@tangle-network/agent-integrations 0.53.29 → 0.53.32

package/dist/{chunk-ARONCYSG.js → chunk-FOIC32DF.js}

@@ -181,6 +181,10 @@ __export(adapters_exports, {
   copperConnector: () => copperConnector,
   copyAiConnector: () => copyAiConnector,
   couchbaseConnector: () => couchbaseConnector,
+  createKafkaConnector: () => createKafkaConnector,
+  createMySqlConnector: () => createMySqlConnector,
+  createRabbitMqConnector: () => createRabbitMqConnector,
+  createRedisConnector: () => createRedisConnector,
   createSftpConnector: () => createSftpConnector,
   createTangleIdentityClient: () => createTangleIdentityClient,
   crispConnector: () => crispConnector,
@@ -217,6 +221,7 @@ __export(adapters_exports, {
   dripConnector: () => dripConnector,
   dropboxConnector: () => dropboxConnector,
   dubConnector: () => dubConnector,
+  duckdbConnector: () => duckdbConnector,
   dumplingAiConnector: () => dumplingAiConnector,
   dustConnector: () => dustConnector,
   easyPeasyAiConnector: () => easyPeasyAiConnector,
@@ -352,6 +357,7 @@ __export(adapters_exports, {
   jotformConnector: () => jotformConnector,
   justInvoiceConnector: () => justInvoiceConnector,
   justcallConnector: () => justcallConnector,
+  kafkaConnector: () => kafkaConnector,
   kallabotAiConnector: () => kallabotAiConnector,
   kapsoConnector: () => kapsoConnector,
   kimaiConnector: () => kimaiConnector,
@@ -436,6 +442,7 @@ __export(adapters_exports, {
   mondayConnector: () => mondayConnector,
   mongodbConnector: () => mongodbConnector,
   mycaseConnector: () => mycaseConnector,
+  mysqlConnector: () => mysqlConnector,
   n8nConnector: () => n8nConnector,
   netlifyConnector: () => netlifyConnector,
   netsuiteConnector: () => netsuiteConnector,
@@ -498,6 +505,7 @@ __export(adapters_exports, {
   predictLeadsConnector: () => predictLeadsConnector,
   productboardConnector: () => productboardConnector,
   proxycurlConnector: () => proxycurlConnector,
+  publicKafkaSocketFactory: () => publicKafkaSocketFactory,
   pushbulletConnector: () => pushbulletConnector,
   pushoverConnector: () => pushoverConnector,
   qawafelConnector: () => qawafelConnector,
@@ -505,6 +513,7 @@ __export(adapters_exports, {
   quadernoConnector: () => quadernoConnector,
   quickbooksConnector: () => quickbooksConnector,
   quickzuConnector: () => quickzuConnector,
+  rabbitMqConnector: () => rabbitMqConnector,
   raiaAiConnector: () => raiaAiConnector,
   rampConnector: () => rampConnector,
   rapidtextAiConnector: () => rapidtextAiConnector,
@@ -512,6 +521,7 @@ __export(adapters_exports, {
   recallAiConnector: () => recallAiConnector,
   recurlyConnector: () => recurlyConnector,
   redditConnector: () => redditConnector,
+  redisConnector: () => redisConnector,
   reoonVerifierConnector: () => reoonVerifierConnector,
   replyIoConnector: () => replyIoConnector,
   resolveConnectorAdapterFactoryOptions: () => resolveConnectorAdapterFactoryOptions,
@@ -1120,6 +1130,10 @@ function sameUrl(left, right) {
 function applyCredentials(headers, url, placement, credentials) {
   const token = credentialToken(credentials);
   if (placement.kind === "bearer") headers.authorization = `Bearer ${token}`;
+  if (placement.kind === "authorization-by-auth") {
+    const prefix = credentials.kind === "oauth2" ? placement.oauth2Prefix ?? "Bearer " : placement.apiKeyPrefix ?? "";
+    headers.authorization = `${prefix}${token}`;
+  }
   if (placement.kind === "basic-api-key") {
     headers.authorization = `Basic ${Buffer.from(`${token}:`).toString("base64")}`;
   }
@@ -6497,6 +6511,294 @@ var digitalPilotConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/duckdb.ts
+import {
+  DuckDBInstance
+} from "@duckdb/node-api";
+var MAX_ARGUMENTS = 100;
+var MAX_COLUMNS2 = 256;
+var MAX_EXECUTION_MS = 5e3;
+var MAX_INPUT_BYTES = 10 * 1024 * 1024;
+var MAX_QUERY_BYTES = 2e4;
+var MAX_RESULT_BYTES = 10 * 1024 * 1024;
+var MAX_ROWS = 1e4;
+var MAX_SCHEMA_DEPTH = 16;
+var MAX_TABLES = 16;
+var TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/;
+var duckdbConnector = {
+  manifest: {
+    kind: "duckdb",
+    displayName: "DuckDB",
+    description: "Load bounded JSON tables into a throwaway in-memory DuckDB database and run a parameterized query.",
+    auth: { kind: "none" },
+    defaultConsistencyModel: "advisory",
+    category: "database",
+    capabilities: [
+      {
+        name: "create.and.query.db",
+        class: "read",
+        description: "Create in-memory tables from JSON arrays and return a bounded parameterized SQL query result.",
+        parameters: {
+          type: "object",
+          properties: {
+            tables: {
+              type: "array",
+              minItems: 1,
+              maxItems: MAX_TABLES,
+              items: {
+                type: "object",
+                properties: {
+                  name: { type: "string", pattern: TABLE_NAME.source, maxLength: 63 },
+                  data: { type: "array", maxItems: MAX_ROWS, items: { type: "object" } },
+                  schema: { type: "object", maxProperties: MAX_COLUMNS2 }
+                },
+                required: ["name", "data"],
+                additionalProperties: false
+              }
+            },
+            query: {
+              type: "string",
+              minLength: 1,
+              maxLength: MAX_QUERY_BYTES,
+              description: "A single relation-returning SQL query. Use $1, $2, and args for dynamic values."
+            },
+            args: {
+              type: "array",
+              maxItems: MAX_ARGUMENTS,
+              items: { type: ["string", "number", "boolean", "null"] }
+            },
+            maxRows: { type: "integer", minimum: 1, maximum: MAX_ROWS, default: 1e3 }
+          },
+          required: ["tables", "query"],
+          additionalProperties: false
+        }
+      }
+    ]
+  },
+  async executeRead({ capabilityName, args }) {
+    if (capabilityName !== "create.and.query.db") {
+      throw new Error(`Unknown DuckDB capability: ${capabilityName}`);
+    }
+    const tables = readTables(args.tables);
+    const query2 = readQuery(args.query);
+    const queryArgs = readArguments(args.args);
+    const maxRows = readBoundedInteger(args.maxRows, 1e3, 1, MAX_ROWS, "maxRows");
+    const instance = await DuckDBInstance.create(":memory:");
+    let connection;
+    let timedOut = false;
+    let timeout;
+    try {
+      const activeConnection = await instance.connect();
+      connection = activeConnection;
+      timeout = setTimeout(() => {
+        timedOut = true;
+        activeConnection.interrupt();
+      }, MAX_EXECUTION_MS);
+      await configureConnection(activeConnection);
+      throwIfTimedOut(timedOut);
+      for (const table of tables) {
+        await loadTable(activeConnection, table);
+        throwIfTimedOut(timedOut);
+      }
+      const reader = await activeConnection.runAndReadAll(
+        `SELECT * FROM (${query2}) AS "_tangle_result" LIMIT ${maxRows + 1}`,
+        queryArgs
+      );
+      throwIfTimedOut(timedOut);
+      const allRows = reader.getRowObjectsJson();
+      const truncated = allRows.length > maxRows;
+      const rows = truncated ? allRows.slice(0, maxRows) : allRows;
+      assertResultSize(rows);
+      return {
+        data: {
+          rows,
+          rowCount: rows.length,
+          truncated,
+          columns: reader.columnNameAndTypeObjectsJson()
+        },
+        fetchedAt: Date.now()
+      };
+    } catch (error) {
+      if (timedOut) throw new Error(`DuckDB execution exceeded ${MAX_EXECUTION_MS}ms`);
+      throw error;
+    } finally {
+      if (timeout) clearTimeout(timeout);
+      try {
+        connection?.closeSync();
+      } finally {
+        instance.closeSync();
+      }
+    }
+  },
+  async test() {
+    const instance = await DuckDBInstance.create(":memory:");
+    let connection;
+    try {
+      const activeConnection = await instance.connect();
+      connection = activeConnection;
+      await configureConnection(activeConnection);
+      const reader = await activeConnection.runAndReadAll("SELECT 1 AS ok");
+      if (reader.getRowObjectsJson()[0]?.ok !== 1) return { ok: false, reason: "DuckDB SELECT 1 returned an unexpected result" };
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    } finally {
+      try {
+        connection?.closeSync();
+      } finally {
+        instance.closeSync();
+      }
+    }
+  }
+};
+async function configureConnection(connection) {
+  await connection.run(`
+    SET memory_limit = '256MB';
+    SET max_temp_directory_size = '0B';
+    SET threads = 2;
+    SET enable_logging = false;
+    SET enable_external_access = false;
+    SET lock_configuration = true;
+  `);
+}
+async function loadTable(connection, table) {
+  const sourceData = stringifyJson(table.data, `${table.name}.data`);
+  let sourceSchema;
+  if (table.schema) {
+    assertDuckDbSchema(table.schema, `${table.name}.schema`);
+    sourceSchema = stringifyJson([table.schema], `${table.name}.schema`);
+  } else {
+    if (table.data.length === 0) {
+      throw new Error(`${table.name}.schema is required when data is empty`);
+    }
+    const detected = await connection.runAndReadAll(
+      "SELECT json_structure($sourceData) AS schema",
+      { sourceData }
+    );
+    const value = detected.getRowsJson()[0]?.[0];
+    if (typeof value !== "string") throw new Error(`Could not infer a schema for ${table.name}`);
+    let detectedSchema;
+    try {
+      detectedSchema = JSON.parse(value);
+    } catch {
+      throw new Error(`Could not parse the inferred schema for ${table.name}`);
+    }
+    assertDuckDbSchema(detectedSchema, `${table.name}.inferredSchema`);
+    sourceSchema = value;
+  }
+  await connection.run(
+    `CREATE TABLE ${quoteIdentifier(table.name)} AS
+       SELECT UNNEST(JSON_TRANSFORM($sourceData, $sourceSchema), recursive := true)`,
+    { sourceData, sourceSchema }
+  );
+}
+function readTables(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_TABLES) {
+    throw new Error(`tables must contain 1 through ${MAX_TABLES} entries`);
+  }
+  assertInputSize(value);
+  let totalRows = 0;
+  const tables = value.map((entry, tableIndex) => {
+    if (!isPlainRecord(entry)) throw new Error(`tables[${tableIndex}] must be an object`);
+    const { name, data: data4, schema } = entry;
+    if (typeof name !== "string" || !TABLE_NAME.test(name)) {
+      throw new Error(`tables[${tableIndex}].name must be a safe SQL identifier`);
+    }
+    if (!Array.isArray(data4) || data4.length > MAX_ROWS) {
+      throw new Error(`tables[${tableIndex}].data must contain at most ${MAX_ROWS} rows`);
+    }
+    const records = data4.map((record, rowIndex) => {
+      if (!isPlainRecord(record)) throw new Error(`tables[${tableIndex}].data[${rowIndex}] must be an object`);
+      if (Object.keys(record).length > MAX_COLUMNS2) {
+        throw new Error(`tables[${tableIndex}].data[${rowIndex}] exceeds ${MAX_COLUMNS2} columns`);
+      }
+      return record;
+    });
+    const columns = new Set(records.flatMap((record) => Object.keys(record)));
+    if (columns.size > MAX_COLUMNS2) {
+      throw new Error(`tables[${tableIndex}].data exceeds ${MAX_COLUMNS2} distinct columns`);
+    }
+    totalRows += records.length;
+    if (totalRows > MAX_ROWS) throw new Error(`tables exceed the ${MAX_ROWS}-row total limit`);
+    if (schema !== void 0 && (!isPlainRecord(schema) || Object.keys(schema).length > MAX_COLUMNS2)) {
+      throw new Error(`tables[${tableIndex}].schema must contain at most ${MAX_COLUMNS2} fields`);
+    }
+    return { name, data: records, schema };
+  });
+  if (new Set(tables.map((table) => table.name.toLowerCase())).size !== tables.length) {
+    throw new Error("table names must be unique ignoring case");
+  }
+  return tables;
+}
+function readQuery(value) {
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error("query is required");
+  if (Buffer.byteLength(value, "utf8") > MAX_QUERY_BYTES) {
+    throw new Error(`query exceeds the ${MAX_QUERY_BYTES}-byte limit`);
+  }
+  return value.trim().replace(/;\s*$/, "");
+}
+function readArguments(value) {
+  if (value === void 0 || value === null) return {};
+  if (!Array.isArray(value) || value.length > MAX_ARGUMENTS) {
+    throw new Error(`args must contain at most ${MAX_ARGUMENTS} scalar values`);
+  }
+  return Object.fromEntries(value.map((entry, index) => {
+    if (entry !== null && typeof entry !== "string" && typeof entry !== "number" && typeof entry !== "boolean") {
+      throw new Error(`args[${index}] must be a string, number, boolean, or null`);
+    }
+    if (typeof entry === "number" && !Number.isFinite(entry)) throw new Error(`args[${index}] must be finite`);
+    return [String(index + 1), entry];
+  }));
+}
+function assertInputSize(value) {
+  const serialized = stringifyJson(value, "tables");
+  if (Buffer.byteLength(serialized, "utf8") > MAX_INPUT_BYTES) {
+    throw new Error(`tables exceed the ${MAX_INPUT_BYTES}-byte input limit`);
+  }
+}
+function assertResultSize(rows) {
+  const serialized = stringifyJson(rows, "DuckDB result");
+  if (Buffer.byteLength(serialized, "utf8") > MAX_RESULT_BYTES) {
+    throw new Error(`DuckDB result exceeds the ${MAX_RESULT_BYTES}-byte output limit`);
+  }
+}
+function assertDuckDbSchema(value, label) {
+  let leaves = 0;
+  const visit = (entry, depth) => {
+    if (depth > MAX_SCHEMA_DEPTH) throw new Error(`${label} exceeds ${MAX_SCHEMA_DEPTH} nested levels`);
+    if (typeof entry === "string") {
+      leaves += 1;
+      if (leaves > MAX_COLUMNS2) throw new Error(`${label} exceeds ${MAX_COLUMNS2} leaf columns`);
+      return;
+    }
+    if (Array.isArray(entry)) {
+      if (entry.length !== 1) throw new Error(`${label} array schemas must contain exactly one element type`);
+      visit(entry[0], depth + 1);
+      return;
+    }
+    if (!isPlainRecord(entry) || Object.keys(entry).length === 0) {
+      throw new Error(`${label} must describe at least one DuckDB column type`);
+    }
+    for (const child of Object.values(entry)) visit(child, depth + 1);
+  };
+  visit(value, 0);
+}
+function stringifyJson(value, label) {
+  try {
+    const serialized = JSON.stringify(value);
+    if (serialized === void 0) throw new Error("undefined");
+    return serialized;
+  } catch {
+    throw new Error(`${label} must be JSON-serializable`);
+  }
+}
+function quoteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function throwIfTimedOut(timedOut) {
+  if (timedOut) throw new Error(`DuckDB execution exceeded ${MAX_EXECUTION_MS}ms`);
+}
+
 // src/connectors/adapters/docsbot.ts
 var docsbotConnector = declarativeRestConnector({
   kind: "docsbot",
@@ -6914,7 +7216,7 @@ var elevenlabsConnector = declarativeRestConnector({
 // src/connectors/adapters/excel-files.ts
 import readXlsxFile from "read-excel-file/node";
 import writeXlsxFile from "write-excel-file/node";
-var MAX_COLUMNS2 = 256;
+var MAX_COLUMNS3 = 256;
 var MAX_SHEETS = 50;
 var MAX_UNCOMPRESSED_WORKBOOK_BYTES = 50 * 1024 * 1024;
 var MAX_ZIP_ENTRIES = 1e3;
@@ -6955,7 +7257,7 @@ var excelFilesConnector = {
               type: "array",
               minItems: 1,
               maxItems: MAX_RECORDS,
-              items: { type: "array", maxItems: MAX_COLUMNS2 }
+              items: { type: "array", maxItems: MAX_COLUMNS3 }
             },
             sheetName: { type: "string", minLength: 1, maxLength: 31, default: "Sheet1" }
           },
@@ -6985,8 +7287,8 @@ var excelFilesConnector = {
       totalRows += sheet.data.length;
       if (totalRows > MAX_RECORDS) throw new Error(`workbook exceeds the ${MAX_RECORDS}-row limit`);
       for (const [rowIndex, row] of sheet.data.entries()) {
-        if (row.length > MAX_COLUMNS2) {
-          throw new Error(`sheet ${sheet.sheet} row ${rowIndex + 1} exceeds the ${MAX_COLUMNS2}-column limit`);
+        if (row.length > MAX_COLUMNS3) {
+          throw new Error(`sheet ${sheet.sheet} row ${rowIndex + 1} exceeds the ${MAX_COLUMNS3}-column limit`);
         }
       }
       return { name: sheet.sheet, rows: jsonSafe(sheet.data) };
@@ -7000,7 +7302,7 @@ var excelFilesConnector = {
     if (capabilityName !== "excel.create") throw new Error(`Unknown Excel capability: ${capabilityName}`);
     const rows = readRows(args.rows);
     for (const [index, row] of rows.entries()) {
-      if (row.length > MAX_COLUMNS2) throw new Error(`rows[${index}] exceeds the ${MAX_COLUMNS2}-column limit`);
+      if (row.length > MAX_COLUMNS3) throw new Error(`rows[${index}] exceeds the ${MAX_COLUMNS3}-column limit`);
     }
     const sheetName = readOptionalString(args.sheetName, "sheetName") ?? "Sheet1";
     validateSheetName(sheetName);
@@ -16298,16 +16600,27 @@ var clickupConnector = declarativeRestConnector({
   displayName: "ClickUp",
   description: "Read and mutate ClickUp workspaces, spaces, folders, lists, tasks, comments, and time entries via the ClickUp REST v2 API.",
   auth: {
-    kind: "oauth2",
-    authorizationUrl: "https://app.clickup.com/api",
-    tokenUrl: "https://api.clickup.com/api/v2/oauth/token",
-    scopes: [],
-    clientIdEnv: "CLICKUP_OAUTH_CLIENT_ID",
-    clientSecretEnv: "CLICKUP_OAUTH_CLIENT_SECRET"
+    kind: "one_of",
+    preferred: "api-key",
+    options: [
+      {
+        kind: "api-key",
+        hint: "ClickUp personal API token (starts with pk_)."
+      },
+      {
+        kind: "oauth2",
+        authorizationUrl: "https://app.clickup.com/api",
+        tokenUrl: "https://api.clickup.com/api/v2/oauth/token",
+        scopes: [],
+        clientIdEnv: "CLICKUP_OAUTH_CLIENT_ID",
+        clientSecretEnv: "CLICKUP_OAUTH_CLIENT_SECRET"
+      }
+    ]
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
   baseUrl: "https://api.clickup.com/api/v2",
+  credentialPlacement: { kind: "authorization-by-auth" },
   // GET /user — returns the authorized user; used as a cheap liveness probe.
   test: { method: "GET", path: "/user" },
   capabilities: [
@@ -33157,6 +33470,548 @@ var justcallConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/kafka.ts
+import { isIP as isIP2 } from "net";
+import tls from "tls";
+import {
+  Kafka,
+  logLevel
+} from "kafkajs";
+
+// src/connectors/adapters/public-network.ts
+import { lookup } from "dns/promises";
+import ipaddr from "ipaddr.js";
+function isPublicNetworkAddress(value) {
+  if (!ipaddr.isValid(value)) return false;
+  let address = ipaddr.parse(value);
+  if (address.kind() === "ipv6" && address.isIPv4MappedAddress()) {
+    address = address.toIPv4Address();
+  }
+  return address.range() === "unicast";
+}
+async function resolvePublicHostAddresses(host) {
+  const addresses = ipaddr.isValid(host) ? [host] : (await lookup(host, { all: true, verbatim: true })).map((entry) => entry.address);
+  if (addresses.length === 0 || addresses.some((address) => !isPublicNetworkAddress(address))) {
+    throw new Error("host is not a public network target");
+  }
+  return addresses;
+}
+var publicDnsLookup = (hostname, options, callback) => {
+  const normalizedOptions = typeof options === "number" ? { family: options } : options;
+  lookup(hostname, { ...normalizedOptions, all: true, verbatim: true }).then((entries) => {
+    if (entries.length === 0 || entries.some((entry) => !isPublicNetworkAddress(entry.address))) {
+      callback(new Error("host is not a public network target"), "", 0);
+      return;
+    }
+    if (normalizedOptions?.all) {
+      callback(null, entries, void 0);
+      return;
+    }
+    callback(null, entries[0].address, entries[0].family);
+  }).catch((error) => callback(error instanceof Error ? error : new Error("DNS lookup failed"), "", 0));
+};
+
+// src/connectors/adapters/kafka.ts
+var MAX_TOPICS = 100;
+var MAX_MESSAGES = 100;
+var MAX_MESSAGE_BYTES2 = 1024 * 1024;
+var MAX_BATCH_BYTES2 = MAX_FILE_BYTES;
+var MAX_HEADERS = 64;
+var MAX_POLL_MS = 3e4;
+function createKafkaConnector(options = {}) {
+  const createClient = options.createClient ?? ((config) => new Kafka(config));
+  return {
+    manifest: {
+      kind: "kafka",
+      displayName: "Apache Kafka",
+      description: "Discover topics and groups, inspect offsets, produce records, and run bounded approved consumers over TLS.",
+      auth: {
+        kind: "api-key",
+        hint: "JSON with brokers and optional SASL or mutual-TLS credentials. TLS is mandatory and broker addresses must resolve publicly."
+      },
+      defaultConsistencyModel: "advisory",
+      category: "webhook",
+      rateLimit: { requests: 120, windowMs: 6e4, scope: "data-source" },
+      capabilities: [
+        readCapability5("kafka.topics.list", "List Kafka topics visible to the connection.", emptySchema()),
+        readCapability5("kafka.topics.describe", "Read partition and replica metadata for selected topics.", {
+          type: "object",
+          properties: { topics: topicArraySchema() },
+          required: ["topics"],
+          additionalProperties: false
+        }),
+        readCapability5("kafka.offsets.list", "Read low, high, and current offsets for one topic.", topicSchema()),
+        readCapability5("kafka.groups.list", "List consumer groups visible to the connection.", emptySchema()),
+        readCapability5("kafka.group.offsets", "Read committed offsets for a consumer group.", {
+          type: "object",
+          properties: {
+            groupId: { type: "string", minLength: 1, maxLength: 255 },
+            topics: topicArraySchema()
+          },
+          required: ["groupId"],
+          additionalProperties: false
+        }),
+        mutationCapability5("kafka.messages.produce", "Produce one or more records with all acknowledgements enabled.", {
+          type: "object",
+          properties: {
+            topic: topicNameSchema(),
+            encoding: { type: "string", enum: ["utf8", "base64"], default: "utf8" },
+            messages: {
+              type: "array",
+              minItems: 1,
+              maxItems: MAX_MESSAGES,
+              items: {
+                type: "object",
+                properties: {
+                  value: { type: "string" },
+                  key: { type: "string" },
+                  partition: { type: "integer", minimum: 0 },
+                  headers: { type: "object", additionalProperties: { type: "string" }, maxProperties: MAX_HEADERS }
+                },
+                required: ["value"],
+                additionalProperties: false
+              }
+            }
+          },
+          required: ["topic", "messages"],
+          additionalProperties: false
+        }),
+        mutationCapability5("kafka.messages.consume", "Join a consumer group and return a bounded batch without automatically committing offsets.", {
+          type: "object",
+          properties: {
+            topic: topicNameSchema(),
+            groupId: { type: "string", minLength: 1, maxLength: 255 },
+            encoding: { type: "string", enum: ["utf8", "base64"], default: "utf8" },
+            fromBeginning: { type: "boolean", default: false },
+            limit: { type: "integer", minimum: 1, maximum: MAX_MESSAGES, default: 25 },
+            timeoutMs: { type: "integer", minimum: 250, maximum: MAX_POLL_MS, default: 5e3 }
+          },
+          required: ["topic", "groupId"],
+          additionalProperties: false
+        }),
+        mutationCapability5("kafka.offsets.commit", "Commit explicit next offsets for a consumer group.", {
+          type: "object",
+          properties: {
+            groupId: { type: "string", minLength: 1, maxLength: 255 },
+            offsets: {
+              type: "array",
+              minItems: 1,
+              maxItems: MAX_MESSAGES,
+              items: {
+                type: "object",
+                properties: {
+                  topic: topicNameSchema(),
+                  partition: { type: "integer", minimum: 0 },
+                  offset: { type: "string", pattern: "^[0-9]+$" },
+                  metadata: { type: "string", maxLength: 4096 }
+                },
+                required: ["topic", "partition", "offset"],
+                additionalProperties: false
+              }
+            }
+          },
+          required: ["groupId", "offsets"],
+          additionalProperties: false
+        }),
+        mutationCapability5("kafka.topics.create", "Create one Kafka topic with explicit partition and replication counts.", {
+          type: "object",
+          properties: {
+            topic: topicNameSchema(),
+            partitions: { type: "integer", minimum: 1, maximum: 100, default: 1 },
+            replicationFactor: { type: "integer", minimum: 1, maximum: 10, default: 1 }
+          },
+          required: ["topic"],
+          additionalProperties: false
+        }),
+        mutationCapability5("kafka.topics.delete", "Delete one or more Kafka topics.", {
+          type: "object",
+          properties: { topics: topicArraySchema() },
+          required: ["topics"],
+          additionalProperties: false
+        })
+      ]
+    },
+    async executeRead({ source, capabilityName, args }) {
+      const client = createClient(readCredentials(source).config);
+      return withAdmin(client.admin(), async (admin) => {
+        let data4;
+        if (capabilityName === "kafka.topics.list") {
+          data4 = { topics: await admin.listTopics() };
+        } else if (capabilityName === "kafka.topics.describe") {
+          data4 = await admin.fetchTopicMetadata({ topics: readTopics(args.topics) });
+        } else if (capabilityName === "kafka.offsets.list") {
+          const topic = readTopic(args.topic);
+          data4 = { topic, partitions: await admin.fetchTopicOffsets(topic) };
+        } else if (capabilityName === "kafka.groups.list") {
+          data4 = await admin.listGroups();
+        } else if (capabilityName === "kafka.group.offsets") {
+          const groupId5 = readGroupId2(args.groupId);
+          const topics = args.topics === void 0 ? void 0 : readTopics(args.topics);
+          data4 = { groupId: groupId5, offsets: await admin.fetchOffsets({ groupId: groupId5, topics, resolveOffsets: true }) };
+        } else {
+          throw new Error(`Unknown Kafka read capability: ${capabilityName}`);
+        }
+        return { data: jsonSafe(data4), fetchedAt: Date.now() };
+      });
+    },
+    async executeMutation({ source, capabilityName, args }) {
+      const client = createClient(readCredentials(source).config);
+      let data4;
+      if (capabilityName === "kafka.messages.produce") {
+        data4 = await produce(client.producer({ idempotent: true, maxInFlightRequests: 1 }), args);
+      } else if (capabilityName === "kafka.messages.consume") {
+        data4 = await consume(client.consumer({
+          groupId: readGroupId2(args.groupId),
+          allowAutoTopicCreation: false,
+          maxBytes: MAX_BATCH_BYTES2,
+          maxBytesPerPartition: MAX_BATCH_BYTES2
+        }), args);
+      } else if (capabilityName === "kafka.offsets.commit") {
+        data4 = await commitOffsets(client.consumer({
+          groupId: readGroupId2(args.groupId),
+          allowAutoTopicCreation: false
+        }), args);
+      } else if (capabilityName === "kafka.topics.create") {
+        data4 = await withAdmin(client.admin(), async (admin) => ({
+          created: await admin.createTopics({
+            waitForLeaders: true,
+            topics: [{
+              topic: readTopic(args.topic),
+              numPartitions: readBoundedInteger(args.partitions, 1, 1, 100, "partitions"),
+              replicationFactor: readBoundedInteger(args.replicationFactor, 1, 1, 10, "replicationFactor")
+            }]
+          })
+        }));
+      } else if (capabilityName === "kafka.topics.delete") {
+        const topics = readTopics(args.topics);
+        data4 = await withAdmin(client.admin(), async (admin) => {
+          await admin.deleteTopics({ topics });
+          return { topics };
+        });
+      } else {
+        throw new Error(`Unknown Kafka mutation capability: ${capabilityName}`);
+      }
+      return {
+        status: "committed",
+        data: jsonSafe(data4),
+        committedAt: Date.now(),
+        idempotentReplay: false
+      };
+    },
+    async test(source) {
+      try {
+        const admin = createClient(readCredentials(source).config).admin();
+        await withAdmin(admin, (connected) => connected.listTopics());
+        return { ok: true };
+      } catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : "Kafka connection test failed" };
+      }
+    }
+  };
+}
+var kafkaConnector = createKafkaConnector();
+var publicKafkaSocketFactory = ({ host, port, ssl, onConnect }) => {
+  validateBrokerHost(host);
+  if (isIP2(host) !== 0 && !isPublicNetworkAddress(host)) {
+    throw new Error("Kafka broker is not a public network target");
+  }
+  const socket = tls.connect({
+    ...ssl,
+    host,
+    port,
+    servername: isIP2(host) === 0 ? host : void 0,
+    lookup: publicDnsLookup
+  }, onConnect);
+  socket.setKeepAlive(true, 6e4);
+  return socket;
+};
+async function withAdmin(admin, run) {
+  try {
+    await admin.connect();
+    return await run(admin);
+  } finally {
+    await admin.disconnect().catch(() => void 0);
+  }
+}
+async function produce(producer, args) {
+  const topic = readTopic(args.topic);
+  const encoding = readEncoding(args.encoding);
+  const messages = readMessageInputs(args.messages).map((message) => ({
+    value: decodeMessageValue(message.value, encoding, "value"),
+    key: message.key === void 0 ? void 0 : decodeMessageValue(message.key, encoding, "key"),
+    partition: message.partition === void 0 ? void 0 : readBoundedInteger(message.partition, 0, 0, Number.MAX_SAFE_INTEGER, "partition"),
+    headers: readHeaders(message.headers)
+  }));
+  const batchBytes = messages.reduce((total, message) => total + message.value.byteLength + (message.key?.byteLength ?? 0) + headerBytes(message.headers), 0);
+  if (batchBytes > MAX_BATCH_BYTES2) throw new Error(`messages exceed the ${MAX_BATCH_BYTES2}-byte batch limit`);
+  try {
+    await producer.connect();
+    return { topic, records: await producer.send({ topic, messages, acks: -1, timeout: 3e4 }) };
+  } finally {
+    await producer.disconnect().catch(() => void 0);
+  }
+}
+async function consume(consumer, args) {
+  const topic = readTopic(args.topic);
+  const encoding = readEncoding(args.encoding);
+  const limit = readBoundedInteger(args.limit, 25, 1, MAX_MESSAGES, "limit");
+  const timeoutMs = readBoundedInteger(args.timeoutMs, 5e3, 250, MAX_POLL_MS, "timeoutMs");
+  const messages = [];
+  let batchBytes = 0;
+  let resolveDone = () => void 0;
+  let rejectDone = () => void 0;
+  const done = new Promise((resolve, reject) => {
+    resolveDone = resolve;
+    rejectDone = reject;
+  });
+  let timer;
+  try {
+    await consumer.connect();
+    await consumer.subscribe({ topics: [topic], fromBeginning: readBoolean(args.fromBeginning, false, "fromBeginning") });
+    const run = consumer.run({
+      autoCommit: false,
+      partitionsConsumedConcurrently: 1,
+      eachMessage: async ({ partition, message }) => {
+        if (messages.length >= limit) return;
+        const messageBytes = (message.key?.byteLength ?? 0) + (message.value?.byteLength ?? 0) + headerBytes(message.headers);
+        if (messageBytes > MAX_MESSAGE_BYTES2) throw new Error(`Kafka message exceeds the ${MAX_MESSAGE_BYTES2}-byte limit`);
+        batchBytes += messageBytes;
+        if (batchBytes > MAX_BATCH_BYTES2) throw new Error(`Kafka batch exceeds the ${MAX_BATCH_BYTES2}-byte limit`);
+        messages.push({
+          topic,
+          partition,
+          offset: message.offset,
+          timestamp: message.timestamp,
+          key: encodeMessageValue(message.key, encoding),
+          value: encodeMessageValue(message.value, encoding),
+          headers: Object.fromEntries(Object.entries(message.headers ?? {}).map(([key, value]) => [key, encodeHeader(value, encoding)]))
+        });
+        if (messages.length >= limit) resolveDone();
+      }
+    });
+    run.catch(rejectDone);
+    timer = setTimeout(resolveDone, timeoutMs);
+    await done;
+    await consumer.stop();
+    await run;
+    return { topic, messages, messageCount: messages.length, offsetsCommitted: false };
+  } finally {
+    if (timer) clearTimeout(timer);
+    await consumer.disconnect().catch(() => void 0);
+  }
+}
+async function commitOffsets(consumer, args) {
+  if (!Array.isArray(args.offsets) || args.offsets.length === 0 || args.offsets.length > MAX_MESSAGES) {
+    throw new Error(`offsets must contain 1 through ${MAX_MESSAGES} entries`);
+  }
+  const offsets = args.offsets.map((entry, index) => {
+    if (!isPlainRecord(entry)) throw new Error(`offsets[${index}] must be an object`);
+    const offset = readOptionalString(entry.offset, `offsets[${index}].offset`);
+    if (!offset || !/^[0-9]+$/.test(offset) || BigInt(offset) > 9223372036854775807n) {
+      throw new Error(`offsets[${index}].offset must be a signed 64-bit non-negative integer string`);
+    }
+    return {
+      topic: readTopic(entry.topic),
+      partition: readBoundedInteger(entry.partition, 0, 0, Number.MAX_SAFE_INTEGER, `offsets[${index}].partition`),
+      offset,
+      metadata: readOptionalString(entry.metadata, `offsets[${index}].metadata`)
+    };
+  });
+  try {
+    await consumer.connect();
+    await consumer.commitOffsets(offsets);
+    return { groupId: readGroupId2(args.groupId), offsets };
+  } finally {
+    await consumer.disconnect().catch(() => void 0);
+  }
+}
+function readCredentials(source) {
+  let raw;
+  if (source.credentials.kind === "custom") raw = source.credentials.values;
+  else if (source.credentials.kind === "api-key") {
+    try {
+      raw = JSON.parse(source.credentials.apiKey);
+    } catch {
+      throw new Error("Kafka credential must be valid JSON");
+    }
+  } else {
+    throw new Error("Kafka requires a structured credential bundle");
+  }
+  if (!isPlainRecord(raw)) throw new Error("Kafka credential must be a JSON object");
+  const brokers = readBrokers(raw.brokers);
+  const clientId = readOptionalString(raw.clientId, "clientId") ?? "tangle-integration-hub";
+  if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) throw new Error("clientId contains unsupported characters");
+  const sasl = readSasl(raw);
+  const ca = readPemList(raw.tlsCa, "tlsCa");
+  const cert = readOptionalString(raw.tlsCert, "tlsCert");
+  const key = readOptionalString(raw.tlsKey, "tlsKey");
+  if (Boolean(cert) !== Boolean(key)) throw new Error("tlsCert and tlsKey must be supplied together");
+  return {
+    config: {
+      brokers,
+      clientId,
+      ssl: {
+        minVersion: "TLSv1.2",
+        rejectUnauthorized: true,
+        ca,
+        cert,
+        key,
+        passphrase: readOptionalString(raw.tlsPassphrase, "tlsPassphrase")
+      },
+      sasl,
+      socketFactory: publicKafkaSocketFactory,
+      connectionTimeout: 1e4,
+      authenticationTimeout: 1e4,
+      requestTimeout: 3e4,
+      enforceRequestTimeout: true,
+      retry: { retries: 3, maxRetryTime: 3e4 },
+      logLevel: logLevel.NOTHING
+    }
+  };
+}
+function readBrokers(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 20) {
+    throw new Error("brokers must contain 1 through 20 host:port entries");
+  }
+  return value.map((entry, index) => {
+    if (typeof entry !== "string" || entry.length === 0) throw new Error(`brokers[${index}] must be a host:port string`);
+    let parsed;
+    try {
+      parsed = new URL(`tcp://${entry}`);
+    } catch {
+      throw new Error(`brokers[${index}] is not a valid host:port`);
+    }
+    const host = parsed.hostname.replace(/^\[|\]$/g, "");
+    if (!parsed.port || parsed.username || parsed.password || !["", "/"].includes(parsed.pathname)) {
+      throw new Error(`brokers[${index}] must contain only host and port`);
+    }
+    validateBrokerHost(host);
+    if (isIP2(host) !== 0 && !isPublicNetworkAddress(host)) throw new Error(`brokers[${index}] is not a public network target`);
+    const port = Number(parsed.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`brokers[${index}] port is invalid`);
+    return entry;
+  });
+}
+function validateBrokerHost(host) {
+  const normalized = host.toLowerCase();
+  if (host.length === 0 || host.length > 253 || normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || /[\s/@]/.test(host)) {
+    throw new Error("Kafka broker must be a public hostname or IP address");
+  }
+}
+function readSasl(raw) {
+  if (raw.saslMechanism === void 0 || raw.saslMechanism === null) return void 0;
+  if (!["plain", "scram-sha-256", "scram-sha-512"].includes(String(raw.saslMechanism))) {
+    throw new Error("saslMechanism must be plain, scram-sha-256, or scram-sha-512");
+  }
+  const username = readOptionalString(raw.saslUsername, "saslUsername");
+  const password = readOptionalString(raw.saslPassword, "saslPassword");
+  if (!username || !password) throw new Error("SASL requires saslUsername and saslPassword");
+  return { mechanism: raw.saslMechanism, username, password };
+}
+function readPemList(value, label) {
+  if (value === void 0 || value === null) return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  if (values.length === 0 || values.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    throw new Error(`${label} must be a PEM string or non-empty array of PEM strings`);
+  }
+  return values;
+}
+function readTopics(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_TOPICS) {
+    throw new Error(`topics must contain 1 through ${MAX_TOPICS} names`);
+  }
+  const topics = value.map(readTopic);
+  if (new Set(topics).size !== topics.length) throw new Error("topics must not contain duplicates");
+  return topics;
+}
+function readTopic(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._-]{1,249}$/.test(value) || value === "." || value === "..") {
+    throw new Error("topic must be 1 through 249 Kafka-safe characters");
+  }
+  return value;
+}
+function readGroupId2(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 255 || /[\u0000-\u001f]/.test(value)) {
+    throw new Error("groupId must be 1 through 255 printable characters");
+  }
+  return value;
+}
+function readEncoding(value) {
+  if (value === void 0 || value === null || value === "utf8") return "utf8";
+  if (value === "base64") return "base64";
+  throw new Error("encoding must be utf8 or base64");
+}
+function readMessageInputs(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_MESSAGES) {
+    throw new Error(`messages must contain 1 through ${MAX_MESSAGES} entries`);
+  }
+  return value.map((entry, index) => {
+    if (!isPlainRecord(entry)) throw new Error(`messages[${index}] must be an object`);
+    return entry;
+  });
+}
+function decodeMessageValue(value, encoding, label) {
+  if (typeof value !== "string") throw new Error(`${label} must be a string`);
+  if (encoding === "base64" && (value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value))) {
+    throw new Error(`${label} must be canonical base64`);
+  }
+  const decoded = Buffer.from(value, encoding);
+  if (decoded.byteLength > MAX_MESSAGE_BYTES2) throw new Error(`${label} exceeds the ${MAX_MESSAGE_BYTES2}-byte limit`);
+  return decoded;
+}
+function encodeMessageValue(value, encoding) {
+  return value ? value.toString(encoding) : null;
+}
+function encodeHeader(value, encoding) {
+  if (value === void 0) return void 0;
+  if (Array.isArray(value)) return value.map((entry) => Buffer.isBuffer(entry) ? entry.toString(encoding) : entry);
+  return Buffer.isBuffer(value) ? value.toString(encoding) : value;
+}
+function readHeaders(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (!isPlainRecord(value) || Object.keys(value).length > MAX_HEADERS) throw new Error(`headers must have at most ${MAX_HEADERS} string fields`);
+  const headers = Object.fromEntries(Object.entries(value).map(([key, entry]) => {
+    if (typeof entry !== "string") throw new Error(`header ${key} must be a string`);
+    return [key, entry];
+  }));
+  if (headerBytes(headers) > MAX_MESSAGE_BYTES2) throw new Error(`headers exceed the ${MAX_MESSAGE_BYTES2}-byte limit`);
+  return headers;
+}
+function headerBytes(headers) {
+  if (!headers) return 0;
+  return Object.entries(headers).reduce((total, [key, value]) => {
+    const values = Array.isArray(value) ? value : [value];
+    return total + Buffer.byteLength(key, "utf8") + values.reduce((sum, entry) => {
+      if (Buffer.isBuffer(entry)) return sum + entry.byteLength;
+      if (typeof entry === "string") return sum + Buffer.byteLength(entry, "utf8");
+      return sum;
+    }, 0);
+  }, 0);
+}
+function emptySchema() {
+  return { type: "object", properties: {}, additionalProperties: false };
+}
+function topicSchema() {
+  return {
+    type: "object",
+    properties: { topic: topicNameSchema() },
+    required: ["topic"],
+    additionalProperties: false
+  };
+}
+function topicArraySchema() {
+  return { type: "array", minItems: 1, maxItems: MAX_TOPICS, items: topicNameSchema() };
+}
+function topicNameSchema() {
+  return { type: "string", minLength: 1, maxLength: 249, pattern: "^[A-Za-z0-9._-]+$" };
+}
+function readCapability5(name, description, parameters) {
+  return { name, class: "read", description, parameters };
+}
+function mutationCapability5(name, description, parameters) {
+  return { name, class: "mutation", description, parameters, cas: "none", externalEffect: true };
+}
+
 // src/connectors/adapters/lead-connector.ts
 var leadConnectorConnector = declarativeRestConnector({
   kind: "lead-connector",
@@ -43338,7 +44193,7 @@ var pipedriveConnector = declarativeRestConnector({
 // src/connectors/adapters/parquet-files.ts
 import { parquetReadObjects } from "hyparquet";
 import { parquetWriteBuffer } from "hyparquet-writer";
-var MAX_COLUMNS3 = 256;
+var MAX_COLUMNS4 = 256;
 var parquetFilesConnector = {
   manifest: {
     kind: "parquet-files",
@@ -43356,7 +44211,7 @@ var parquetFilesConnector = {
           type: "object",
           properties: {
             fileBase64: { type: "string", description: "Parquet file content encoded as canonical base64." },
-            columns: { type: "array", maxItems: MAX_COLUMNS3, items: { type: "string", minLength: 1 } },
+            columns: { type: "array", maxItems: MAX_COLUMNS4, items: { type: "string", minLength: 1 } },
             rowStart: { type: "integer", minimum: 0, default: 0 },
             rowLimit: { type: "integer", minimum: 1, maximum: MAX_RECORDS, default: MAX_RECORDS }
           },
@@ -43402,8 +44257,8 @@ var parquetFilesConnector = {
     if (capabilityName !== "parquet.create") throw new Error(`Unknown Parquet capability: ${capabilityName}`);
     const records = readRecords(args.records);
     const columnNames = [...new Set(records.flatMap((record) => Object.keys(record)))];
-    if (columnNames.length === 0 || columnNames.length > MAX_COLUMNS3) {
-      throw new Error(`records must contain 1 through ${MAX_COLUMNS3} columns`);
+    if (columnNames.length === 0 || columnNames.length > MAX_COLUMNS4) {
+      throw new Error(`records must contain 1 through ${MAX_COLUMNS4} columns`);
     }
     if (columnNames.some((name) => name.length === 0)) throw new Error("column names must not be empty");
     const columnData = columnNames.map((name) => {
@@ -43433,8 +44288,8 @@ function asyncBuffer(file) {
 }
 function readColumns2(value) {
   if (value === void 0 || value === null) return void 0;
-  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_COLUMNS3) {
-    throw new Error(`columns must contain 1 through ${MAX_COLUMNS3} names`);
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_COLUMNS4) {
+    throw new Error(`columns must contain 1 through ${MAX_COLUMNS4} names`);
   }
   const columns = value.map((entry, index) => {
     if (typeof entry !== "string" || entry.length === 0) throw new Error(`columns[${index}] must be a non-empty string`);
@@ -43890,6 +44745,759 @@ var quickbooksConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/rabbitmq.ts
+import { createHash as createHash7 } from "crypto";
+import { isIP as isIP3 } from "net";
+import {
+  connect as amqpConnect
+} from "amqplib";
+var MAX_MESSAGE_BYTES3 = 1024 * 1024;
+var MAX_NAME_BYTES = 255;
+var MAX_PEM_BYTES = 64 * 1024;
+var MAX_CA_CERTIFICATES = 16;
+var MAX_CA_BYTES = 256 * 1024;
+function createRabbitMqConnector(options = {}) {
+  const connect = options.connect ?? ((connectOptions, socketOptions) => amqpConnect(connectOptions, socketOptions));
+  const resolveHost = options.resolveHost ?? resolvePublicHostAddresses;
+  return {
+    manifest: {
+      kind: "rabbitmq",
+      displayName: "RabbitMQ",
+      description: "Inspect queues and exchanges and publish confirmed JSON messages over verified TLS.",
+      auth: {
+        kind: "api-key",
+        hint: "JSON with a public RabbitMQ host, username, password, virtual host, and optional TLS client credentials."
+      },
+      defaultConsistencyModel: "advisory",
+      category: "webhook",
+      rateLimit: { requests: 120, windowMs: 6e4, scope: "data-source" },
+      capabilities: [
+        readCapability6("rabbitmq.queues.inspect", "Check a queue and return its current message and consumer counts.", {
+          type: "object",
+          properties: { queue: nameSchema("queue") },
+          required: ["queue"],
+          additionalProperties: false
+        }),
+        readCapability6("rabbitmq.exchanges.inspect", "Check whether a named exchange exists and is visible to the connection.", {
+          type: "object",
+          properties: { exchange: nameSchema("exchange") },
+          required: ["exchange"],
+          additionalProperties: false
+        }),
+        mutationCapability6("send.message.to.queue", "Publish a persistent JSON message directly to an existing queue with broker confirmation.", {
+          type: "object",
+          properties: {
+            queue: nameSchema("queue"),
+            data: {},
+            persistent: { type: "boolean", default: true },
+            expirationMs: { type: "integer", minimum: 1, maximum: 6048e5 },
+            priority: { type: "integer", minimum: 0, maximum: 255 }
+          },
+          required: ["queue", "data"],
+          additionalProperties: false
+        }),
+        mutationCapability6("send.message.to.exchange", "Publish a persistent JSON message to an existing exchange with broker confirmation.", {
+          type: "object",
+          properties: {
+            exchange: nameSchema("exchange"),
+            routingKey: { type: "string", maxLength: MAX_NAME_BYTES, default: "" },
+            data: {},
+            persistent: { type: "boolean", default: true },
+            expirationMs: { type: "integer", minimum: 1, maximum: 6048e5 },
+            priority: { type: "integer", minimum: 0, maximum: 255 }
+          },
+          required: ["exchange", "data"],
+          additionalProperties: false
+        })
+      ]
+    },
+    async executeRead({ source, capabilityName, args }) {
+      if (capabilityName === "rabbitmq.queues.inspect") {
+        const queue = readName(args.queue, "queue");
+        const data4 = await withChannel(source, connect, resolveHost, async (channel) => {
+          const details = await channel.checkQueue(queue);
+          return { queue: details.queue, messageCount: details.messageCount, consumerCount: details.consumerCount };
+        });
+        return { data: data4, fetchedAt: Date.now() };
+      }
+      if (capabilityName === "rabbitmq.exchanges.inspect") {
+        const exchange = readName(args.exchange, "exchange");
+        const data4 = await withChannel(source, connect, resolveHost, async (channel) => {
+          await channel.checkExchange(exchange);
+          return { exchange, exists: true };
+        });
+        return { data: data4, fetchedAt: Date.now() };
+      }
+      throw new Error(`Unknown RabbitMQ read capability: ${capabilityName}`);
+    },
+    async executeMutation({ source, capabilityName, args, idempotencyKey }) {
+      let data4;
+      if (capabilityName === "send.message.to.queue") {
+        const queue = readName(args.queue, "queue");
+        const body = readJsonMessage(args.data);
+        const publishOptions = readPublishOptions(args, idempotencyKey);
+        data4 = await withConfirmChannel(source, connect, resolveHost, async (channel) => {
+          await channel.checkQueue(queue);
+          await publishConfirmed(channel, publishOptions, (options2) => channel.sendToQueue(queue, body, options2));
+          return { queue, confirmed: true, messageId: publishOptions.messageId, byteLength: body.byteLength };
+        });
+      } else if (capabilityName === "send.message.to.exchange") {
+        const exchange = readName(args.exchange, "exchange");
+        const routingKey = readRoutingKey(args.routingKey);
+        const body = readJsonMessage(args.data);
+        const publishOptions = readPublishOptions(args, idempotencyKey);
+        data4 = await withConfirmChannel(source, connect, resolveHost, async (channel) => {
+          await channel.checkExchange(exchange);
+          await publishConfirmed(channel, publishOptions, (options2) => channel.publish(exchange, routingKey, body, options2));
+          return { exchange, routingKey, confirmed: true, messageId: publishOptions.messageId, byteLength: body.byteLength };
+        });
+      } else {
+        throw new Error(`Unknown RabbitMQ mutation capability: ${capabilityName}`);
+      }
+      return { status: "committed", data: data4, committedAt: Date.now(), idempotentReplay: false };
+    },
+    async test(source) {
+      try {
+        const credentials = readCredentials2(source);
+        await resolveHost(credentials.host);
+        const model2 = await connect(credentials.connectOptions, credentials.socketOptions);
+        await model2.close();
+        return { ok: true };
+      } catch (error) {
+        return { ok: false, reason: safeErrorMessage(error, credentialSecrets(source)) };
+      }
+    }
+  };
+}
+var rabbitMqConnector = createRabbitMqConnector();
+async function withChannel(source, connect, resolveHost, run) {
+  const credentials = readCredentials2(source);
+  await resolveHost(credentials.host);
+  let model2;
+  let channel;
+  try {
+    model2 = await connect(credentials.connectOptions, credentials.socketOptions);
+    channel = await model2.createChannel();
+    return await run(channel);
+  } catch (error) {
+    throw new Error(safeErrorMessage(error, credentials.secrets));
+  } finally {
+    await channel?.close().catch(() => void 0);
+    await model2?.close().catch(() => void 0);
+  }
+}
+async function withConfirmChannel(source, connect, resolveHost, run) {
+  const credentials = readCredentials2(source);
+  await resolveHost(credentials.host);
+  let model2;
+  let channel;
+  try {
+    model2 = await connect(credentials.connectOptions, credentials.socketOptions);
+    channel = await model2.createConfirmChannel();
+    return await run(channel);
+  } catch (error) {
+    throw new Error(safeErrorMessage(error, credentials.secrets));
+  } finally {
+    await channel?.close().catch(() => void 0);
+    await model2?.close().catch(() => void 0);
+  }
+}
+async function publishConfirmed(channel, publishOptions, publish) {
+  let returned;
+  const onReturn = (message) => {
+    returned = message;
+  };
+  channel.on("return", onReturn);
+  try {
+    publish(publishOptions);
+    await channel.waitForConfirms();
+    if (returned) throw new Error("RabbitMQ accepted but could not route the message");
+  } finally {
+    channel.removeListener("return", onReturn);
+  }
+}
+function readCredentials2(source) {
+  let raw;
+  if (source.credentials.kind === "custom") raw = source.credentials.values;
+  else if (source.credentials.kind === "api-key") {
+    try {
+      raw = JSON.parse(source.credentials.apiKey);
+    } catch {
+      throw new Error("RabbitMQ credential must be valid JSON");
+    }
+  } else {
+    throw new Error("RabbitMQ requires a structured credential bundle");
+  }
+  if (!isPlainRecord(raw)) throw new Error("RabbitMQ credential must be a JSON object");
+  const host = readHost(raw.host);
+  const port = readBoundedInteger(raw.port, 5671, 1, 65535, "port");
+  const username = readRequiredString(raw.username, "username", 1024);
+  const password = readRequiredString(raw.password, "password", 4096);
+  const vhost = readOptionalString(raw.vhost, "vhost") ?? "/";
+  if (Buffer.byteLength(vhost, "utf8") > MAX_NAME_BYTES || /[\u0000-\u001f\u007f]/.test(vhost)) {
+    throw new Error(`vhost must be at most ${MAX_NAME_BYTES} bytes without control characters`);
+  }
+  const ca = readPem(raw.tlsCa, "tlsCa", true);
+  const cert = readPem(raw.tlsCert, "tlsCert", false);
+  const key = readPem(raw.tlsKey, "tlsKey", false);
+  if (Boolean(cert) !== Boolean(key)) throw new Error("tlsCert and tlsKey must be supplied together");
+  const passphrase = readOptionalString(raw.tlsPassphrase, "tlsPassphrase");
+  return {
+    host,
+    connectOptions: {
+      protocol: "amqps",
+      hostname: host,
+      port,
+      username,
+      password,
+      vhost,
+      heartbeat: readBoundedInteger(raw.heartbeatSeconds, 30, 5, 300, "heartbeatSeconds"),
+      frameMax: MAX_MESSAGE_BYTES3 + 4096
+    },
+    socketOptions: {
+      minVersion: "TLSv1.2",
+      rejectUnauthorized: true,
+      servername: isIP3(host) === 0 ? host : void 0,
+      lookup: publicDnsLookup,
+      timeout: readBoundedInteger(raw.connectionTimeoutMs, 1e4, 1e3, 3e4, "connectionTimeoutMs"),
+      noDelay: true,
+      keepAlive: true,
+      keepAliveDelay: 6e4,
+      ca,
+      cert,
+      key,
+      passphrase
+    },
+    secrets: [password, ...cert ? [cert] : [], ...key ? [key] : [], ...passphrase ? [passphrase] : []]
+  };
+}
+function readHost(value) {
+  const host = readRequiredString(value, "host", 253);
+  const ipVersion = isIP3(host);
+  if (ipVersion !== 0) {
+    if (!isPublicNetworkAddress(host)) throw new Error("RabbitMQ host is not a public network target");
+    return host;
+  }
+  const normalized = host.toLowerCase();
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || /[\s/@:\[\]]/.test(host)) {
+    throw new Error("RabbitMQ host must be a public hostname or IP address without a scheme or port");
+  }
+  return host;
+}
+function readPublishOptions(args, idempotencyKey) {
+  const expirationMs = args.expirationMs === void 0 ? void 0 : readBoundedInteger(args.expirationMs, 0, 1, 6048e5, "expirationMs");
+  const priority = args.priority === void 0 ? void 0 : readBoundedInteger(args.priority, 0, 0, 255, "priority");
+  return {
+    mandatory: true,
+    persistent: readBoolean(args.persistent, true, "persistent"),
+    contentType: "application/json",
+    contentEncoding: "utf-8",
+    messageId: createHash7("sha256").update(idempotencyKey).digest("hex"),
+    timestamp: Math.floor(Date.now() / 1e3),
+    appId: "tangle-integration-hub",
+    expiration: expirationMs === void 0 ? void 0 : String(expirationMs),
+    priority
+  };
+}
+function readJsonMessage(value) {
+  if (value === void 0) throw new Error("data is required");
+  let serialized;
+  try {
+    serialized = JSON.stringify(value);
+  } catch {
+    throw new Error("data must be JSON-serializable");
+  }
+  if (serialized === void 0) throw new Error("data must be JSON-serializable");
+  const body = Buffer.from(serialized);
+  if (body.byteLength > MAX_MESSAGE_BYTES3) throw new Error(`data exceeds the ${MAX_MESSAGE_BYTES3}-byte limit`);
+  return body;
+}
+function readName(value, label) {
+  const name = readRequiredString(value, label, MAX_NAME_BYTES);
+  if (Buffer.byteLength(name, "utf8") > MAX_NAME_BYTES || /[\u0000-\u001f\u007f]/.test(name)) {
+    throw new Error(`${label} must be at most ${MAX_NAME_BYTES} bytes without control characters`);
+  }
+  return name;
+}
+function readRoutingKey(value) {
+  if (value === void 0 || value === null || value === "") return "";
+  return readName(value, "routingKey");
+}
+function readRequiredString(value, label, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength) {
+    throw new Error(`${label} must be a non-empty string no longer than ${maxLength} characters`);
+  }
+  return value;
+}
+function readPem(value, label, allowArray) {
+  if (value === void 0 || value === null) return void 0;
+  const values = Array.isArray(value) && allowArray ? value : [value];
+  if (values.length === 0 || values.length > MAX_CA_CERTIFICATES || values.some((entry) => typeof entry !== "string" || entry.length === 0 || Buffer.byteLength(entry, "utf8") > MAX_PEM_BYTES) || values.reduce((total, entry) => total + (typeof entry === "string" ? Buffer.byteLength(entry, "utf8") : 0), 0) > MAX_CA_BYTES) {
+    throw new Error(
+      allowArray ? `${label} must contain 1-${MAX_CA_CERTIFICATES} PEM strings, each under ${MAX_PEM_BYTES} bytes and ${MAX_CA_BYTES} bytes total` : `${label} must be a PEM string under ${MAX_PEM_BYTES} bytes`
+    );
+  }
+  return allowArray ? values : values[0];
+}
+function credentialSecrets(source) {
+  try {
+    return readCredentials2(source).secrets;
+  } catch {
+    return [];
+  }
+}
+function safeErrorMessage(error, secrets) {
+  let message = error instanceof Error ? error.message : String(error);
+  for (const secret of secrets) {
+    if (secret.length >= 4) message = message.replaceAll(secret, "[REDACTED]");
+  }
+  return message;
+}
+function readCapability6(name, description, parameters) {
+  return { name, class: "read", description, parameters };
+}
+function mutationCapability6(name, description, parameters) {
+  return { name, class: "mutation", description, parameters, cas: "none", externalEffect: true };
+}
+function nameSchema(label) {
+  return { type: "string", minLength: 1, maxLength: MAX_NAME_BYTES, description: `Existing RabbitMQ ${label} name.` };
+}
+
+// src/connectors/adapters/redis.ts
+import { isIP as isIP4 } from "net";
+import {
+  createClient as createRedisClient
+} from "redis";
+var MAX_KEY_BYTES = 1024;
+var MAX_PATTERN_BYTES = 4096;
+var MAX_VALUE_BYTES = 1024 * 1024;
+var MAX_SCAN_KEYS = 1e3;
+var MAX_SCAN_BYTES = 1024 * 1024;
+var MAX_TLS_CA_BYTES = 256 * 1024;
+var MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var SCAN_SCRIPT = `
+local page
+if ARGV[4] == '' then
+  page = redis.call('SCAN', ARGV[1], 'MATCH', ARGV[2], 'COUNT', ARGV[3])
+else
+  page = redis.call('SCAN', ARGV[1], 'MATCH', ARGV[2], 'COUNT', ARGV[3], 'TYPE', ARGV[4])
+end
+local keys = page[2]
+if #keys > tonumber(ARGV[5]) then return redis.error_reply('Redis SCAN page exceeds the configured key limit') end
+local bytes = 0
+for _, key in ipairs(keys) do
+  if string.len(key) > tonumber(ARGV[7]) then return redis.error_reply('Redis SCAN key exceeds the configured key limit') end
+  bytes = bytes + string.len(key)
+  if bytes > tonumber(ARGV[6]) then return redis.error_reply('Redis SCAN page exceeds the configured byte limit') end
+end
+return page
+`;
+var INSPECT_SCRIPT = `
+local kind = redis.call('TYPE', KEYS[1])
+if type(kind) == 'table' then kind = kind['ok'] end
+return { kind, redis.call('PTTL', KEYS[1]) }
+`;
+var READ_STRING_SCRIPT = `
+local kind = redis.call('TYPE', KEYS[1])
+if type(kind) == 'table' then kind = kind['ok'] end
+local ttl = redis.call('PTTL', KEYS[1])
+if kind == 'none' then return { kind, ttl, false, 0 } end
+if kind ~= 'string' then return redis.error_reply('WRONGTYPE key does not contain a string') end
+local length = redis.call('STRLEN', KEYS[1])
+if length > tonumber(ARGV[1]) then return redis.error_reply('Redis value exceeds the configured read limit') end
+return { kind, ttl, redis.call('GET', KEYS[1]), length }
+`;
+var COMPARE_SET_SCRIPT = `
+if redis.call('GET', KEYS[1]) ~= ARGV[1] then return 0 end
+if ARGV[3] ~= '' then
+  redis.call('SET', KEYS[1], ARGV[2], 'PX', ARGV[3])
+elseif ARGV[4] == '1' then
+  redis.call('SET', KEYS[1], ARGV[2], 'KEEPTTL')
+else
+  redis.call('SET', KEYS[1], ARGV[2])
+end
+return 1
+`;
+var COMPARE_DELETE_SCRIPT = `
+if redis.call('GET', KEYS[1]) ~= ARGV[1] then return 0 end
+return redis.call('DEL', KEYS[1])
+`;
+function createRedisConnector(options = {}) {
+  const createClient = options.createClient ?? defaultCreateClient;
+  const resolveHost = options.resolveHost ?? resolvePublicHostAddresses;
+  return {
+    manifest: {
+      kind: "redis",
+      displayName: "Redis",
+      description: "Inspect and scan Redis keys and perform bounded, approved string compare-and-swap mutations over verified TLS.",
+      auth: {
+        kind: "api-key",
+        hint: "JSON with a public Redis host, password, optional ACL username/database, and optional TLS CA. Verified TLS is mandatory."
+      },
+      defaultConsistencyModel: "authoritative",
+      category: "database",
+      rateLimit: { requests: 120, windowMs: 6e4, scope: "data-source" },
+      capabilities: [
+        readCapability7("redis.keys.scan", "Read one bounded SCAN page without blocking the server with KEYS.", {
+          type: "object",
+          properties: {
+            cursor: { type: "string", pattern: "^[0-9]+$", default: "0" },
+            match: { type: "string", maxLength: MAX_PATTERN_BYTES, default: "*" },
+            count: { type: "integer", minimum: 1, maximum: MAX_SCAN_KEYS, default: 100 },
+            type: { type: "string", enum: ["string", "list", "set", "zset", "hash", "stream"] }
+          },
+          additionalProperties: false
+        }),
+        readCapability7("redis.key.inspect", "Read a key type and remaining expiry atomically.", keySchema()),
+        readCapability7("redis.string.get", "Read one bounded string value, type, and remaining expiry atomically.", keySchema()),
+        mutationCapability7("redis.string.set", "Set a bounded string only when the key is absent, present, or matches an expected value.", {
+          type: "object",
+          properties: {
+            key: keyParameter(),
+            value: { type: "string", maxLength: MAX_VALUE_BYTES },
+            condition: { type: "string", enum: ["absent", "present", "matches"] },
+            expectedValue: { type: "string", maxLength: MAX_VALUE_BYTES },
+            ttlMs: { type: "integer", minimum: 1, maximum: MAX_TTL_MS },
+            keepTtl: { type: "boolean", default: false }
+          },
+          required: ["key", "value", "condition"],
+          additionalProperties: false
+        }),
+        mutationCapability7("redis.string.delete", "Delete a string key only when its current value exactly matches the caller expectation.", {
+          type: "object",
+          properties: {
+            key: keyParameter(),
+            expectedValue: { type: "string", maxLength: MAX_VALUE_BYTES }
+          },
+          required: ["key", "expectedValue"],
+          additionalProperties: false
+        })
+      ]
+    },
+    async test(source) {
+      try {
+        await withClient(source, createClient, resolveHost, async (client) => {
+          const response = await client.ping();
+          if (response !== "PONG") throw new Error("Redis PING returned an unexpected response");
+        });
+        return { ok: true };
+      } catch (error) {
+        return { ok: false, reason: safeErrorMessage2(error, credentialSecrets2(source)) };
+      }
+    },
+    async executeRead({ source, capabilityName, args }) {
+      if (capabilityName === "redis.keys.scan") {
+        const cursor = readCursor(args.cursor);
+        const match = readPattern(args.match);
+        const count = readBoundedInteger(args.count, 100, 1, MAX_SCAN_KEYS, "count");
+        const type = readScanType(args.type);
+        const data4 = await withClient(source, createClient, resolveHost, async (client) => {
+          const reply = readArrayReply(await client.eval(SCAN_SCRIPT, {
+            keys: [],
+            arguments: [
+              cursor,
+              match,
+              String(count),
+              type ?? "",
+              String(MAX_SCAN_KEYS),
+              String(MAX_SCAN_BYTES),
+              String(MAX_KEY_BYTES)
+            ]
+          }), "scan");
+          const keys = readStringArray(reply[1], "scan keys");
+          assertScanPage(keys);
+          return { cursor: readCursor(readReplyString(reply[0], "cursor")), keys };
+        });
+        return { data: data4, fetchedAt: Date.now() };
+      }
+      if (capabilityName === "redis.key.inspect") {
+        const key = readKey(args.key);
+        const data4 = await withClient(source, createClient, resolveHost, async (client) => {
+          const reply = readArrayReply(await client.eval(INSPECT_SCRIPT, { keys: [key], arguments: [] }), "inspect");
+          const type = readReplyString(reply[0], "type");
+          return { key, exists: type !== "none", type, ttlMs: normalizeTtl(reply[1]) };
+        });
+        return { data: data4, fetchedAt: Date.now() };
+      }
+      if (capabilityName === "redis.string.get") {
+        const key = readKey(args.key);
+        const data4 = await withClient(source, createClient, resolveHost, async (client) => {
+          const reply = readArrayReply(await client.eval(READ_STRING_SCRIPT, {
+            keys: [key],
+            arguments: [String(MAX_VALUE_BYTES)]
+          }), "string read");
+          const type = readReplyString(reply[0], "type");
+          const exists = type !== "none";
+          const value = exists ? readReplyString(reply[2], "value") : null;
+          if (value !== null && Buffer.byteLength(value, "utf8") > MAX_VALUE_BYTES) {
+            throw new Error(`Redis value exceeds the ${MAX_VALUE_BYTES}-byte limit`);
+          }
+          return {
+            key,
+            exists,
+            type,
+            ttlMs: normalizeTtl(reply[1]),
+            value,
+            byteLength: exists ? readReplyInteger(reply[3], "byteLength") : 0
+          };
+        });
+        return { data: data4, fetchedAt: Date.now() };
+      }
+      throw new Error(`Unknown Redis read capability: ${capabilityName}`);
+    },
+    async executeMutation({ source, capabilityName, args }) {
+      if (capabilityName === "redis.string.set") {
+        const input = readSetInput(args);
+        return withClient(source, createClient, resolveHost, async (client) => {
+          let committed;
+          if (input.condition === "matches") {
+            committed = readReplyInteger(await client.eval(COMPARE_SET_SCRIPT, {
+              keys: [input.key],
+              arguments: [input.expectedValue, input.value, input.ttlMs === void 0 ? "" : String(input.ttlMs), input.keepTtl ? "1" : "0"]
+            }), "compare-and-set result") === 1;
+          } else {
+            const response = await client.set(input.key, input.value, {
+              condition: input.condition === "absent" ? "NX" : "XX",
+              expiration: input.ttlMs === void 0 ? input.keepTtl ? "KEEPTTL" : void 0 : { type: "PX", value: input.ttlMs }
+            });
+            committed = response === "OK";
+          }
+          if (!committed) return conflict(`Redis key ${input.key} did not satisfy condition ${input.condition}`);
+          return committedResult({ key: input.key, condition: input.condition, byteLength: Buffer.byteLength(input.value, "utf8") });
+        });
+      }
+      if (capabilityName === "redis.string.delete") {
+        const key = readKey(args.key);
+        const expectedValue = readValue(args.expectedValue, "expectedValue");
+        return withClient(source, createClient, resolveHost, async (client) => {
+          const deleted = readReplyInteger(await client.eval(COMPARE_DELETE_SCRIPT, {
+            keys: [key],
+            arguments: [expectedValue]
+          }), "compare-and-delete result");
+          if (deleted !== 1) return conflict(`Redis key ${key} did not match the expected value`);
+          return committedResult({ key, deleted: true });
+        });
+      }
+      throw new Error(`Unknown Redis mutation capability: ${capabilityName}`);
+    }
+  };
+}
+var redisConnector = createRedisConnector();
+function defaultCreateClient(options) {
+  return createRedisClient(options);
+}
+async function withClient(source, createClient, resolveHost, run) {
+  const credentials = readCredentials3(source);
+  const addresses = await resolveHost(credentials.host);
+  if (addresses.length === 0) throw new Error("Redis host did not resolve");
+  let client;
+  try {
+    client = createClient({
+      username: credentials.username,
+      password: credentials.password,
+      database: credentials.database,
+      name: "tangle-integration-hub",
+      disableOfflineQueue: true,
+      commandsQueueMaxLength: 10,
+      maintNotifications: "disabled",
+      commandOptions: { abortSignal: AbortSignal.timeout(credentials.commandTimeoutMs) },
+      socket: {
+        host: addresses[0],
+        port: credentials.port,
+        tls: true,
+        servername: isIP4(credentials.host) === 0 ? credentials.host : void 0,
+        minVersion: "TLSv1.2",
+        rejectUnauthorized: true,
+        ca: credentials.tlsCa,
+        connectTimeout: credentials.connectTimeoutMs,
+        socketTimeout: credentials.commandTimeoutMs,
+        reconnectStrategy: false
+      }
+    });
+    client.on("error", () => void 0);
+    await client.connect();
+    return await run(client);
+  } catch (error) {
+    throw new Error(safeErrorMessage2(error, credentials.secrets));
+  } finally {
+    if (client?.isOpen) await client.close().catch(() => client?.destroy());
+    else client?.destroy();
+  }
+}
+function readCredentials3(source) {
+  let raw;
+  if (source.credentials.kind === "custom") raw = source.credentials.values;
+  else if (source.credentials.kind === "api-key") {
+    try {
+      raw = JSON.parse(source.credentials.apiKey);
+    } catch {
+      throw new Error("Redis credential must be valid JSON");
+    }
+  } else {
+    throw new Error("Redis requires a structured credential bundle");
+  }
+  if (!isPlainRecord(raw)) throw new Error("Redis credential must be a JSON object");
+  const host = readHost2(raw.host);
+  const username = readOptionalString(raw.username, "username");
+  if (username && (username.length > 128 || /[\u0000-\u001f\u007f]/.test(username))) {
+    throw new Error("Redis username must be at most 128 characters without control characters");
+  }
+  const password = readRequiredString2(raw.password, "password", 4096);
+  const tlsCa = readOptionalString(raw.tlsCa, "tlsCa");
+  if (tlsCa && Buffer.byteLength(tlsCa, "utf8") > MAX_TLS_CA_BYTES) {
+    throw new Error(`Redis tlsCa exceeds the ${MAX_TLS_CA_BYTES}-byte limit`);
+  }
+  return {
+    host,
+    port: readBoundedInteger(raw.port, 6380, 1, 65535, "port"),
+    username,
+    password,
+    database: readBoundedInteger(raw.database, 0, 0, 65535, "database"),
+    tlsCa,
+    connectTimeoutMs: readBoundedInteger(raw.connectTimeoutMs, 1e4, 1e3, 3e4, "connectTimeoutMs"),
+    commandTimeoutMs: readBoundedInteger(raw.commandTimeoutMs, 1e4, 1e3, 3e4, "commandTimeoutMs"),
+    secrets: [password]
+  };
+}
+function readHost2(value) {
+  const host = readRequiredString2(value, "host", 253);
+  const ipVersion = isIP4(host);
+  if (ipVersion !== 0) {
+    if (!isPublicNetworkAddress(host)) throw new Error("Redis host is not a public network target");
+    return host;
+  }
+  const normalized = host.toLowerCase();
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || /[\s/@:\[\]]/.test(host)) {
+    throw new Error("Redis host must be a public hostname or IP address without a scheme or port");
+  }
+  return host;
+}
+function readSetInput(args) {
+  const key = readKey(args.key);
+  const value = readValue(args.value, "value");
+  const condition = args.condition;
+  if (!["absent", "present", "matches"].includes(String(condition))) {
+    throw new Error("condition must be absent, present, or matches");
+  }
+  const expectedValue = args.expectedValue === void 0 ? void 0 : readValue(args.expectedValue, "expectedValue");
+  if (condition === "matches" && expectedValue === void 0) throw new Error("expectedValue is required when condition is matches");
+  if (condition !== "matches" && expectedValue !== void 0) throw new Error("expectedValue is only valid when condition is matches");
+  const ttlMs = args.ttlMs === void 0 ? void 0 : readBoundedInteger(args.ttlMs, 0, 1, MAX_TTL_MS, "ttlMs");
+  const keepTtl = readBoolean(args.keepTtl, false, "keepTtl");
+  if (ttlMs !== void 0 && keepTtl) throw new Error("ttlMs and keepTtl cannot be used together");
+  return { key, value, condition, expectedValue, ttlMs, keepTtl };
+}
+function readCursor(value) {
+  if (value === void 0 || value === null || value === "") return "0";
+  if (typeof value !== "string" || !/^[0-9]+$/.test(value) || value.length > 32) {
+    throw new Error("cursor must be a Redis numeric cursor string");
+  }
+  return value;
+}
+function readPattern(value) {
+  if (value === void 0 || value === null || value === "") return "*";
+  if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > MAX_PATTERN_BYTES || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`match must be under ${MAX_PATTERN_BYTES} bytes without control characters`);
+  }
+  return value;
+}
+function readScanType(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (!["string", "list", "set", "zset", "hash", "stream"].includes(String(value))) {
+    throw new Error("type must be string, list, set, zset, hash, or stream");
+  }
+  return String(value);
+}
+function assertScanPage(keys) {
+  if (!Array.isArray(keys) || keys.length > MAX_SCAN_KEYS) {
+    throw new Error(`Redis SCAN page exceeds ${MAX_SCAN_KEYS} keys`);
+  }
+  if (keys.some((key) => typeof key !== "string" || Buffer.byteLength(key, "utf8") > MAX_KEY_BYTES || /[\u0000-\u001f\u007f]/.test(key)) || Buffer.byteLength(JSON.stringify(keys), "utf8") > MAX_SCAN_BYTES) {
+    throw new Error(`Redis SCAN page exceeds the ${MAX_SCAN_BYTES}-byte limit`);
+  }
+}
+function readKey(value) {
+  return readBoundedString(value, "key", MAX_KEY_BYTES);
+}
+function readValue(value, label) {
+  if (typeof value !== "string") throw new Error(`${label} must be a string`);
+  if (Buffer.byteLength(value, "utf8") > MAX_VALUE_BYTES) {
+    throw new Error(`${label} exceeds the ${MAX_VALUE_BYTES}-byte limit`);
+  }
+  return value;
+}
+function readBoundedString(value, label, maxBytes) {
+  if (typeof value !== "string" || value.length === 0 || Buffer.byteLength(value, "utf8") > maxBytes || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${label} must be a non-empty string under ${maxBytes} bytes without control characters`);
+  }
+  return value;
+}
+function readRequiredString2(value, label, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength) {
+    throw new Error(`${label} must be a non-empty string no longer than ${maxLength} characters`);
+  }
+  return value;
+}
+function readArrayReply(value, label) {
+  if (!Array.isArray(value)) throw new Error(`Redis ${label} returned a malformed response`);
+  return value;
+}
+function readStringArray(value, label) {
+  if (!Array.isArray(value)) throw new Error(`Redis response ${label} is malformed`);
+  return value.map((entry) => readReplyString(entry, label));
+}
+function readReplyString(value, label) {
+  if (typeof value === "string") return value;
+  if (Buffer.isBuffer(value)) return value.toString("utf8");
+  throw new Error(`Redis response ${label} is malformed`);
+}
+function readReplyInteger(value, label) {
+  const parsed = typeof value === "bigint" ? Number(value) : typeof value === "string" ? Number(value) : value;
+  if (typeof parsed !== "number" || !Number.isSafeInteger(parsed)) throw new Error(`Redis response ${label} is malformed`);
+  return parsed;
+}
+function normalizeTtl(value) {
+  const ttl = readReplyInteger(value, "ttlMs");
+  return ttl >= 0 ? ttl : null;
+}
+function safeErrorMessage2(error, secrets) {
+  let message = error instanceof Error ? error.message : String(error);
+  for (const secret of secrets) {
+    if (secret.length >= 4) message = message.replaceAll(secret, "[REDACTED]");
+  }
+  return message;
+}
+function credentialSecrets2(source) {
+  try {
+    return readCredentials3(source).secrets;
+  } catch {
+    return [];
+  }
+}
+function committedResult(data4) {
+  return { status: "committed", data: data4, committedAt: Date.now(), idempotentReplay: false };
+}
+function conflict(message) {
+  return { status: "conflict", alternatives: [], currentState: null, message };
+}
+function readCapability7(name, description, parameters) {
+  return { name, class: "read", description, parameters };
+}
+function mutationCapability7(name, description, parameters) {
+  return { name, class: "mutation", description, parameters, cas: "optimistic-read-verify", externalEffect: true };
+}
+function keyParameter() {
+  return { type: "string", minLength: 1, maxLength: MAX_KEY_BYTES };
+}
+function keySchema() {
+  return {
+    type: "object",
+    properties: { key: keyParameter() },
+    required: ["key"],
+    additionalProperties: false
+  };
+}
+
 // src/connectors/adapters/recall-ai.ts
 var recallAiRegions = [
   "https://us-east-1.recall.ai",
@@ -44720,16 +46328,14 @@ var salesforceConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/sftp.ts
-import { lookup } from "dns/promises";
 import { timingSafeEqual as timingSafeEqual4 } from "crypto";
 import { posix } from "path";
-import ipaddr from "ipaddr.js";
 import SftpClient from "ssh2-sftp-client";
 var MAX_LIST_ENTRIES = 1e3;
 var MAX_PATH_LENGTH = 1024;
 function createSftpConnector(options = {}) {
   const createClient = options.createClient ?? (() => new SftpClient());
-  const lookupHost = options.lookupHost ?? resolvePublicAddresses;
+  const lookupHost = options.lookupHost ?? resolvePublicHostAddresses;
   return {
     manifest: {
       kind: "sftp",
@@ -44828,7 +46434,7 @@ function createSftpConnector(options = {}) {
       ]
     },
     async executeRead({ source, capabilityName, args }) {
-      const credentials = readCredentials(source);
+      const credentials = readCredentials4(source);
       if (capabilityName === "sftp.list") {
         const path = resolveRemotePath(credentials.rootPath, args.path ?? "/");
         const limit = readBoundedInteger(args.limit, MAX_LIST_ENTRIES, 1, MAX_LIST_ENTRIES, "limit");
@@ -44861,7 +46467,7 @@ function createSftpConnector(options = {}) {
       throw new Error(`Unknown SFTP read capability: ${capabilityName}`);
     },
     async executeMutation({ source, capabilityName, args }) {
-      const credentials = readCredentials(source);
+      const credentials = readCredentials4(source);
       const prepared = prepareMutation(capabilityName, args, credentials.rootPath);
       return withSftp(credentials, createClient, lookupHost, async (client) => {
         let data4;
@@ -44895,7 +46501,7 @@ function createSftpConnector(options = {}) {
     },
     async test(source) {
       try {
-        const credentials = readCredentials(source);
+        const credentials = readCredentials4(source);
         await withSftp(credentials, createClient, lookupHost, (client) => client.cwd());
         return { ok: true };
       } catch (error) {
@@ -44963,7 +46569,7 @@ async function withSftp(credentials, createClient, lookupHost, run) {
     await client.end().catch(() => false);
   }
 }
-function readCredentials(source) {
+function readCredentials4(source) {
   let raw;
   if (source.credentials.kind === "custom") raw = source.credentials.values;
   else if (source.credentials.kind === "api-key") {
@@ -45004,21 +46610,6 @@ function validateHostname(host) {
     throw new Error("SFTP host must be a public hostname or IP address without a scheme");
   }
 }
-async function resolvePublicAddresses(host) {
-  const addresses = ipaddr.isValid(host) ? [host] : (await lookup(host, { all: true, verbatim: true })).map((entry) => entry.address);
-  if (addresses.length === 0 || addresses.some((address) => !isPublicAddress(address))) {
-    throw new Error("SFTP host is not a public network target");
-  }
-  return addresses;
-}
-function isPublicAddress(value) {
-  if (!ipaddr.isValid(value)) return false;
-  let address = ipaddr.parse(value);
-  if (address.kind() === "ipv6" && address.isIPv4MappedAddress()) {
-    address = address.toIPv4Address();
-  }
-  return address.range() === "unicast";
-}
 function parseFingerprint(value) {
   if (/^[a-fA-F0-9]{64}$/.test(value)) return Buffer.from(value, "hex");
   const match = /^SHA256:([A-Za-z0-9+/]{43}=?)$/.exec(value);
@@ -54681,17 +56272,17 @@ var zohoBookingsConnector = {
     category: "calendar",
     defaultConsistencyModel: "authoritative",
     capabilities: [
-      readCapability5("workspaces.list", "List Zoho Bookings workspaces.", {}),
-      readCapability5("services.list", "List services, optionally within one workspace.", {
+      readCapability8("workspaces.list", "List Zoho Bookings workspaces.", {}),
+      readCapability8("services.list", "List services, optionally within one workspace.", {
         workspace_id: { type: "string" }
       }),
-      readCapability5("resources.list", "List bookable resources, optionally for one service.", {
+      readCapability8("resources.list", "List bookable resources, optionally for one service.", {
         service_id: { type: "string" }
       }),
-      readCapability5("staff.list", "List staff, optionally for one service.", {
+      readCapability8("staff.list", "List staff, optionally for one service.", {
         service_id: { type: "string" }
       }),
-      readCapability5("appointments.list", "List appointments from a required start time.", {
+      readCapability8("appointments.list", "List appointments from a required start time.", {
         from_time: {
           type: "string",
           description: "Zoho timestamp in dd-MMM-yyyy HH:mm:ss format."
@@ -54701,17 +56292,17 @@ var zohoBookingsConnector = {
         staff_id: { type: "string" },
         status: { type: "string" }
       }, ["from_time"]),
-      readCapability5("appointments.get", "Read one appointment by booking id.", {
+      readCapability8("appointments.get", "Read one appointment by booking id.", {
         booking_id: { type: "string" }
       }, ["booking_id"]),
-      readCapability5("availability.fetch", "Fetch open time slots for a service and date.", {
+      readCapability8("availability.fetch", "Fetch open time slots for a service and date.", {
         service_id: { type: "string" },
         selected_date: { type: "string", description: "Date in YYYY-MM-DD format." },
         staff_id: { type: "string" },
         group_id: { type: "string" },
         resource_id: { type: "string" }
       }, ["service_id", "selected_date"]),
-      mutationCapability5("appointments.book", "Book an appointment for a customer.", {
+      mutationCapability8("appointments.book", "Book an appointment for a customer.", {
         service_id: { type: "string" },
         from_time: { type: "string", description: "Zoho timestamp in dd-MMM-yyyy HH:mm:ss format." },
         customer_details: {
@@ -54727,13 +56318,13 @@ var zohoBookingsConnector = {
         additional_fields: { type: "object" },
         payment_info: { type: "object" }
       }, ["service_id", "from_time", "customer_details"]),
-      mutationCapability5("appointments.reschedule", "Move an appointment to a new time, staff member, or group.", {
+      mutationCapability8("appointments.reschedule", "Move an appointment to a new time, staff member, or group.", {
         booking_id: { type: "string" },
         start_time: { type: "string", description: "Zoho timestamp in dd-MMM-yyyy HH:mm:ss format." },
         staff_id: { type: "string" },
         group_id: { type: "string" }
       }, ["booking_id"]),
-      mutationCapability5("appointments.cancel", "Cancel an appointment by booking id.", {
+      mutationCapability8("appointments.cancel", "Cancel an appointment by booking id.", {
         booking_id: { type: "string" }
       }, ["booking_id"])
     ]
@@ -54850,7 +56441,7 @@ var zohoBookingsConnector = {
     }
   }
 };
-function readCapability5(name, description, properties, required = []) {
+function readCapability8(name, description, properties, required = []) {
   return {
     name,
     class: "read",
@@ -54859,7 +56450,7 @@ function readCapability5(name, description, properties, required = []) {
     requiredScopes: ["zohobookings.data.READ"]
   };
 }
-function mutationCapability5(name, description, properties, required) {
+function mutationCapability8(name, description, properties, required) {
   return {
     name,
     class: "mutation",
@@ -62203,6 +63794,393 @@ var metabaseConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/mysql.ts
+import { connect as createSocket, isIP as isIP5 } from "net";
+import {
+  createConnection as createMysqlConnection
+} from "mysql2/promise";
+var MAX_PARAMETERS = 1e3;
+var MAX_PARAMETER_BYTES = 10 * 1024 * 1024;
+var MAX_RESULT_ROWS = 1e4;
+var MAX_RESULT_BYTES2 = 10 * 1024 * 1024;
+var DEFAULT_QUERY_TIMEOUT_MS = 3e4;
+function createMySqlConnector(options = {}) {
+  const createConnection = options.createConnection ?? defaultCreateConnection;
+  const resolveHost = options.resolveHost ?? resolvePublicHostAddresses;
+  return {
+    manifest: {
+      kind: "mysql",
+      displayName: "MySQL",
+      description: "Inspect schemas and run bounded parameterized reads or approved compare-and-swap writes against MySQL over verified TLS.",
+      auth: {
+        kind: "api-key",
+        hint: "JSON with host, port, user, password, optional database, and optional tlsCa. TLS and public network targets are mandatory."
+      },
+      defaultConsistencyModel: "authoritative",
+      category: "database",
+      rateLimit: { requests: 120, windowMs: 6e4, scope: "data-source" },
+      capabilities: [
+        {
+          name: "mysql.databases.list",
+          class: "read",
+          description: "List databases visible to the connected MySQL user.",
+          parameters: emptySchema2()
+        },
+        {
+          name: "mysql.tables.list",
+          class: "read",
+          description: "List base tables and views in one database.",
+          parameters: {
+            type: "object",
+            properties: { database: identifierSchema("Database name; defaults to the connection database.") },
+            additionalProperties: false
+          }
+        },
+        {
+          name: "mysql.tables.describe",
+          class: "read",
+          description: "Read columns, types, nullability, defaults, and keys for one table.",
+          parameters: {
+            type: "object",
+            properties: {
+              database: identifierSchema("Database name; defaults to the connection database."),
+              table: identifierSchema("Table name.")
+            },
+            required: ["table"],
+            additionalProperties: false
+          }
+        },
+        {
+          name: "mysql.query",
+          class: "read",
+          description: "Run one parameterized SELECT, SHOW, DESCRIBE, or EXPLAIN statement inside a read-only transaction.",
+          parameters: statementSchema(false)
+        },
+        {
+          name: "mysql.execute",
+          class: "mutation",
+          description: "Run one approved parameterized INSERT, UPDATE, DELETE, or REPLACE statement and commit only when the affected-row count matches the caller expectation.",
+          parameters: statementSchema(true),
+          cas: "optimistic-read-verify",
+          externalEffect: true
+        }
+      ]
+    },
+    async test(source) {
+      try {
+        await withConnection(source, createConnection, resolveHost, async (connection) => {
+          await connection.ping();
+        });
+        return { ok: true };
+      } catch (error) {
+        return { ok: false, reason: safeErrorMessage3(error) };
+      }
+    },
+    async executeRead(inv) {
+      const query2 = readQuery2(inv);
+      assertReadStatement(query2.statement);
+      const data4 = await withConnection(inv.source, createConnection, resolveHost, async (connection) => {
+        await executeStatement(connection, {
+          statement: "START TRANSACTION READ ONLY",
+          parameters: []
+        }, queryTimeout(inv.source));
+        try {
+          const [rows, fields] = await executeStatement(connection, query2, queryTimeout(inv.source));
+          if (!Array.isArray(rows)) throw new Error("MySQL read returned a non-row result");
+          return boundedResult(rows, fields);
+        } finally {
+          await connection.rollback().catch(() => void 0);
+        }
+      });
+      return { data: data4, fetchedAt: Date.now() };
+    },
+    async executeMutation(inv) {
+      if (inv.capabilityName !== "mysql.execute") {
+        throw new Error(`Unknown MySQL mutation capability: ${inv.capabilityName}`);
+      }
+      const query2 = readStatementArgs(inv.args);
+      assertMutationStatement(query2.statement);
+      const expectedAffectedRows = readBoundedInteger(
+        inv.args.expectedAffectedRows,
+        -1,
+        0,
+        MAX_RESULT_ROWS,
+        "expectedAffectedRows"
+      );
+      if (expectedAffectedRows < 0) throw new Error("expectedAffectedRows is required");
+      return withConnection(inv.source, createConnection, resolveHost, async (connection) => {
+        await connection.beginTransaction();
+        try {
+          const [result] = await executeStatement(connection, query2, queryTimeout(inv.source));
+          const affectedRows = readAffectedRows(result);
+          if (affectedRows !== expectedAffectedRows) {
+            await connection.rollback();
+            return {
+              status: "conflict",
+              alternatives: [],
+              currentState: { affectedRows },
+              message: `MySQL write affected ${affectedRows} rows; expected ${expectedAffectedRows}. The transaction was rolled back.`
+            };
+          }
+          await connection.commit();
+          return committedMutation(result, affectedRows);
+        } catch (error) {
+          await connection.rollback().catch(() => void 0);
+          throw error;
+        }
+      });
+    }
+  };
+}
+var mysqlConnector = createMySqlConnector();
+async function defaultCreateConnection(config) {
+  return createMysqlConnection(config);
+}
+async function withConnection(source, createConnection, resolveHost, run) {
+  const credentials = readCredentials5(source);
+  const addresses = await resolveHost(credentials.host);
+  if (addresses.length === 0) throw new Error("MySQL host did not resolve");
+  const address = addresses[0];
+  let connection;
+  try {
+    connection = await createConnection({
+      host: credentials.host,
+      port: credentials.port,
+      user: credentials.user,
+      password: credentials.password,
+      database: credentials.database,
+      connectTimeout: credentials.connectTimeoutMs,
+      multipleStatements: false,
+      namedPlaceholders: false,
+      supportBigNumbers: true,
+      bigNumberStrings: true,
+      decimalNumbers: false,
+      dateStrings: true,
+      timezone: "Z",
+      charset: "utf8mb4",
+      enableKeepAlive: true,
+      maxPreparedStatements: 100,
+      stream: () => createSocket({ host: address, port: credentials.port }),
+      ssl: {
+        ca: credentials.tlsCa,
+        minVersion: "TLSv1.2",
+        rejectUnauthorized: true,
+        verifyIdentity: true
+      }
+    });
+    return await run(connection);
+  } finally {
+    if (connection) await connection.end().catch(() => void 0);
+  }
+}
+function readCredentials5(source) {
+  let raw;
+  if (source.credentials.kind === "custom") raw = source.credentials.values;
+  else if (source.credentials.kind === "api-key") {
+    try {
+      raw = JSON.parse(source.credentials.apiKey);
+    } catch {
+      throw new Error("MySQL credential must be valid JSON");
+    }
+  } else {
+    throw new Error("MySQL requires a structured credential bundle");
+  }
+  if (!isPlainRecord(raw)) throw new Error("MySQL credential must be a JSON object");
+  const host = requiredCredentialString3(raw.host, "host", 253);
+  validateHost(host);
+  const user = requiredCredentialString3(raw.user ?? raw.username, "user", 128);
+  const password = requiredCredentialString3(raw.password, "password", 4096);
+  const database = readOptionalString(raw.database, "database");
+  if (database && database.length > 64) throw new Error("MySQL credential database exceeds 64 characters");
+  const tlsCa = readOptionalString(raw.tlsCa, "tlsCa");
+  if (tlsCa && Buffer.byteLength(tlsCa, "utf8") > 1024 * 1024) {
+    throw new Error("MySQL credential tlsCa exceeds the 1 MiB limit");
+  }
+  return {
+    host,
+    port: readBoundedInteger(raw.port, 3306, 1, 65535, "port"),
+    user,
+    password,
+    database,
+    tlsCa,
+    connectTimeoutMs: readBoundedInteger(raw.connectTimeoutMs, 1e4, 1e3, 3e4, "connectTimeoutMs"),
+    queryTimeoutMs: readBoundedInteger(raw.queryTimeoutMs, DEFAULT_QUERY_TIMEOUT_MS, 1e3, 6e4, "queryTimeoutMs")
+  };
+}
+function readQuery2(inv) {
+  if (inv.capabilityName === "mysql.databases.list") {
+    return {
+      statement: "SELECT SCHEMA_NAME AS databaseName, DEFAULT_CHARACTER_SET_NAME AS characterSet, DEFAULT_COLLATION_NAME AS collation FROM information_schema.SCHEMATA ORDER BY SCHEMA_NAME",
+      parameters: []
+    };
+  }
+  if (inv.capabilityName === "mysql.tables.list") {
+    const database = readDatabase(inv.args.database, inv.source);
+    return {
+      statement: "SELECT TABLE_NAME AS tableName, TABLE_TYPE AS tableType, ENGINE AS engine, TABLE_ROWS AS estimatedRows, TABLE_COLLATION AS collation FROM information_schema.TABLES WHERE TABLE_SCHEMA = ? ORDER BY TABLE_NAME",
+      parameters: [database]
+    };
+  }
+  if (inv.capabilityName === "mysql.tables.describe") {
+    const database = readDatabase(inv.args.database, inv.source);
+    const table = readIdentifier(inv.args.table, "table");
+    return {
+      statement: "SELECT COLUMN_NAME AS columnName, ORDINAL_POSITION AS ordinalPosition, COLUMN_DEFAULT AS columnDefault, IS_NULLABLE AS isNullable, DATA_TYPE AS dataType, COLUMN_TYPE AS columnType, COLUMN_KEY AS columnKey, EXTRA AS extra FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ? ORDER BY ORDINAL_POSITION",
+      parameters: [database, table]
+    };
+  }
+  if (inv.capabilityName === "mysql.query") return readStatementArgs(inv.args);
+  throw new Error(`Unknown MySQL read capability: ${inv.capabilityName}`);
+}
+function readStatementArgs(args) {
+  const statement = requiredString7(args.statement, "statement");
+  if (Buffer.byteLength(statement, "utf8") > 1024 * 1024) throw new Error("statement exceeds the 1 MiB limit");
+  const parameters = args.parameters === void 0 ? [] : args.parameters;
+  if (!Array.isArray(parameters) || parameters.length > MAX_PARAMETERS) {
+    throw new Error(`parameters must be an array with at most ${MAX_PARAMETERS} entries`);
+  }
+  for (const [index, value] of parameters.entries()) {
+    if (value !== null && !["string", "number", "boolean"].includes(typeof value)) {
+      throw new Error(`parameters[${index}] must be a JSON scalar or null`);
+    }
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new Error(`parameters[${index}] must be finite`);
+    }
+  }
+  if (Buffer.byteLength(JSON.stringify(parameters), "utf8") > MAX_PARAMETER_BYTES) {
+    throw new Error(`parameters exceed the ${MAX_PARAMETER_BYTES}-byte limit`);
+  }
+  return { statement, parameters };
+}
+function assertReadStatement(statement) {
+  const keyword = leadingKeyword(statement);
+  if (!["SELECT", "SHOW", "DESCRIBE", "DESC", "EXPLAIN", "WITH"].includes(keyword)) {
+    throw new Error("mysql.query accepts only SELECT, SHOW, DESCRIBE, or EXPLAIN statements");
+  }
+  if (/\b(?:INTO\s+(?:OUTFILE|DUMPFILE)|LOAD_FILE\s*\(|GET_LOCK\s*\(|RELEASE_LOCK\s*\(|SLEEP\s*\(|BENCHMARK\s*\(|FOR\s+UPDATE|LOCK\s+IN\s+SHARE\s+MODE)\b/i.test(statement)) {
+    throw new Error("mysql.query rejects file, lock, and delay side effects");
+  }
+}
+function assertMutationStatement(statement) {
+  const keyword = leadingKeyword(statement);
+  if (!["INSERT", "UPDATE", "DELETE", "REPLACE"].includes(keyword)) {
+    throw new Error("mysql.execute accepts only INSERT, UPDATE, DELETE, or REPLACE statements");
+  }
+}
+function leadingKeyword(statement) {
+  const withoutComments = statement.replace(/^\s*(?:--[^\n]*(?:\n|$)|#[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/\s*)*/u, "").trimStart();
+  return /^[A-Za-z]+/.exec(withoutComments)?.[0]?.toUpperCase() ?? "";
+}
+async function executeStatement(connection, query2, timeout) {
+  return connection.execute({ sql: query2.statement, values: query2.parameters, timeout });
+}
+function boundedResult(rows, fields) {
+  if (rows.length > MAX_RESULT_ROWS) throw new Error(`MySQL result exceeds ${MAX_RESULT_ROWS} rows`);
+  const data4 = {
+    rows: jsonSafe(rows),
+    columns: fields.map((field) => ({
+      name: field.name,
+      table: field.table,
+      database: field.schema,
+      type: field.type
+    })),
+    rowCount: rows.length
+  };
+  const serialized = JSON.stringify(data4);
+  if (Buffer.byteLength(serialized, "utf8") > MAX_RESULT_BYTES2) {
+    throw new Error(`MySQL result exceeds the ${MAX_RESULT_BYTES2}-byte limit`);
+  }
+  return data4;
+}
+function readAffectedRows(result) {
+  if (!isPlainRecord(result) || !Number.isInteger(result.affectedRows) || result.affectedRows < 0) {
+    throw new Error("MySQL mutation did not return an affected-row count");
+  }
+  return result.affectedRows;
+}
+function committedMutation(result, affectedRows) {
+  const header2 = result;
+  const rawInsertId = header2.insertId;
+  const insertId = typeof rawInsertId === "number" && Number.isSafeInteger(rawInsertId) ? rawInsertId : typeof rawInsertId === "string" ? rawInsertId : void 0;
+  return {
+    status: "committed",
+    data: jsonSafe({
+      affectedRows,
+      changedRows: header2.changedRows,
+      insertId,
+      warningStatus: header2.warningStatus
+    }),
+    committedAt: Date.now(),
+    idempotentReplay: false
+  };
+}
+function readDatabase(value, source) {
+  const explicit = value === void 0 ? void 0 : readIdentifier(value, "database");
+  if (explicit) return explicit;
+  const credentials = readCredentials5(source);
+  if (!credentials.database) throw new Error("database is required when the connection has no default database");
+  return credentials.database;
+}
+function queryTimeout(source) {
+  return readCredentials5(source).queryTimeoutMs;
+}
+function requiredString7(value, label) {
+  const parsed = readOptionalString(value, label);
+  if (!parsed) throw new Error(`${label} is required`);
+  return parsed;
+}
+function requiredCredentialString3(value, label, maxLength) {
+  const parsed = readOptionalString(value, label);
+  if (!parsed) throw new Error(`MySQL credential ${label} is required`);
+  if (parsed.length > maxLength) throw new Error(`MySQL credential ${label} exceeds ${maxLength} characters`);
+  return parsed;
+}
+function readIdentifier(value, label) {
+  const parsed = requiredString7(value, label);
+  if (parsed.length > 64) throw new Error(`${label} exceeds 64 characters`);
+  return parsed;
+}
+function validateHost(host) {
+  const normalized = host.toLowerCase();
+  if (host.length > 253 || host.includes("://") || /[\s/@]/.test(host) || normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || isIP5(host) === 0 && !/^[A-Za-z0-9.-]+$/.test(host) || host.split(".").some((label) => !label || label.startsWith("-") || label.endsWith("-"))) {
+    throw new Error("MySQL host must be a public hostname or IP address without a scheme");
+  }
+}
+function emptySchema2() {
+  return { type: "object", properties: {}, additionalProperties: false };
+}
+function identifierSchema(description) {
+  return { type: "string", minLength: 1, maxLength: 64, description };
+}
+function statementSchema(mutation) {
+  const properties = {
+    statement: { type: "string", minLength: 1, maxLength: 1024 * 1024 },
+    parameters: {
+      type: "array",
+      maxItems: MAX_PARAMETERS,
+      items: { type: ["string", "number", "boolean", "null"] },
+      description: "Values bound to ? placeholders in order."
+    }
+  };
+  if (mutation) {
+    properties.expectedAffectedRows = {
+      type: "integer",
+      minimum: 0,
+      maximum: MAX_RESULT_ROWS,
+      description: "Commit only when MySQL reports exactly this many affected rows."
+    };
+  }
+  return {
+    type: "object",
+    properties,
+    required: mutation ? ["statement", "expectedAffectedRows"] : ["statement"],
+    additionalProperties: false
+  };
+}
+function safeErrorMessage3(error) {
+  return error instanceof Error && error.message ? error.message : "MySQL connection failed";
+}
+
 // src/connectors/adapters/segment.ts
 var segmentConnector = declarativeRestConnector({
   kind: "segment",
@@ -63698,6 +65676,7 @@ var CONNECTOR_ADAPTER_FACTORIES = [
   defineFactoryAdapter(() => digitalOceanConnector, {}),
   defineFactoryAdapter(() => clicksendConnector, {}),
   defineFactoryAdapter(() => metabaseConnector, {}),
+  defineFactoryAdapter(() => mysqlConnector, {}),
   defineFactoryAdapter(
     () => microsoftDynamics365BusinessCentralConnector,
     microsoftOAuthEnvMap
@@ -63755,6 +65734,10 @@ var CONNECTOR_ADAPTER_FACTORIES = [
   defineFactoryAdapter(() => amazonSqsConnector, {}),
   defineFactoryAdapter(() => httpConnector, {}),
   defineFactoryAdapter(() => rssConnector, {}),
+  defineFactoryAdapter(() => kafkaConnector, {}),
+  defineFactoryAdapter(() => duckdbConnector, {}),
+  defineFactoryAdapter(() => rabbitMqConnector, {}),
+  defineFactoryAdapter(() => redisConnector, {}),
   defineFactoryAdapter(() => csvFilesConnector, {}),
   defineFactoryAdapter(() => excelFilesConnector, {}),
   defineFactoryAdapter(() => parquetFilesConnector, {}),
@@ -63827,10 +65810,7 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "MONDAY_OAUTH_CLIENT_ID",
     clientSecret: "MONDAY_OAUTH_CLIENT_SECRET"
   }),
-  defineFactoryAdapter(() => clickupConnector, {
-    clientId: "CLICKUP_OAUTH_CLIENT_ID",
-    clientSecret: "CLICKUP_OAUTH_CLIENT_SECRET"
-  }),
+  defineFactoryAdapter(() => clickupConnector, {}),
   defineFactoryAdapter(() => basecampConnector, {
     clientId: "BASECAMP_OAUTH_CLIENT_ID",
     clientSecret: "BASECAMP_OAUTH_CLIENT_SECRET"
@@ -69735,7 +71715,7 @@ var sanityConnector = declarativeRestConnector({
 var figmaConnector = declarativeRestConnector({
   kind: "figma",
   displayName: "Figma",
-  description: "Read Figma files, components, comments, and team projects; post comments back into the design source of truth.",
+  description: "Read Figma files, components, comments, and project metadata; post comments back into the design source of truth.",
   auth: {
     kind: "oauth2",
     authorizationUrl: "https://www.figma.com/oauth",
@@ -69748,7 +71728,7 @@ var figmaConnector = declarativeRestConnector({
       "file_dev_resources:read",
       "file_versions:read",
       "library_content:read",
-      "projects:read",
+      "project_metadata:read",
       "team_library_content:read",
       "webhooks:write"
     ],
@@ -69964,35 +71944,16 @@ var figmaConnector = declarativeRestConnector({
       requiredScopes: ["file_comments:read"]
     },
     {
-      name: "teams.projects.list",
+      name: "projects.metadata.get",
       class: "read",
-      description: "List projects inside a Figma team.",
+      description: "Get metadata for a Figma project visible to the authenticated user.",
       parameters: {
         type: "object",
-        properties: { team_id: { type: "string" } },
-        required: ["team_id"]
-      },
-      request: { method: "GET", path: "/v1/teams/{team_id}/projects" },
-      requiredScopes: ["projects:read"]
-    },
-    {
-      name: "projects.files.list",
-      class: "read",
-      description: "List Figma files inside a project.",
-      parameters: {
-        type: "object",
-        properties: {
-          project_id: { type: "string" },
-          branch_data: { type: "boolean" }
-        },
+        properties: { project_id: { type: "string" } },
         required: ["project_id"]
       },
-      request: {
-        method: "GET",
-        path: "/v1/projects/{project_id}/files",
-        query: { branch_data: "{branch_data}" }
-      },
-      requiredScopes: ["projects:read"]
+      request: { method: "GET", path: "/v1/projects/{project_id}/meta" },
+      requiredScopes: ["project_metadata:read"]
     },
     {
       name: "teams.components.list",
@@ -70159,7 +72120,7 @@ var figmaConnector = declarativeRestConnector({
 var figjamConnector = declarativeRestConnector({
   kind: "figjam",
   displayName: "FigJam",
-  description: "Read FigJam boards (stickies, connectors, shapes, sections), list team/project boards, render board images, and post or delete board comments through the Figma REST API.",
+  description: "Read FigJam boards (stickies, connectors, shapes, sections), project metadata, render board images, and post or delete board comments through the Figma REST API.",
   auth: {
     kind: "oauth2",
     authorizationUrl: "https://www.figma.com/oauth",
@@ -70170,7 +72131,7 @@ var figjamConnector = declarativeRestConnector({
       "file_comments:write",
       "file_content:read",
       "file_versions:read",
-      "projects:read",
+      "project_metadata:read",
       "webhooks:write"
     ],
     clientIdEnv: "FIGMA_OAUTH_CLIENT_ID",
@@ -70328,33 +72289,16 @@ var figjamConnector = declarativeRestConnector({
       requiredScopes: ["file_comments:read"]
     },
     {
-      name: "teams.projects.list",
-      class: "read",
-      description: "List projects inside a Figma team (FigJam boards live alongside Figma design files inside projects).",
-      parameters: {
-        type: "object",
-        properties: { team_id: { type: "string" } },
-        required: ["team_id"]
-      },
-      request: { method: "GET", path: "/v1/teams/{team_id}/projects" },
-      requiredScopes: ["projects:read"]
-    },
-    {
-      name: "projects.files.list",
+      name: "projects.metadata.get",
       class: "read",
-      description: 'List files inside a project \u2014 response items expose a `type` field; FigJam boards are returned with type "jam" and design files with type "design".',
+      description: "Get metadata for a Figma/FigJam project visible to the authenticated user.",
       parameters: {
         type: "object",
-        properties: {
-          project_id: { type: "string" }
-        },
+        properties: { project_id: { type: "string" } },
         required: ["project_id"]
       },
-      request: {
-        method: "GET",
-        path: "/v1/projects/{project_id}/files"
-      },
-      requiredScopes: ["projects:read"]
+      request: { method: "GET", path: "/v1/projects/{project_id}/meta" },
+      requiredScopes: ["project_metadata:read"]
     },
     {
       name: "files.comments.create",
@@ -143646,6 +145590,7 @@ export {
   deepgramConnector,
   detectingAiConnector,
   digitalPilotConnector,
+  duckdbConnector,
   docsbotConnector,
   dripConnector,
   echowinConnector,
@@ -143754,6 +145699,9 @@ export {
   jiraCloudConnector,
   jotformConnector,
   justcallConnector,
+  createKafkaConnector,
+  kafkaConnector,
+  publicKafkaSocketFactory,
   leadConnectorConnector,
   lemonSqueezyConnector,
   linearConnector,
@@ -143791,6 +145739,10 @@ export {
   pipedriveConnector,
   parquetFilesConnector,
   quickbooksConnector,
+  createRabbitMqConnector,
+  rabbitMqConnector,
+  createRedisConnector,
+  redisConnector,
   recallAiConnector,
   rampConnector,
   ringcentralConnector,
@@ -143858,6 +145810,8 @@ export {
   googleBigqueryConnector,
   hightouchConnector,
   metabaseConnector,
+  createMySqlConnector,
+  mysqlConnector,
   segmentConnector,
   supabaseConnector,
   builtwithConnector,
@@ -144249,4 +146203,4 @@ export {
   demandbaseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-ARONCYSG.js.map
+//# sourceMappingURL=chunk-FOIC32DF.js.map