsRegion);
   if (inv.expectedEtag) headers["if-match"] = inv.expectedEtag;
@@ -1108,7 +1127,7 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
   if (sendsBody && getHeaderCI(headers, "content-type") === void 0) {
     headers["content-type"] = "application/json";
   }
-  const bodyString = sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, requiredArgs)) : void 0;
+  const bodyString = sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, scope, requiredArgs)) : void 0;
   if (placement.kind === "aws-sigv4") {
     signAwsRequest(headers, url, {
       method: request.method,
@@ -1130,21 +1149,21 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
     throw new CredentialsExpired(`${spec.displayName} rejected credentials (${res.status})`, inv.source.id);
   }
   if (res.status === 409 || res.status === 412) {
+    const text2 = await safeErrorText(res);
     return {
-      data: {
-        status: "conflict",
-        message: await safeErrorText(res)
-      },
+      data: parseBodyText(text2),
+      outcome: "conflict",
+      message: text2,
       etag: res.headers.get("etag") ?? void 0
     };
   }
   if (res.status === 429) {
+    const text2 = await safeErrorText(res);
     return {
-      data: {
-        status: "rate-limited",
-        retryAfter: res.headers.get("retry-after") ?? void 0,
-        message: await safeErrorText(res)
-      }
+      data: parseBodyText(text2),
+      outcome: "rate-limited",
+      message: text2,
+      retryAfterMs: retryAfterMsFromHeader(res.headers.get("retry-after"))
     };
   }
   if (request.existenceCheck && (res.status === 204 || res.status === 404)) {
@@ -1218,10 +1237,34 @@ function signAwsRequest(headers, url, opts) {
   headers["x-amz-date"] = signed.amzDate;
   headers.authorization = signed.authorization;
 }
-function resolveBody(body, args, requiredArgs) {
+function resolveBody(body, args, scope, requiredArgs) {
   if (!body || body === "args") return args;
-  if (typeof body === "string") return renderValue(body, args, requiredArgs);
-  return renderObject(body, args, requiredArgs);
+  if (typeof body === "string") return renderValue(body, scope, requiredArgs);
+  return renderObject(body, scope, requiredArgs);
+}
+var DEFAULT_RETRY_AFTER_MS = 6e4;
+var MIN_RETRY_AFTER_MS = 1e3;
+function parseBodyText(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { raw: text };
+  }
+}
+function retryAfterMsFromHeader(raw) {
+  if (typeof raw === "string" && raw.trim()) {
+    const seconds = Number(raw);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+      return Math.max(MIN_RETRY_AFTER_MS, Math.round(seconds * 1e3));
+    }
+    const at = Date.parse(raw);
+    if (Number.isFinite(at)) return Math.max(MIN_RETRY_AFTER_MS, at - Date.now());
+  }
+  return DEFAULT_RETRY_AFTER_MS;
+}
+function renderScope(inv) {
+  return { ...inv.args, connection: inv.source.metadata };
 }
 function renderHeaders(headers, args) {
   return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, interpolate(value, args)]));
@@ -18364,8 +18407,71 @@ var quickbooksConnector = declarativeRestConnector({
   defaultHeaders: {
     accept: "application/json"
   },
-  test: { method: "GET", path: "companyinfo/{realmId}", query: { minorversion: "70" } },
+  // `realmId` is pinned at connect time, not passed per call, so the health
+  // check reads it from connection metadata. Written as `{realmId}` it resolved
+  // against the (empty) test argument map and threw before any request was
+  // made — the connection test could never pass, for any connection.
+  test: { method: "GET", path: "companyinfo/{connection.realmId}", query: { minorversion: "70" } },
   capabilities: [
+    {
+      // The reports namespace is NOT reachable through `entities.query` — QBO
+      // exposes the accountant-grade statements only under /reports/{name}.
+      // These four are the tax/bookkeeping read surface; without them a tax
+      // agent can enumerate ledger rows but cannot obtain a P&L or a balance
+      // sheet, which is what a return is actually built from.
+      name: "reports.get",
+      class: "read",
+      description: "Run a QuickBooks Online report. `reportName` is the QBO report id (ProfitAndLoss, BalanceSheet, TrialBalance, GeneralLedger, CashFlow, AgedReceivables, AgedPayables).",
+      parameters: {
+        type: "object",
+        properties: {
+          reportName: {
+            type: "string",
+            enum: [
+              "ProfitAndLoss",
+              "BalanceSheet",
+              "TrialBalance",
+              "GeneralLedger",
+              "CashFlow",
+              "AgedReceivables",
+              "AgedPayables"
+            ]
+          },
+          start_date: { type: "string", description: "YYYY-MM-DD (inclusive)." },
+          end_date: { type: "string", description: "YYYY-MM-DD (inclusive)." },
+          accounting_method: { type: "string", enum: ["Cash", "Accrual"] },
+          date_macro: { type: "string", description: 'e.g. "Last Fiscal Year" \u2014 alternative to start/end dates.' },
+          summarize_column_by: { type: "string", description: "e.g. Month, Quarter, Year, Total." },
+          minorversion: { type: "string" }
+        },
+        required: ["reportName"]
+      },
+      request: {
+        method: "GET",
+        path: "reports/{reportName}",
+        query: {
+          start_date: "{start_date}",
+          end_date: "{end_date}",
+          accounting_method: "{accounting_method}",
+          date_macro: "{date_macro}",
+          summarize_column_by: "{summarize_column_by}",
+          minorversion: "{minorversion}"
+        }
+      },
+      requiredScopes: ["com.intuit.quickbooks.accounting"]
+    },
+    {
+      name: "companyinfo.get",
+      class: "read",
+      description: "Read the connected QuickBooks company profile (legal name, EIN/company id, fiscal year start, country) for the realm this connection was authorized against.",
+      parameters: { type: "object", properties: { minorversion: { type: "string" } } },
+      request: {
+        method: "GET",
+        path: "companyinfo/{connection.realmId}",
+        query: { minorversion: "{minorversion}" }
+      },
+      requiredScopes: ["com.intuit.quickbooks.accounting"]
+    },
     {
       name: "entities.query",
       class: "read",
@@ -18722,7 +18828,15 @@ var xeroConnector = declarativeRestConnector({
     kind: "oauth2",
     authorizationUrl: "https://login.xero.com/identity/connect/authorize",
     tokenUrl: "https://identity.xero.com/connect/token",
-    scopes: ["offline_access", "accounting.contacts", "accounting.transactions", "accounting.settings.read"],
+    // `accounting.reports.read` is a distinct Xero scope — the reports
+    // namespace is not covered by settings/transactions and 403s without it.
+    scopes: [
+      "offline_access",
+      "accounting.contacts",
+      "accounting.transactions",
+      "accounting.settings.read",
+      "accounting.reports.read"
+    ],
     clientIdEnv: "XERO_OAUTH_CLIENT_ID",
     clientSecretEnv: "XERO_OAUTH_CLIENT_SECRET"
   },
@@ -18732,6 +18846,54 @@ var xeroConnector = declarativeRestConnector({
   defaultHeaders: { accept: "application/json" },
   test: { method: "GET", path: "/connections" },
   capabilities: [
+    {
+      // Every other Xero capability REQUIRES `tenantId`, and a tenant id is an
+      // opaque GUID no caller can know before asking. Without this read the
+      // connector is unusable by an agent: the only place the id appeared was
+      // the health check, which discards its body.
+      name: "tenants.list",
+      class: "read",
+      description: "List the Xero organizations (tenants) this connection is authorized for. Call this FIRST \u2014 every other Xero capability requires the `tenantId` returned here.",
+      parameters: { type: "object", properties: {} },
+      request: { method: "GET", path: "/connections" }
+    },
+    {
+      // Xero's reporting surface, like QBO's, is a separate namespace from the
+      // record endpoints. These are the statements a return or a books review
+      // is actually built from.
+      name: "reports.get",
+      class: "read",
+      description: "Run a Xero accounting report. `reportName` is the Xero report id (ProfitAndLoss, BalanceSheet, TrialBalance, BankSummary, AgedReceivablesByContact, AgedPayablesByContact).",
+      parameters: {
+        type: "object",
+        properties: {
+          tenantId: { type: "string", description: "From tenants.list." },
+          reportName: {
+            type: "string",
+            enum: [
+              "ProfitAndLoss",
+              "BalanceSheet",
+              "TrialBalance",
+              "BankSummary",
+              "AgedReceivablesByContact",
+              "AgedPayablesByContact"
+            ]
+          },
+          fromDate: { type: "string", description: "YYYY-MM-DD." },
+          toDate: { type: "string", description: "YYYY-MM-DD." },
+          date: { type: "string", description: "YYYY-MM-DD \u2014 point-in-time reports (BalanceSheet, TrialBalance)." },
+          contactId: { type: "string", description: "Required by the aged receivables/payables reports." }
+        },
+        required: ["tenantId", "reportName"]
+      },
+      request: {
+        method: "GET",
+        path: "/api.xro/2.0/Reports/{reportName}",
+        query: { fromDate: "{fromDate}", toDate: "{toDate}", date: "{date}", contactID: "{contactId}" },
+        headers: { "xero-tenant-id": "{tenantId}" }
+      },
+      requiredScopes: ["accounting.reports.read"]
+    },
     {
       name: "contacts.search",
       class: "read",
@@ -125794,4 +125956,4 @@ export {
   demandbaseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-RM6JJK4Q.js.map
+//# sourceMappingURL=chunk-XEJKVCXB.js.map